joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407269
Capabilities:
Enumerate files on windows

Disassembly:
push 0x264
mov eax, 0x41101e
call fcn.0040f8eb
xor edi, edi
xor ebx, ebx
inc edi
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x26c], edi
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x264]
cmp dword [0x419208], ebx
je 0x4072ab
push 0x414b30
jmp 0x4072b0
push 0x414b28
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
push 0x24c
lea eax, [ebp - 0x25c]
push ebx
push eax
mov dword [ebp - 0x260], ebx
call sub.MSVCR100.dll_memset
push 0x414b20
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x268]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
je 0x407388
cmp edi, ebx
je 0x40737c
test byte [ebp - 0x260], 0x10
je 0x40735f
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push 0x414b18
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x40735f
push 0x414b14
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x40735f
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x264]
call esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407376
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
jmp 0x40730e
mov dword [ebp - 0x26c], ebx
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x268]
call esi
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
mov eax, dword [ebp - 0x26c]
call fcn.0040f935
ret
Function at 0x4073cb
Capabilities:
Read .ini file
Write file on windows

Disassembly:
push 0x320
mov eax, 0x41105b
call fcn.0040f8eb
xor edi, edi
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
lea ecx, [ebp + 8]
test al, al
je 0x4073fe
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
jmp 0x407591
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
call esi
push eax
push edi
push str.UserDataSavePathType
mov ebx, str.UserDataSet
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x32c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x318], ax
lea eax, [ebp - 0x316]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 0x103
lea eax, [ebp - 0x318]
push eax
push 0x413658
push str.UserDataSavePath
push ebx
call edi
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call esi
push eax
push 0x7f
lea eax, [ebp - 0x110]
push eax
push 0x413658
push str.NewVersion
push ebx
call edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x324], eax
cmp eax, edi
je 0x407504
xor eax, eax
and dword [ebp - 0x328], eax
push eax
lea edi, [ebp - 0x31b]
stosb byte es:[edi], al
lea eax, [ebp - 0x328]
push eax
push 2
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x324]
mov word [ebp - 0x31c], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x320]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
push dword [ebp - 0x32c]
lea eax, [ebp - 0x320]
push 0x414248
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___cdecl_CTXStringW::Format_wchar_t_const__]
add esp, 0xc
lea ecx, [ebp + 8]
call esi
push eax
lea ecx, [ebp - 0x320]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push str.UserDataSavePathType
push ebx
call edi
lea ecx, [ebp + 8]
call esi
push eax
lea eax, [ebp - 0x318]
push eax
push str.UserDataSavePath
push ebx
call edi
lea ecx, [ebp + 8]
call esi
push eax
lea eax, [ebp - 0x110]
push eax
push str.NewVersion
push ebx
call edi
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
call fcn.0040f935
ret
Function at 0x407637
Capabilities:
Create directory
Delete file

Disassembly:
push 0xc
mov eax, 0x411095
call fcn.0040f882
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
test al, al
je 0x40766e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call edi
mov eax, ebx
call fcn.0040f921
ret 4
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push ebx
lea ecx, [ebp + 8]
call esi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.testfile
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4076cc
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4076fa
lea eax, [ebp - 0x18]
push eax
push 0x413448
push str.StorageTool
push 2
push str.func
push 0x62
push str.file
mov dword [ebp - 0x18], 0x414b50
call fcn.004011f4
add esp, 0x1c
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x10]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call edi
mov ebx, dword [ebp - 0x14]
jmp 0x40765b
Function at 0x407b9f
Capabilities:
Check if file exists
Create directory
Get file attributes
Move file

Disassembly:
push 8
mov eax, 0x41117c
call fcn.0040f882
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
xor ebx, ebx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x10], esp
inc ebx
push eax
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_Util::FS::GetParentDir_class_CTXStringW_]
pop ecx
pop ecx
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407bfa
push 0
lea ecx, [ebp - 0x10]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0xa
lea ecx, [ebp + 0xc]
call esi
push eax
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x407c69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call edi
push str.MoveFileEx___s__to___s__fail_ErrorCode_lu
push str.StorageTool
push 2
pop ebx
push ebx
push str.func
push 0x121
push str.file
call fcn.00407b33
add esp, 0x24
cmp esi, 0x70
jne 0x407c59
or ebx, 0xffffffff
jmp 0x407c69
cmp esi, 0x50
je 0x407c69
cmp esi, 0xb7
je 0x407c69
push 0xfffffffffffffffd
pop ebx
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
mov eax, ebx
call fcn.0040f921
ret
Function at 0x407c92
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes

Disassembly:
push 8
mov eax, 0x41117c
call fcn.0040f882
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
xor ebx, ebx
inc ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
jne 0x407cdf
mov edi, ebx
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
mov eax, edi
call fcn.0040f921
ret
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_Util::FS::GetParentDir_class_CTXStringW_]
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call esi
push eax
call edi
cmp eax, 0xffffffff
jne 0x407d1e
push 0
lea ecx, [ebp - 0x10]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp + 0x10]
xor edi, edi
lea ecx, [ebp + 0xc]
inc edi
call esi
push eax
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x407d91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call ebx
push str.CopyFile___s__to___s__fail_ErrorCode_lu
push str.StorageTool
push 2
pop edi
push edi
push str.func
push 0x14b
push str.file
call fcn.00407b33
add esp, 0x24
cmp esi, 0x70
jne 0x407d81
or edi, 0xffffffff
jmp 0x407d91
cmp esi, 0x50
je 0x407d91
cmp esi, 0xb7
je 0x407d91
push 0xfffffffffffffffd
pop edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
jmp 0x407cbf
Function at 0x407da3
Capabilities:
Check if file exists
Create directory
Enumerate files on windows
Get file attributes

Disassembly:
push 0x26c
mov eax, 0x4111d9
call fcn.0040f8eb
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
xor edi, edi
inc edi
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407ddf
push 0
lea ecx, [ebp + 0xc]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
and dword [ebp - 0x260], 0
push 0x24c
lea eax, [ebp - 0x25c]
push 0
push eax
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x264], edi
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
push 0x414b20
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x278]
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 2
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
je 0x407f90
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
cmp dword [ebp - 0x264], 0
je 0x407f84
test byte [ebp - 0x260], 0x10
jne 0x407f4e
lea eax, [ebp - 0x234]
push eax
push 0x414d1c
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407f4e
lea eax, [ebp - 0x234]
push eax
push 0x414d00
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407f4e
lea eax, [ebp - 0x234]
push eax
push str.CustomFaceRecv.db
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407f4e
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
push eax
call edi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 3
call edi
add esp, 0x18
push 1
push ecx
lea eax, [ebp - 0x268]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
mov byte [ebp - 4], 4
call ebx
push ecx
lea eax, [ebp - 0x26c]
mov ecx, esp
mov dword [ebp - 0x264], esp
push eax
mov byte [ebp - 4], 5
call ebx
mov byte [ebp - 4], 4
call fcn.00407c92
add esp, 0xc
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
je 0x407f6c
cmp eax, 0xfffffffd
je 0x407f6c
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 3
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 2
call esi
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x264], eax
jmp 0x407e55
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 3
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 2
call esi
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
mov eax, dword [ebp - 0x270]
call fcn.0040f935
ret
Function at 0x40907d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x18
mov eax, 0x411517
call fcn.0040f882
push dword [ebp + 0x10]
mov esi, dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], 1
call esi
add esp, 0xc
mov edi, dword [reloc.Common.dll___YCTXStringW__QAEAAV0_PB_W_Z]
mov ebx, 0x414d30
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call edi
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call esi
add esp, 0xc
push ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call edi
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call ebx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov byte [ebp - 4], 4
call ebx
mov byte [ebp - 4], 3
call fcn.00407da3
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x4091f1
cmp eax, 0xfffffffd
je 0x4091f1
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
add esp, 0xc
push 0x414e04
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call edi
lea ecx, [ebp - 0x14]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
cmp eax, 0xffffffff
je 0x4091c2
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
cmp dword [0x419208], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x10]
je 0x40917b
push 0x414dfc
jmp 0x409180
push 0x414df4
call edi
push 0x414e04
lea ecx, [ebp - 0x10]
call edi
push 1
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call ebx
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
mov byte [ebp - 4], 7
call ebx
mov byte [ebp - 4], 6
call fcn.00407c92
add esp, 0xc
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 5
call esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
jmp 0x40921b
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call edi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call edi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call edi
mov eax, dword [ebp - 0x20]
call fcn.0040f921
ret
Function at 0x40be78
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push 0x26c
mov eax, 0x4118fc
call fcn.0040f8eb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x26c], eax
xor edi, edi
push 0x24c
xor ebx, ebx
lea eax, [ebp - 0x25c]
push edi
inc ebx
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x260], edi
call sub.MSVCR100.dll_memset
push 0x414b20
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0x18
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], bl
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x264], eax
cmp eax, 0xffffffff
je 0x40bffd
cmp ebx, edi
je 0x40bff1
test byte [ebp - 0x260], 0x10
je 0x40bfd7
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push 0x414b18
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x40bfd7
push 0x414b14
lea eax, [ebp - 0x234]
push eax
call ebx
test eax, eax
je 0x40bfd7
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x274], edi
call dword [sym.imp.Common.dll_Ordinal_34]
pop ecx
pop ecx
cmp dword [ebp - 0x274], edi
je 0x40bf99
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x26c]
lea eax, [ebp - 0x234]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
call fcn.0040b634
add esp, 0x10
jmp 0x40bfd7
lea eax, [ebp - 0x234]
push eax
push str.All_Users
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40bfd7
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x26c]
lea eax, [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
call fcn.0040bb82
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
jmp 0x40befd
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40c04a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push 0x414d48
push str.StorageTool
push 2
push str.func
push 0xa4d
push str.file
call fcn.00407b33
add esp, 0x20
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
call fcn.0040f935
ret
Function at 0x40ec00
Capabilities:
Create process on windows

Disassembly:
push 0x14
mov eax, 0x411eb4
call fcn.0040f882
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
lea ecx, [ebp - 0x10]
call esi
mov eax, 0x104
push eax
xor ebx, ebx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_wchar_t____thiscall_CTXStringW::GetBuffer_int_]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::ReleaseBuffer_int_]
push 0x5c
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_class_CTXStringW___thiscall_CTXStringW::Mid_int__int_]
push str.QQ.exe
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
mov byte [ebp - 4], 2
cmp dword [0x419208], ebx
je 0x40ec84
push str.TM.exe
lea ecx, [ebp - 0x14]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___class_CTXStringW_const__]
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call esi
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 5
push ebx
lea ecx, [ebp - 0x18]
call esi
push eax
lea ecx, [ebp - 0x1c]
call esi
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x18]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call esi
call fcn.0040f921
ret

Function at 0x40ecf7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.explorer.exe
lea ecx, [ebp - 4]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
mov ecx, dword [ebp + 8]
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 5
push 0
call esi
push eax
lea ecx, [ebp - 4]
call esi
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop esi
leave
ret
Function at 0x40ee25
Capabilities:
Delete file

Disassembly:
push 0x18
mov eax, 0x411ee1
call fcn.0040f882
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
lea ecx, [ebp + 8]
test al, al
je 0x40ee58
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
xor eax, eax
call fcn.0040f921
ret
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.Common.dll_public:_class_CTXStringW___thiscall_CTXStringW::Right_int_]
push 0x5c
push eax
call dword [sym.imp.Common.dll_bool___cdecl_operator__class_CTXStringW_const___wchar_t_]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 0xd], al
call esi
cmp byte [ebp - 0xd], bl
je 0x40ee8d
push 0x5c
lea ecx, [ebp + 8]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_]
push str.temp.tmp
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
xor eax, eax
push ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push 0x80
push 2
lea eax, [ebp - 0x24]
push eax
push ebx
push 0xc0000000
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40eefa
xor edi, edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
mov eax, edi
jmp 0x40ee52
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
inc edi
jmp 0x40eee2