joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bff0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
push esi
call dword [0x4280c4]
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..360SelfProtection
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0
call dword [0x4280c8]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c05f
push edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x10]
push 4
push ecx
lea edx, [esp + 0x1c]
push 4
push edx
push 0x22204c
push esi
call dword [0x4280cc]
push esi
mov edi, eax
call dword [0x4280d0]
test edi, edi
pop edi
je 0x40c05f
mov eax, dword [esp + 4]
test eax, eax
jne 0x40c09e
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x40c06e
xor eax, eax
pop esi
add esp, 0xc
ret
push esi
call dword [0x4285d0]
test eax, eax
je 0x40c09e
push esi
call fcn.004090f0
add esp, 4
test eax, eax
jne 0x40c09e
push 1
call fcn.00425090
push eax
push esi
call fcn.004252a0
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x40c0b0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x430684]
sub esp, 0x80c
test eax, eax
je 0x40c0cd
mov ecx, dword [0x430688]
test ecx, ecx
jne 0x40c216
push esi
push edi
lea eax, [esp + 0x14]
push 0x400
push eax
push 0
call dword [0x4280c0]
mov edi, dword [0x4285c8]
lea ecx, [esp + 0x14]
push ecx
call edi
mov eax, dword [0x43068c]
xor esi, esi
test eax, eax
jle 0x40c10a
lea edx, [esp + 0x14]
push edx
call edi
mov eax, dword [0x43068c]
inc esi
cmp esi, eax
jl 0x40c0f9
lea eax, [esp + 0x14]
push str.MiniUI.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [0x4285cc]
call dword [0x4280c4]
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..360SelfProtection
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
call dword [0x4280c8]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c188
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x10]
push 4
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push 0x22204c
push esi
call dword [0x4280cc]
push esi
mov edi, eax
call dword [0x4280d0]
test edi, edi
je 0x40c188
mov eax, dword [esp + 8]
test eax, eax
jne 0x40c1c9
lea edx, [esp + 0x14]
test edx, edx
je 0x40c1c5
lea eax, [esp + 0x14]
push eax
call dword [0x4285d0]
test eax, eax
je 0x40c1c9
lea ecx, [esp + 0x14]
push ecx
call fcn.004090f0
add esp, 4
test eax, eax
jne 0x40c1c9
push 1
call fcn.00425090
lea edx, [esp + 0x18]
push eax
push edx
call fcn.004252a0
add esp, 0xc
xor eax, eax
jmp 0x40c1d4
lea eax, [esp + 0x14]
push eax
call dword [0x4280d4]
pop edi
mov dword [0x430688], eax
test eax, eax
pop esi
je 0x40c20b
push str.GetMiniUI
push eax
call dword [0x4280d8]
test eax, eax
mov dword [0x430684], eax
jne 0x40c216
mov ecx, dword [0x430688]
push ecx
call dword [0x4280dc]
mov dword [0x430688], 0
xor eax, eax
add esp, 0x80c
ret 0xc
call eax
test eax, eax
je 0x40c20b
mov ecx, dword [esp + 0x818]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x818]
push ecx
mov ecx, dword [esp + 0x818]
push ecx
push eax
call dword [edx]
add esp, 0x80c
ret 0xc
Function at 0x40cb90
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x430670]
sub esp, 0x80c
test eax, eax
push ebx
mov ebx, dword [esp + 0x824]
push ebp
mov ebp, dword [esp + 0x824]
jne 0x40cd39
mov eax, dword [0x430674]
push esi
test eax, eax
jne 0x40ccd1
push edi
lea eax, [esp + 0x1c]
push 0x400
push eax
push 0
call dword [0x4280c0]
mov edi, dword [0x4285c8]
lea ecx, [esp + 0x1c]
push ecx
call edi
mov eax, dword [0x430678]
xor esi, esi
test eax, eax
jle 0x40cbfd
lea edx, [esp + 0x1c]
push edx
call edi
mov eax, dword [0x430678]
inc esi
cmp esi, eax
jl 0x40cbec
lea eax, [esp + 0x1c]
push str.360Common.dll
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [0x4285cc]
call dword [0x4280c4]
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..360SelfProtection
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 0
call dword [0x4280c8]
mov esi, eax
cmp esi, 0xffffffff
je 0x40cc7b
lea edx, [esp + 0x18]
push 0
push edx
lea eax, [esp + 0x18]
push 4
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push 0x22204c
push esi
call dword [0x4280cc]
push esi
mov edi, eax
call dword [0x4280d0]
test edi, edi
je 0x40cc7b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40ccbc
lea edx, [esp + 0x1c]
test edx, edx
je 0x40ccb8
lea eax, [esp + 0x1c]
push eax
call dword [0x4285d0]
test eax, eax
je 0x40ccbc
lea ecx, [esp + 0x1c]
push ecx
call fcn.004090f0
add esp, 4
test eax, eax
jne 0x40ccbc
push 1
call fcn.00425090
lea edx, [esp + 0x20]
push eax
push edx
call fcn.004252a0
add esp, 0xc
xor eax, eax
jmp 0x40ccc7
lea eax, [esp + 0x1c]
push eax
call dword [0x4280d4]
test eax, eax
mov dword [0x430674], eax
pop edi
je 0x40cd2f
mov esi, dword [0x4280d8]
push str.Get360CommonInstance
push eax
call esi
mov ecx, dword [0x430674]
push str.Get360ProductHistoryManager
push ecx
mov dword [0x430670], eax
call esi
mov edx, dword [0x430674]
push str.Create360FireWareStateFunction
push edx
mov dword [0x43066c], eax
call esi
mov dword [0x430668], eax
mov eax, dword [0x430674]
push str.GetFireWallState
push eax
call esi
mov ecx, dword [0x430674]
push str.Create360FireWareStateFunction2
push ecx
mov dword [0x430664], eax
call esi
mov dword [0x430660], eax
mov eax, dword [0x430670]
pop esi
test eax, eax
je 0x40cd53
call eax
test eax, eax
je 0x40cd53
mov edx, dword [eax]
push eax
call dword [edx + 8]
test eax, eax
je 0x40cd53
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40cd87
mov edx, dword [esp + 0x820]
mov eax, dword [esp + 0x81c]
mov ecx, dword [esp + 0x818]
push ebx
push ebp
push edx
push eax
push ecx
call fcn.0040dd10
add esp, 0x14
test eax, eax
je 0x40cd87
pop ebp
mov eax, 1
pop ebx
add esp, 0x80c
ret
mov edx, dword [esp + 0x820]
mov eax, dword [esp + 0x81c]
mov ecx, dword [esp + 0x818]
push ebx
push ebp
push edx
push eax
push ecx
call fcn.0040cdc0
add esp, 0x14
pop ebp
pop ebx
add esp, 0x80c
ret
Function at 0x40fff0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x426f20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_1
xor esi, esi
push 0x4306d8
lea ecx, [esp + 8]
mov dword [esp + 0x24], esi
call sub.MFC42u.DLL_CString::operator
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 4]
push esi
mov dword [esp + 0x24], 1
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x20]
lea ecx, [esp + 4]
push ecx
push eax
mov edx, dword [eax]
call dword [edx]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x411570
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x664
push ebx
push ebp
push esi
mov ebx, ecx
push edi
xor ebp, ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
push 0x103
push eax
mov ecx, ebx
mov dword [esp + 0x20], ebp
call fcn.00411b40
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebx
call fcn.00411ac0
test eax, eax
je 0x4116b8
lea edx, [esp + 0x1c]
push 0x42ee18
push edx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
cmp esi, ebp
mov dword [esp + 0x10], esi
je 0x41175a
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push ebp
push ebp
push esi
call edi
push esi
push 4
lea eax, [esp + 0x2c]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, 4
je 0x41161f
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
call dword [0x4280e8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x664
ret
cmp dword [esp + 0x18], 1
je 0x411646
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea edx, [esp + 0x1c]
push edx
call dword [0x4280e8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x664
ret
push 2
push ebp
push esi
call edi
mov eax, dword [ebx + 0xc]
add esp, 0xc
cmp eax, ebp
jle 0x411750
mov dword [esp + 0x14], eax
mov esi, dword [ebx + 8]
mov ecx, 0x114
xor eax, eax
lea edi, [esp + 0x224]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
add esi, ebp
mov ecx, 0x114
lea edi, [esp + 0x224]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x450
lea ecx, [esp + 0x22c]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [esp + 0x24]
add esp, 0x10
add ebp, 0x450
dec eax
mov dword [esp + 0x14], eax
jne 0x41165e
mov esi, dword [esp + 0x10]
jmp 0x411750
lea edx, [esp + 0x1c]
push 0x42e1a8
push edx
mov dword [esp + 0x20], 1
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
cmp esi, ebp
mov dword [esp + 0x14], esi
je 0x41175a
push esi
push 4
lea eax, [esp + 0x20]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [ebx + 0xc]
add esp, 0x10
cmp eax, ebp
jle 0x411750
mov dword [esp + 0x10], eax
mov esi, dword [ebx + 8]
mov ecx, 0x114
xor eax, eax
lea edi, [esp + 0x224]
rep stosd dword es:[edi], eax
add esi, ebp
mov ecx, 0x114
lea edi, [esp + 0x224]
lea edx, [esp + 0x224]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
push ecx
push 0x450
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [esp + 0x20]
add esp, 0x10
add ebp, 0x450
dec eax
mov dword [esp + 0x10], eax
jne 0x4116fb
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x664
ret
Function at 0x412260
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x427010
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
xor esi, esi
push edi
lea ecx, [esp + 0x14]
mov ebp, 0x80004005
mov dword [esp + 0x10], esi
xor ebx, ebx
call sub.MFC42u.DLL_CString::CString_1
push 0x4306d8
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], esi
call sub.MFC42u.DLL_CString::operator
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
lea eax, [esp + 0x10]
mov dword [esp + 0x2c], 1
push eax
call fcn.0040f0d0
cmp eax, esi
jl 0x412325
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
mov edi, dword [edx]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push edx
call dword [edi + 8]
cmp eax, esi
jl 0x412325
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x40]
push ecx
push eax
mov edx, dword [eax]
mov ebx, 1
call dword [edx + 0x10]
cmp eax, esi
jl 0x412325
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x38]
push edi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, esi
jl 0x412325
push 0x64
call dword [0x428088]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
push eax
push edi
push ecx
call fcn.00412370
xor ebp, ebp
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x412345
cmp ebx, esi
je 0x41233b
mov edx, dword [eax]
push eax
call dword [edx + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x415050
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x427555
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x808
mov eax, dword [0x430684]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
mov dword [esp + 0xc], ebx
je 0x415088
cmp dword [0x430688], ebx
jne 0x415172
push edi
lea eax, [esp + 0x14]
push 0x400
push eax
push ebx
call dword [0x4280c0]
mov edi, dword [0x4285c8]
lea ecx, [esp + 0x14]
push ecx
call edi
mov eax, dword [0x43068c]
xor esi, esi
cmp eax, ebx
jle 0x4150c3
lea edx, [esp + 0x14]
push edx
call edi
mov eax, dword [0x43068c]
inc esi
cmp esi, eax
jl 0x4150b2
lea eax, [esp + 0x14]
push str.MiniUI.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [0x4285cc]
push ebx
call dword [0x4280c4]
push eax
call fcn.004023c0
add esp, 8
cmp eax, ebx
pop edi
jne 0x41512e
lea edx, [esp + 0x10]
test edx, edx
je 0x41512a
lea eax, [esp + 0x10]
push eax
call dword [0x4285d0]
test eax, eax
je 0x41512e
lea ecx, [esp + 0x10]
push ecx
call fcn.004090f0
add esp, 4
test eax, eax
jne 0x41512e
push 1
call fcn.00425090
lea edx, [esp + 0x14]
push eax
push edx
call fcn.004252a0
add esp, 0xc
xor eax, eax
jmp 0x415139
lea eax, [esp + 0x10]
push eax
call dword [0x4280d4]
cmp eax, ebx
mov dword [0x430688], eax
jne 0x415146
xor esi, esi
jmp 0x415176
push str.GetMiniUI
push eax
call dword [0x4280d8]
cmp eax, ebx
mov dword [0x430684], eax
jne 0x415172
mov ecx, dword [0x430688]
push ecx
call dword [0x4280dc]
mov dword [0x430688], ebx
xor esi, esi
jmp 0x415176
call eax
mov esi, eax
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_1
cmp esi, ebx
mov dword [esp + 0x818], 1
jne 0x4151ab
mov esi, dword [esp + 0x820]
push 0x4306d8
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_2
mov dword [esp + 0xc], 1
jmp 0x4151f6
mov edx, dword [esi]
push esi
call dword [edx + 0x68]
push eax
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 8]
cmp eax, ebx
je 0x4151db
cmp word [ecx + eax*2 - 2], 0x5c
jne 0x4151db
dec eax
push 1
push eax
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::Delete
mov esi, dword [esp + 0x820]
lea eax, [esp + 8]
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x818], bl
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x810]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x814
ret
Function at 0x4185e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x427985
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
push 0x4306d8
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0
stosw word es:[edi], ax
call sub.MFC42u.DLL_CString::CString_2
mov ecx, dword [esp + 0x230]
lea eax, [esp + 0xc]
push eax
mov edi, 1
push ecx
push 0
mov dword [esp + 0x230], edi
call dword [0x4285a8]
test eax, eax
jne 0x418670
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push eax
call dword [0x42859c]
test eax, eax
je 0x418670
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator
mov esi, dword [esp + 0x22c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 0x10], edi
lea ecx, [esp + 8]
mov byte [esp + 0x224], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x220
ret 8
Function at 0x418900
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x430670]
sub esp, 0x80c
test eax, eax
jne 0x418a99
mov eax, dword [0x430674]
push esi
test eax, eax
jne 0x418a31
push edi
lea eax, [esp + 0x14]
push 0x400
push eax
push 0
call dword [0x4280c0]
mov edi, dword [0x4285c8]
lea ecx, [esp + 0x14]
push ecx
call edi
mov eax, dword [0x430678]
xor esi, esi
test eax, eax
jle 0x41895d
lea edx, [esp + 0x14]
push edx
call edi
mov eax, dword [0x430678]
inc esi
cmp esi, eax
jl 0x41894c
lea eax, [esp + 0x14]
push str.360Common.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [0x4285cc]
call dword [0x4280c4]
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..360SelfProtection
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
call dword [0x4280c8]
mov esi, eax
cmp esi, 0xffffffff
je 0x4189db
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x10]
push 4
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push 0x22204c
push esi
call dword [0x4280cc]
push esi
mov edi, eax
call dword [0x4280d0]
test edi, edi
je 0x4189db
mov eax, dword [esp + 8]
test eax, eax
jne 0x418a1c
lea edx, [esp + 0x14]
test edx, edx
je 0x418a18
lea eax, [esp + 0x14]
push eax
call dword [0x4285d0]
test eax, eax
je 0x418a1c
lea ecx, [esp + 0x14]
push ecx
call fcn.004090f0
add esp, 4
test eax, eax
jne 0x418a1c
push 1
call fcn.00425090
lea edx, [esp + 0x18]
push eax
push edx
call fcn.004252a0
add esp, 0xc
xor eax, eax
jmp 0x418a27
lea eax, [esp + 0x14]
push eax
call dword [0x4280d4]
test eax, eax
mov dword [0x430674], eax
pop edi
je 0x418a8f
mov esi, dword [0x4280d8]
push str.Get360CommonInstance
push eax
call esi
mov ecx, dword [0x430674]
push str.Get360ProductHistoryManager
push ecx
mov dword [0x430670], eax
call esi
mov edx, dword [0x430674]
push str.Create360FireWareStateFunction
push edx
mov dword [0x43066c], eax
call esi
mov dword [0x430668], eax
mov eax, dword [0x430674]
push str.GetFireWallState
push eax
call esi
mov ecx, dword [0x430674]
push str.Create360FireWareStateFunction2
push ecx
mov dword [0x430664], eax
call esi
mov dword [0x430660], eax
mov eax, dword [0x430670]
pop esi
test eax, eax
je 0x418ab6
call eax
test eax, eax
je 0x418ab6
mov edx, dword [eax]
push eax
call dword [edx + 8]
test eax, eax
je 0x418ab6
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
add esp, 0x80c
ret
xor eax, eax
add esp, 0x80c
ret
Function at 0x41af80
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x430680]
sub esp, 0x80c
test eax, eax
je 0x41af9d
mov ecx, dword [0x430688]
test ecx, ecx
jne 0x41b0d2
push esi
push edi
lea eax, [esp + 0x14]
push 0x400
push eax
push 0
call dword [0x4280c0]
mov edi, dword [0x4285c8]
lea ecx, [esp + 0x14]
push ecx
call edi
mov eax, dword [0x43068c]
xor esi, esi
test eax, eax
jle 0x41afda
lea edx, [esp + 0x14]
push edx
call edi
mov eax, dword [0x43068c]
inc esi
cmp esi, eax
jl 0x41afc9
lea eax, [esp + 0x14]
push str.MiniUI.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [0x4285cc]
call dword [0x4280c4]
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..360SelfProtection
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
call dword [0x4280c8]
mov esi, eax
cmp esi, 0xffffffff
je 0x41b058
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x10]
push 4
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push 0x22204c
push esi
call dword [0x4280cc]
push esi
mov edi, eax
call dword [0x4280d0]
test edi, edi
je 0x41b058
mov eax, dword [esp + 8]
test eax, eax
jne 0x41b099
lea edx, [esp + 0x14]
test edx, edx
je 0x41b095
lea eax, [esp + 0x14]
push eax
call dword [0x4285d0]
test eax, eax
je 0x41b099
lea ecx, [esp + 0x14]
push ecx
call fcn.004090f0
add esp, 4
test eax, eax
jne 0x41b099
push 1
call fcn.00425090
lea edx, [esp + 0x18]
push eax
push edx
call fcn.004252a0
add esp, 0xc
xor eax, eax
jmp 0x41b0a4
lea eax, [esp + 0x14]
push eax
call dword [0x4280d4]
pop edi
mov dword [0x430688], eax
test eax, eax
pop esi
jne 0x41b0b6
add esp, 0x80c
ret
push str.GetMiniUI2
push eax
call dword [0x4280d8]
test eax, eax
mov dword [0x430680], eax
jne 0x41b0d2
add esp, 0x80c
ret
call eax
add esp, 0x80c
ret
Function at 0x41b240
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x430684]
sub esp, 0x80c
test eax, eax
je 0x41b25d
mov ecx, dword [0x430688]
test ecx, ecx
jne 0x41b3a6
push esi
push edi
lea eax, [esp + 0x14]
push 0x400
push eax
push 0
call dword [0x4280c0]
mov edi, dword [0x4285c8]
lea ecx, [esp + 0x14]
push ecx
call edi
mov eax, dword [0x43068c]
xor esi, esi
test eax, eax
jle 0x41b29a
lea edx, [esp + 0x14]
push edx
call edi
mov eax, dword [0x43068c]
inc esi
cmp esi, eax
jl 0x41b289
lea eax, [esp + 0x14]
push str.MiniUI.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [0x4285cc]
call dword [0x4280c4]
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..360SelfProtection
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
call dword [0x4280c8]
mov esi, eax
cmp esi, 0xffffffff
je 0x41b318
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x10]
push 4
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push 0x22204c
push esi
call dword [0x4280cc]
push esi
mov edi, eax
call dword [0x4280d0]
test edi, edi
je 0x41b318
mov eax, dword [esp + 8]
test eax, eax
jne 0x41b359
lea edx, [esp + 0x14]
test edx, edx
je 0x41b355
lea eax, [esp + 0x14]
push eax
call dword [0x4285d0]
test eax, eax
je 0x41b359
lea ecx, [esp + 0x14]
push ecx
call fcn.004090f0
add esp, 4
test eax, eax
jne 0x41b359
push 1
call fcn.00425090
lea edx, [esp + 0x18]
push eax
push edx
call fcn.004252a0
add esp, 0xc
xor eax, eax
jmp 0x41b364
lea eax, [esp + 0x14]
push eax
call dword [0x4280d4]
pop edi
mov dword [0x430688], eax
test eax, eax
pop esi
je 0x41b39b
push str.GetMiniUI
push eax
call dword [0x4280d8]
test eax, eax
mov dword [0x430684], eax
jne 0x41b3a6
mov ecx, dword [0x430688]
push ecx
call dword [0x4280dc]
mov dword [0x430688], 0
xor eax, eax
add esp, 0x80c
ret 0xc
call eax
test eax, eax
je 0x41b39b
mov ecx, dword [esp + 0x818]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x818]
push ecx
mov ecx, dword [esp + 0x818]
push ecx
push eax
call dword [edx + 0x5c]
add esp, 0x80c
ret 0xc
Function at 0x41bc50
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x427bc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b4
push esi
push edi
mov ecx, 0xac
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2cc]
push eax
call dword [0x4285c4]
test eax, eax
push 0x111
push 0x2b4
je 0x41bcac
lea ecx, [esp + 0x10]
push ecx
push 0x10
push 0x42f530
jmp 0x41bcbe
mov eax, dword [esp + 0x2d4]
lea edx, [esp + 0x10]
push edx
push 0x80
push eax
call dword [0x4285a4]
mov esi, dword [esp + 8]
lea ecx, [esp + 0x2cc]
mov dword [esp + 0x2c4], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x2bc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c0
ret