joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403cb2
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x41aa75
call fcn.00418610
sub esp, 0x280
mov eax, dword [0x427480]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor eax, ebp
push edi
mov dword [ebp - 0x10], eax
xor esi, esi
xor eax, eax
mov word [ebp - 0x218], si
mov ecx, 0x81
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._net_monitor_i.exe
lea eax, [ebp - 0x218]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403dda
push str._i_net_monitor.dll
lea ecx, [ebp - 0x28c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov dword [ebp - 4], esi
push ebx
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.004039b9
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x26c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x270], 0x3c
mov dword [ebp - 0x26c], 0x40
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], str.open
mov dword [ebp - 0x260], eax
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x270]
push eax
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004186c1
leave
ret
Function at 0x403df3
Capabilities:
Copy file

Disassembly:
mov eax, 0x41aa91
call fcn.00418610
sub esp, 0x3c
mov eax, dword [0x427480]
push esi
xor eax, ebp
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov esi, str.stat.dat
push esi
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00401149
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.00401149
add esp, 0x18
mov byte [ebp - 4], 1
push 1
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.004186c1
leave
ret 8
Function at 0x4094d8
Capabilities:
Print debug messages
Set current directory

Disassembly:
mov eax, 0x41b5a5
call fcn.00418610
sub esp, 0x7c
mov eax, dword [0x427480]
push ebx
push esi
mov esi, dword [sym.imp.MSVCR71.dll__wcsicmp]
push edi
mov edi, dword [ebp + 0x10]
mov ebx, str._StartTP
xor eax, ebp
push ebx
push edi
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x81], 0
call esi
test eax, eax
pop ecx
pop ecx
je 0x409531
push str._debug
push edi
call dword [sym.imp.MSVCR71.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x409531
push 0x41df9c
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x409538
mov byte [ebp - 0x81], 1
lea ecx, [ebp - 0x80]
call fcn.00408dfc
and dword [ebp - 4], 0
lea eax, [ebp - 0x80]
push eax
call fcn.004092a7
cmp byte [ebp - 0x81], 0
pop ecx
je 0x409561
lea eax, [ebp - 0x80]
push eax
call fcn.00408e87
pop ecx
lea eax, [ebp - 0x80]
push eax
call fcn.0040905f
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c4c5
pop ecx
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str._RegServer
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x4095b3
call fcn.004093f7
mov ecx, dword [0x4275f4]
call fcn.00408952
mov esi, eax
call fcn.00409476
jmp 0x40966b
push str._RegServerEx
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x4095d4
call fcn.004093f7
mov eax, dword [0x4275f4]
mov byte [eax + 0xf0], 0
jmp 0x40959c
push str._UnRegServer
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x4095f4
call fcn.004093f7
mov ecx, dword [0x4275f4]
call fcn.004085bb
jmp 0x4095a7
lea ecx, [ebp - 0x85]
call fcn.0040303c
mov byte [ebp - 4], 2
push ebx
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x40963e
push str._debug
push edi
call dword [sym.imp.MSVCR71.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x409632
push 0x41df9c
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x409632
or esi, 0xffffffff
jmp 0x40965c
call fcn.004091e5
mov ecx, eax
call fcn.00409713
xor esi, esi
call fcn.004091e5
mov ecx, eax
call fcn.0040b9a9
push str.Calling_into_UnInitReplaceProgram_...
