joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ba70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x4826e0]
add esp, 0xc
test al, 1
jne 0x40babf
or eax, 1
push 0x45ae80
mov dword [0x4826e0], eax
call fcn.004521b7
add esp, 4
sub esp, 8
lea eax, [ebp - 0x20c]
push eax
call fcn.00444100
test al, al
je 0x40bb62
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bae0
sub ecx, edx
sar ecx, 1
je 0x40bb62
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x45f36c
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40bb62
mov eax, dword [0x4826e0]
test al, 1
jne 0x40bb57
or eax, 1
push 0x45ae80
mov dword [0x4826e0], eax
call fcn.004521b7
add esp, 4
lea ecx, [ebp - 0x414]
call fcn.004441f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.00452076
mov esp, ebp
pop ebp
ret

Function at 0x40bb80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
xor bl, bl
call sub.MSVCR110.dll_memset
add esp, 0xc
test esi, esi
je 0x40bc81
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bbc4
sub ecx, edx
sar ecx, 1
je 0x40bc81
push 0x45f374
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40bc6f
mov eax, dword [0x4826e0]
test al, 1
jne 0x40bc1b
or eax, 1
push 0x45ae80
mov dword [0x4826e0], eax
call fcn.004521b7
add esp, 4
lea ecx, [ebp - 0x20c]
call fcn.004441f0
mov bl, al
test bl, bl
je 0x40bc53
lea eax, [ebp - 0x20c]
push eax
push str.ClearLog__DeleteFolder_succeed:_path___s_
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLogNoMask]
add esp, 8
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.ClearLog__DeleteFolder_failed:_path___s__err___d_
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x40bca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
mov esi, ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
test esi, esi
je 0x40be33
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bce1
sub ecx, edx
sar ecx, 1
je 0x40be33
push 0x45f374
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x414]
push eax
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x4826e0]
add esp, 0xc
test al, 1
jne 0x40bd47
or eax, 1
push 0x45ae80
mov dword [0x4826e0], eax
call fcn.004521b7
add esp, 4
sub esp, 8
lea eax, [ebp - 0x61c]
push eax
call fcn.00444100
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x61c]
push str.log_bak
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
je 0x40be33
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x40bdbd
call fcn.004050a0
lea ecx, [ebp - 0x20c]
call fcn.004441f0
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x414]
call fcn.0042a690
mov esi, eax
lea eax, [ebp - 0x20c]
test esi, esi
jne 0x40be06
push eax
lea eax, [ebp - 0x414]
push eax
push str.BackupLog__CopyFolder_succeed:_src___s__dst___s_
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
xor eax, eax
test esi, esi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
push esi
push eax
lea eax, [ebp - 0x414]
push eax
push str.BackupLog__CopyFolder_failed:_src___s__dst___s__err___d_
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0x10
xor eax, eax
test esi, esi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x40c370
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454f49
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 5
xor eax, eax
push str._stop
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x428], 0
mov word [ebp - 0x438], ax
call fcn.00406c00
mov cl, 1
mov dword [ebp - 4], 0
call fcn.00409d10
mov esi, dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
test al, al
je 0x40c482
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.0040b7f0
mov eax, dword [0x48277c]
test eax, eax
jne 0x40c447
push 0xe4
call esi
add esp, 4
mov dword [ebp - 0x43c], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x40c43c
mov ecx, eax
call fcn.004122b0
jmp 0x40c43e
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x48277c], eax
cmp word [ebp - 0x218], 0
lea edx, [eax + 0x90]
jne 0x40c45b
xor ecx, ecx
jmp 0x40c473
lea ecx, [ebp - 0x218]
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c464
sub ecx, edi
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, edx
call fcn.00406c00
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x48277c]
add esp, 0xc
test eax, eax
jne 0x40c4d1
push 0xe4
call esi
add esp, 4
mov dword [ebp - 0x43c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x40c4ca
mov ecx, eax
call fcn.004122b0
jmp 0x40c4cc
xor eax, eax
mov dword [0x48277c], eax
add eax, 0x90
cmp dword [eax + 0x14], 8
jb 0x40c4de
mov eax, dword [eax]
push 0x45f1b8
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c549
cmp dword [ebp - 0x424], 8
mov eax, dword [0x482720]
lea esi, [ebp - 0x438]
cmovae esi, dword [ebp - 0x438]
test al, 1
jne 0x40c534
or eax, 1
push 0x45aeb0
mov dword [0x482720], eax
call fcn.004521b7
add esp, 4
push 0
push 1
push esi
lea eax, [ebp - 0x420]
push eax
call fcn.00443c20
mov bl, 1
jmp 0x40c54b
xor bl, bl
cmp dword [ebp - 0x424], 8
jb 0x40c563
push dword [ebp - 0x438]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x40c590
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4551e7
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov dword [ebp - 4], 0
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x48277c]
add esp, 0xc
test eax, eax
jne 0x40c616
push 0xe4
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x428], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x40c60f
mov ecx, eax
call fcn.004122b0
jmp 0x40c611
xor eax, eax
mov dword [0x48277c], eax
add eax, 0x90
cmp dword [eax + 0x14], 8
jb 0x40c623
mov eax, dword [eax]
push str.cfgisafe.dat
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x18
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c6a0
push eax
push eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40c6a0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp - 0x420]
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c6d4
lea eax, [ebp - 0x420]
push eax
push esi
push str.partner
push str.general
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp + 0x1c], 8
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
jb 0x40c6f0
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x40c710
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4551e7
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov dword [ebp - 4], 0
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x48277c]
add esp, 0xc
test eax, eax
jne 0x40c796
push 0xe4
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x428], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x40c78f
mov ecx, eax
call fcn.004122b0
jmp 0x40c791
xor eax, eax
mov dword [0x48277c], eax
add eax, 0x90
cmp dword [eax + 0x14], 8
jb 0x40c7a3
mov eax, dword [eax]
push str.cfgisafe.dat
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x18
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c820
push eax
push eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40c820
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp - 0x420]