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.00417f90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x85]
call fcn.004030b9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00408e40
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004186c1
leave
ret 0x10
Function at 0x40a3a0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x41b784
call fcn.00418610
sub esp, 0x3c
mov eax, dword [0x427480]
push ebx
xor eax, ebp
push esi
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x2c]
push eax
mov edi, ecx
call fcn.0040c46a
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040f840
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, eax
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp esi, ebx
je 0x40a427
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x40a420
mov ecx, edi
call fcn.0040a319
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004186c1
leave
ret
Function at 0x40c10e
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x41b98b
call fcn.00418610
sub esp, 0x3c
mov eax, dword [0x427480]
push ebx
xor eax, ebp
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
push edi
xor edi, edi
lea eax, [ebp - 0x48]
push eax
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.0040c4c5
mov dword [ebp - 4], edi
mov dword [esp], str.dl_uac_tool.dll
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00401149
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x40c1c1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetSingleProcessUseDir
push ebx
call edi
push str.GetProfileDir
push ebx
mov dword [esi], eax
call edi
push str.GetComponentsDir
push ebx
mov dword [esi + 4], eax
call edi
push str.GetSingleProcessUseDir
push ebx
mov dword [esi + 8], eax
call edi
push str.SetMultiProcessUseDir
push ebx
mov dword [esi + 0xc], eax
call edi
push str.GetMultiProcessUseDir
push ebx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004186c1
leave
ret
Function at 0x40c5fc
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x427480]
and word [ebp - 0x7c], 0
and dword [ebp - 0x80], 0
xor eax, ebp
push ebx
mov ebx, dword [ebp + 0x198]
push edi
mov dword [ebp + 0x18c], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x7a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x7c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40c658
push 0x41d588
mov ecx, ebx
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
jmp 0x40c69d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Xunlei
lea eax, [ebp - 0x7c]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40c685
push 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x41dac0
lea eax, [ebp - 0x7c]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
mov ecx, ebx
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
pop esi
mov ecx, dword [ebp + 0x18c]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004186c1
add ebp, 0x190
leave
ret

Function at 0x40c738
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x40c77c
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x40c70f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [esp + 0xc], bl
mov dword [esi + 8], eax
jne 0x40c77c
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ebx
ret 4
Function at 0x40eaca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x40eaef
cmp word [eax], 0
je 0x40eaef
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40eaec
test al, 0x10
je 0x40eaec
xor eax, eax
inc eax
ret
xor eax, eax
ret
push 0x132b3a1
call fcn.0040f124
pop ecx
xor al, al
ret

Function at 0x40eafd
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x41bbf0
call fcn.00418610
sub esp, 0x270
mov eax, dword [0x427480]
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x10], eax
je 0x40ebdb
cmp word [esi], bx
je 0x40ebdb
push esi
call fcn.0040eaca
test al, al
pop ecx
je 0x40ebdb
push esi
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], ebx
jae 0x40eb57
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov ax, word [eax + ecx*2 - 2]
cmp ax, 0x5c
je 0x40eb76
cmp ax, 0x2f
je 0x40eb76
push 0x5c
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_]
push 0x41e398
lea ecx, [ebp - 0x2c]
call dword [0x41d1f8]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40eb90
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x27c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ebca
cmp word [ebp - 0x250], 0x2e
jne 0x40ebc3
lea eax, [ebp - 0x27c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40eba5
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
jmp 0x40ebdd
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004186c1
leave
ret
Function at 0x40efbb
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x40f05d
cmp word [esi], bx
je 0x40f05d
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x40f059
inc eax
push edi
push eax
call fcn.00418603
mov edi, eax
cmp edi, ebx
pop ecx
je 0x40f058
push edi
push dword [ebp + 8]
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40f051
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x41dac0
push edi
mov dword [ebp - 4], ebx
mov dword [ebp + 8], 0x34
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40f051
mov eax, dword [ebp - 4]
mov cx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
mov word [edx], cx
mov cx, word [eax + 8]
mov edx, dword [ebp + 0x10]
mov word [edx], cx
mov cx, word [eax + 0xe]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov ax, word [eax + 0xc]
mov ecx, dword [ebp + 0x18]
mov word [ecx], ax
mov bl, 1
push edi
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
pop ecx
pop edi
mov al, bl
jmp 0x40f06a
push 0x132b3a1
call fcn.0040f124
pop ecx
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x40f480
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
lea edi, [ebp - 0x110]
mov ecx, 0x44
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0040efb6
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x40f4bb
mov eax, 0x80004005
jmp 0x40f58b
mov dword [ebp - 0x40], 0
mov ecx, 0xe
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
mov dword [ebp - 0x38], 0
call fcn.0040f420
movzx eax, al
test eax, eax
je 0x40f4f8
mov dword [ebp - 0x34], 0
jmp 0x40f4ff
mov dword [ebp - 0x34], str.runas
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov esi, esp
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp esi, esp
call fcn.00418b0c
test eax, eax
jne 0x40f53e
mov eax, 0x80004005
jmp 0x40f58b
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x40f54a
xor eax, eax
jmp 0x40f58b
mov esi, esp
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 0x4c], 0x80004005
mov esi, esp
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp esi, esp
call fcn.00418b0c
test eax, eax
jne 0x40f588
mov eax, 0x80004005
jmp 0x40f58b
mov eax, dword [ebp - 0x4c]
push edx
mov ecx, ebp
push eax
lea edx, [0x40f5b0]
call fcn.00418b2f
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x110
cmp ebp, esp
call fcn.00418b0c
mov esp, ebp
pop ebp
ret
Function at 0x411440
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bfe5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x32c
push ebx
push esi
push edi
lea edi, [ebp - 0x338]
mov ecx, 0xcb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov word [ebp - 0x218], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, esp
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x4114b7
xor al, al
jmp 0x411623
mov esi, esp
push str.SHGetKnownFolderPath
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x411599
mov dword [ebp - 0x23c], 0
mov esi, esp
lea eax, [ebp - 0x23c]
push eax
push 0
push 0
push 0x41e728
call dword [ebp - 0x230]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x23c], 0
jne 0x411524
xor al, al
jmp 0x411623
mov esi, esp
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.MSVCR71.dll_wcslen]
add esp, 4
cmp esi, esp
call fcn.00418b0c
cmp eax, 0x104
jbe 0x411561
mov esi, esp
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp esi, esp
call fcn.00418b0c
xor al, al
jmp 0x411623
mov esi, esp
mov eax, dword [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
cmp esi, esp
call fcn.00418b0c
mov esi, esp
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp esi, esp
call fcn.00418b0c
jmp 0x4115b7
mov esi, esp
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp esi, esp
call fcn.00418b0c
mov esi, esp
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x32c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x334]
mov dword [ebp - 0x338], ecx
mov dword [ebp - 4], 0
mov esi, esp
mov edx, dword [ebp - 0x338]
push edx
mov ecx, dword [ebp + 8]
call dword [0x41d208]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 4], 0xffffffff
mov esi, esp
lea ecx, [ebp - 0x32c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp esi, esp
call fcn.00418b0c
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x411654]
call fcn.00418b2f
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x338
cmp ebp, esp
call fcn.00418b0c
mov esp, ebp
pop ebp
ret
Function at 0x411970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bfe5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x32c
push ebx
push esi
push edi
lea edi, [ebp - 0x338]
mov ecx, 0xcb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov word [ebp - 0x218], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, esp
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x4119e7
xor al, al
jmp 0x411b53
mov esi, esp
push str.SHGetKnownFolderPath
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x411ac9
mov dword [ebp - 0x23c], 0
mov esi, esp
lea eax, [ebp - 0x23c]
push eax
push 0
push 0
push 0x41e718
call dword [ebp - 0x230]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x23c], 0
jne 0x411a54
xor al, al
jmp 0x411b53
mov esi, esp
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.MSVCR71.dll_wcslen]
add esp, 4
cmp esi, esp
call fcn.00418b0c
cmp eax, 0x104
jbe 0x411a91
mov esi, esp
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp esi, esp
call fcn.00418b0c
xor al, al
jmp 0x411b53
mov esi, esp
mov eax, dword [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
cmp esi, esp
call fcn.00418b0c
mov esi, esp
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp esi, esp
call fcn.00418b0c
jmp 0x411ae7
mov esi, esp
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp esi, esp
call fcn.00418b0c
mov esi, esp
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x32c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x334]
mov dword [ebp - 0x338], ecx
mov dword [ebp - 4], 0
mov esi, esp
mov edx, dword [ebp - 0x338]
push edx
mov ecx, dword [ebp + 8]
call dword [0x41d208]
cmp esi, esp
call fcn.00418b0c
mov dword [ebp - 4], 0xffffffff
mov esi, esp
lea ecx, [ebp - 0x32c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp esi, esp
call fcn.00418b0c
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x411b84]
call fcn.00418b2f
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x338
cmp ebp, esp
call fcn.00418b0c
mov esp, ebp
pop ebp
ret