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c854
lea eax, [ebp - 0x420]
push eax
push esi
push str.promote
push str.general
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp + 0x1c], 8
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
jb 0x40c870
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x40c890
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45521f
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [0x47f2aa]
mov byte [ebp - 0x428], al
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x48277c]
add esp, 0xc
test eax, eax
jne 0x40c91d
push 0xe4
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x42c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x40c916
mov ecx, eax
call fcn.004122b0
jmp 0x40c918
xor eax, eax
mov dword [0x48277c], eax
add eax, 0x90
cmp dword [eax + 0x14], 8
jb 0x40c92a
mov eax, dword [eax]
push str.cfgisafe.dat
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor ebx, ebx
cmp byte [ebp - 0x428], bl
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
setne bl
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x18
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c9b2
push eax
push eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40c9b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push str.virus
push str.general
lea ecx, [ebp - 0x424]
call fcn.00443f00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x40c9f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45521f
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x425], cl
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x48277c]
add esp, 0xc
test eax, eax
jne 0x40ca78
push 0xe4
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x42c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x40ca71
mov ecx, eax
call fcn.004122b0
jmp 0x40ca73
xor eax, eax
mov dword [0x48277c], eax
add eax, 0x90
cmp dword [eax + 0x14], 8
jb 0x40ca85
mov eax, dword [eax]
push str.cfgisafe.dat
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor ebx, ebx
cmp byte [ebp - 0x425], bl
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
setne bl
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x18
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40cb0d
push eax
push eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40cb0d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push str.silence
push str.general
lea ecx, [ebp - 0x424]
call fcn.00443f00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret

Function at 0x40cb40
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push str.cfgisafe.dat
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
test eax, eax
jne 0x40cbe0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x414]
push eax
push 0
push str.silence
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x40cc10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45519f
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCR110.dll__time64]
add esp, 4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x48277c]
add esp, 0xc
test eax, eax
jne 0x40cca1
push 0xe4
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x434], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x40cc9a
mov ecx, eax
call fcn.004122b0
jmp 0x40cc9c
xor eax, eax
mov dword [0x48277c], eax
add eax, 0x90
cmp dword [eax + 0x14], 8
jb 0x40ccae
mov eax, dword [eax]
push str.cfgisafe.dat
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x208
lea eax, [ebp - 0x42c]
push 0
push eax
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x42c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40cd2e
push eax
push eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40cd2e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x430]
push dword [ebp - 0x220]
sub esp, 8
call fcn.00443fa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x40cd70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45521f
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [0x47f2a8]
mov byte [ebp - 0x428], al
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
mov eax, dword [0x48277c]
add esp, 0xc
test eax, eax
jne 0x40cdfd
push 0xe4
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x42c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x40cdf6
mov ecx, eax
call fcn.004122b0
jmp 0x40cdf8
xor eax, eax
mov dword [0x48277c], eax
add eax, 0x90
cmp dword [eax + 0x14], 8
jb 0x40ce0a
mov eax, dword [eax]
push str.cfgisafe.dat
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor ebx, ebx
cmp byte [ebp - 0x428], bl
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
setne bl
mov dword [ebp - method.CProfileIni.virtual_0], vtable.CProfileIni.0
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0x18
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40ce92
push eax
push eax
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40ce92
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push str.EnableAppStore
push str.AppStoreConfig
lea ecx, [ebp - 0x424]
call fcn.00443f00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret
Function at 0x40ee60
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454856
mov eax, dword fs:[0]
push eax
sub esp, 0x664
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
xor bl, bl
call sub.MSVCR110.dll_memset
add esp, 0xc
call fcn.0042da20
test al, al
lea eax, [ebp - 0x218]
je 0x40eec6
push str.iSafeRKScanShell64.dll
jmp 0x40eecb
push str.iSafeRKScanShell.dll
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x40f06a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x628]
push str.System32_regsvr32.exe
push eax
lea eax, [ebp - 0x420]
push eax
call esi
lea eax, [ebp - 0x420]
push eax
call edi
test eax, eax
je 0x40f06a
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x670]
call fcn.00406d00
push eax
mov edx, str._s__
lea ecx, [ebp - 0x658]
mov dword [ebp - 4], 0
call fcn.00411770
push 0x45ef18
mov edx, eax
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 1
call fcn.00411660
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 8
cmp dword [ebp - 0x644], 8
jb 0x40efbd
push dword [ebp - 0x658]
call esi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x65c], 8
mov dword [ebp - 0x644], 7
mov dword [ebp - 0x648], 0
mov word [ebp - 0x658], ax
jb 0x40efee
push dword [ebp - 0x670]
call esi
add esp, 4
cmp dword [ebp - 0x62c], 8
mov eax, dword [0x482720]
lea edi, [ebp - 0x640]
cmovae edi, dword [ebp - 0x640]
test al, 1
jne 0x40f020
or eax, 1
push 0x45aeb0
mov dword [0x482720], eax
call fcn.004521b7
add esp, 4
push 0
push 1
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.00443c20
cmp dword [ebp - 0x62c], 8
lea ecx, [ebp - 0x640]
cmovae ecx, dword [ebp - 0x640]
push ecx
push str.UnRegisterRKScanShellDLL__cmdline___s_
mov bl, al
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLogNoMask]
add esp, 8
cmp dword [ebp - 0x62c], 8
jb 0x40f06a
push dword [ebp - 0x640]
call esi
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret