joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x408
mov eax, dword [0x408004]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
push edi
push str.PYTHONSCRIPT
push 1
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4028d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Could_not_locate_script_resource:
jmp 0x4028f2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402979
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Could_not_load_script_resource:
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov esi, eax
push 2
call edi
add esp, 4
push eax
call fcn.00401010
add esp, 8
test esi, esi
je 0x402960
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0x400
push esi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x400
push dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0xc]
push eax
push 2
call edi
add esp, 4
push eax
call fcn.00401010
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.00401073
add esp, 0x408
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov dword [0x408f48], edx
mov dword [0x409da8], edx
test edx, edx
jne 0x4029bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Could_not_lock_script_resource:
mov ecx, eax
call fcn.00401d20
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.00401073
add esp, 0x408
ret
cmp dword [edx], 0x78563412
lea esi, [edx + 0x10]
mov eax, dword [edx + 0xc]
mov dword [0x408f44], eax
mov dword [0x408f48], esi
je 0x402a08
push str.Bug:_Invalid_script_resource
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.00401073
add esp, 0x408
ret
mov ecx, esi
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402a10
sub ecx, edi
lea eax, [edx + 0x11]
add eax, ecx
cmp byte [esi], 0
mov dword [0x408f48], eax
je 0x402a47
push esi
push 0x408f60
push str._s_S
push 0x608
push 0x409180
call fcn.00401040
add esp, 0x14
jmp 0x402a59
push 0x608
push 0x409180
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [esp + 0x40c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.00401073
add esp, 0x408
ret
Function at 0x402a2e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0040a364
lea eax, [esi + 0x220]
push str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
push eax
call fcn.0043c490
cmp dword [esi + 0x58], 8
pop ecx
pop ecx
jb 0x402a67
mov eax, dword [esi + 0x44]
jmp 0x402a6a
lea eax, [esi + 0x44]
push str.Config
push eax
lea eax, [esi + 0x52c]
push str._s_sUseCloud.ini
push eax
call fcn.0043c3b0
and word [ebp - 0x20c], 0
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0043c2f0
add esp, 0x1c
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.004086e0
test al, al
jne 0x402ac9
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push str.BubblesPop_
push eax
call fcn.0043c36a
lea eax, [ebp - 0x20c]
push eax
push str._sCheckToTips.ini
add esi, 0x324
push esi
call fcn.0043c3b0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0043bcca
leave
ret 4
Function at 0x408526
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0040dff2
mov dword [esi], eax
call fcn.0040e12b
mov dword [esi + 8], eax
call fcn.0040df68
mov dword [esi + 0xc], eax
call fcn.0040e0e1
mov dword [esi + 0x10], eax
call fcn.0040e04d
mov dword [esi + 0x18], eax
call fcn.0040e097
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
mov dword [esi + 4], eax
lea eax, [esi + 0x1c0]
push eax
call edi
lea eax, [esi + 0x1d8]
push eax
call edi
lea eax, [esi + 0x1c8]
push eax
call edi
lea eax, [esi + 0x208]
push eax
call edi
lea eax, [esi + 0x1e8]
push eax
call edi
lea eax, [esi + 0x1f8]
push eax
call edi
mov eax, dword [0x58b3b0]
pop edi
mov dword [esi + 0x1ac], eax
pop esi
ret

Function at 0x4085a8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0x11c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0043c2f0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jne 0x408603
xor eax, eax
inc eax
cmp dword [ebp - 0x78], 0
je 0x4085fb
cmp dword [ebp - 0x78], eax
jne 0x408603
cmp byte [ebp + 0x9a], al
je 0x408605
xor eax, eax
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.0043bcca
add ebp, 0xa0
leave
ret

Function at 0x408710
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov esi, ecx
call fcn.0043c2f0
add esp, 0xc
cmp dword [esi + 0x58], 8
jb 0x40874f
mov esi, dword [esi + 0x44]
jmp 0x408752
add esi, 0x44
push str.AllSkin
push esi
lea eax, [ebp - 0x20c]
push 0x52db10
push eax
call fcn.0043c3b0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop esi
jne 0x40878b
lea eax, [ebp - 0x20c]
push eax
call fcn.0040a3fc
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bcca
leave
ret
Function at 0x408797
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp + 0x188], eax
and word [ebp - 0x80], 0
push ebx
push esi
push edi
push 0x206
lea eax, [ebp - 0x7e]
push 0
push eax
mov esi, ecx
call fcn.0043c2f0
add esp, 0xc
cmp dword [esi + 0x3c], 8
jb 0x4087da
mov eax, dword [esi + 0x28]
jmp 0x4087dd
lea eax, [esi + 0x28]
push 0x52db38
push eax
mov ebx, 0x52db10
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0043c3b0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call edi
test eax, eax
jne 0x408810
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x3c], 8
jb 0x40881b
mov esi, dword [esi + 0x28]
jmp 0x40881e
add esi, 0x28
push str.Dict
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0043c3b0
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call edi
test eax, eax
pop edi
pop esi
pop ebx
jne 0x408849
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
call fcn.0043bcca
add ebp, 0x18c
leave
ret

Function at 0x408894
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5a0]
sub esp, 0x620
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp + 0x59c], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [ebp + 0x396]
push ebx
push eax
mov esi, ecx
mov word [ebp + 0x394], bx
call fcn.0043c2f0
lea eax, [ebp + 0x394]
push str.SOFTWARE_
push eax
call fcn.0043c394
lea eax, [ebp + 0x394]
push str.SmartCloudInput
push eax
call fcn.0043c36a
add esp, 0x1c
cmp dword [esi + 0x58], 8
jb 0x4088fe
mov eax, dword [esi + 0x44]
jmp 0x408901
lea eax, [esi + 0x44]
push eax
lea eax, [ebp + 0x18c]
push eax
call fcn.0043c394
cmp dword [esi + 0x3c], 8
pop ecx
pop ecx
jb 0x40891b
mov esi, dword [esi + 0x28]
jmp 0x40891e
add esi, 0x28
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0043c394
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
push 2
push ebx
lea eax, [ebp + 0x394]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40897b
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov edi, 0x104
push edi
lea eax, [ebp + 0x18c]
push eax
push 1
push ebx
push str.CfgRootPath
push dword [ebp - 0x80]
call esi
push edi
lea eax, [ebp - 0x7c]
push eax
push 1
push ebx
push str.CfgUserPath
push dword [ebp - 0x80]
call esi
pop edi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x59c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bcca
add ebp, 0x5a0
leave
ret
Function at 0x4093b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
jb 0x4093d1
mov eax, dword [esi + 0x44]
jmp 0x4093d4
lea eax, [esi + 0x44]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x52db10
push eax
call fcn.0043c3b0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40940c
lea eax, [ebp - 0x20c]
push eax
call fcn.0040a3fc
pop ecx
lea eax, [ebp - 0x20c]
push str.Config.ini
push eax
call fcn.0043c36a
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x5c]
call fcn.00402966
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043bcca
leave
ret

Function at 0x40943b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
jb 0x40945c
mov eax, dword [esi + 0x44]
jmp 0x40945f
lea eax, [esi + 0x44]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x52db10
push eax
call fcn.0043c3b0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x409497
lea eax, [ebp - 0x20c]
push eax
call fcn.0040a3fc
pop ecx
lea eax, [ebp - 0x20c]
push 0x52dcac
push eax
call fcn.0043c36a
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xe8]
call fcn.00402966
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043bcca
leave
ret

Function at 0x40958d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
jb 0x4095ae
mov eax, dword [esi + 0x44]
jmp 0x4095b1
lea eax, [esi + 0x44]
push str.UseData
push eax
lea eax, [ebp - 0x20c]
push 0x52db10
push eax
call fcn.0043c3b0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4095e9
lea eax, [ebp - 0x20c]
push eax
call fcn.0040a3fc
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x174]
call fcn.00402966
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043bcca
leave
ret
Function at 0x409ae8
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x3b8]
sub esp, 0x438
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp + 0x3b4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp + 0x1ae]
push esi
push eax
mov edi, ecx
mov word [ebp + 0x1ac], si
call fcn.0043c2f0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov ebx, eax
lea eax, [ebp - 0x7c]
push esi
push eax
mov dword [ebp - 0x80], esi
call fcn.0043c2f0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x409bac
lea eax, [ebp - 0x80]
push eax
push esi
mov dword [ebp - 0x80], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x409b74
cmp dword [ebp - 0x78], ebx
je 0x409b7a
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x409b65
jmp 0x409b8c
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.0043c394
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x1ac]
push eax
call fcn.0043e88b
pop ecx
push eax
lea ecx, [edi + 0x190]
call fcn.00402966
mov ecx, dword [ebp + 0x3b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bcca
add ebp, 0x3b8
leave
ret

Function at 0x409bc4
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x7e]
push esi
push eax
mov edi, ecx
mov word [ebp - 0x80], si
call fcn.0043c2f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.004086e0
test al, al
jne 0x409c2b
push esi
push 0x1a
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x80]
push eax
call fcn.0043c2da
test eax, eax
pop ecx
je 0x409c79
mov esi, 0x52dca8
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0043c36a
lea eax, [ebp - 0x80]
push str.SmartCloudIME
push eax
call fcn.0043c36a
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0043c36a
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x409c6d
lea eax, [ebp - 0x80]
push eax
call fcn.0040a3fc
pop ecx
lea eax, [ebp - 0x80]
push eax
lea ecx, [edi + 0x40]
call fcn.00402966
mov ecx, dword [ebp + 0x188]
pop edi
xor ecx, ebp
pop esi
call fcn.0043bcca
add ebp, 0x18c
leave
ret
Function at 0x409c90
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x7e]
push esi
push eax
mov edi, ecx
mov word [ebp - 0x80], si
call fcn.0043c2f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.004086e0
test al, al
jne 0x409cf7
push esi
push 0x1a
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x80]
push eax
call fcn.0043c2da
test eax, eax
pop ecx
je 0x409d45
mov esi, 0x52dca8
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0043c36a
lea eax, [ebp - 0x80]
push str.SmartCloudIME.users
push eax
call fcn.0043c36a
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0043c36a
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x409d39
lea eax, [ebp - 0x80]
push eax
call fcn.0040a3fc
pop ecx
lea eax, [ebp - 0x80]
push eax
lea ecx, [edi + 0x24]
call fcn.00402966
mov ecx, dword [ebp + 0x188]
pop edi
xor ecx, ebp
pop esi
call fcn.0043bcca
add ebp, 0x18c
leave
ret

Function at 0x409d5c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and word [ebp - 0x414], 0
push esi
push edi
mov esi, 0x206
push esi
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x412]
push 0
push eax
mov edi, ecx
call fcn.0043c2f0
and word [ebp - 0x20c], 0
push esi
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0043c2f0
add esp, 0x18
lea eax, [edi + 0xb0]
cmp dword [eax + 0x18], 8
pop edi
pop esi
jb 0x409dc5
mov eax, dword [eax + 4]
jmp 0x409dc8
add eax, 4
push str.SmartCloudInfo.ini
push eax
lea eax, [ebp - 0x20c]
push 0x52d100
push eax
call fcn.0043c3b0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x52cea8
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push eax
call fcn.00402966
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bcca
leave
ret 4
Function at 0x409e2a
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xbc0]
sub esp, 0xc40
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp + 0xbbc], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov dword [ebp - 0x78], ecx
xor ebx, ebx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov word [ebp - 0x74], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x39e]
push edi
push eax
mov word [ebp + 0x39c], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x7ae]
push edi
push eax
mov word [ebp + 0x7ac], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov word [ebp + 0x194], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x9b6]
push edi
push eax
mov word [ebp + 0x9b4], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x5a6]
push edi
push eax
mov word [ebp + 0x5a4], di
call fcn.0043c2f0
add esp, 0x48
push edi
push 0x1a
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x9b4]
push eax
call fcn.0043c394
lea eax, [ebp + 0x9b4]
push eax
call fcn.0043c2da
lea eax, [ebp + 0x9b4]
push 0x5c
push eax
call fcn.0043e0de
add esp, 0x14
cmp eax, edi
je 0x40a033
mov word [eax], di
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.0043c394
lea eax, [ebp + 0x39c]
push str.Local
push eax
call fcn.0043c36a
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp + 0x39c]
push eax
call esi
test eax, eax
je 0x409f56
inc ebx
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x7ac]
push eax
call fcn.0043c394
lea eax, [ebp + 0x7ac]
push str.LocalLow
push eax
call fcn.0043c36a
add esp, 0x10
lea eax, [ebp + 0x7ac]
push eax
call esi
test eax, eax
je 0x409f91
mov dword [ebp - 0x80], 1
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.0043c394
lea eax, [ebp + 0x194]
push str.Roaming
push eax
call fcn.0043c36a
add esp, 0x10
lea eax, [ebp + 0x194]
push eax
call esi
test eax, eax
je 0x409fcc
mov dword [ebp - 0x7c], 1
cmp ebx, edi
je 0x40a033
cmp dword [ebp - 0x80], edi
je 0x40a033
cmp dword [ebp - 0x7c], edi
je 0x40a033
mov edi, dword [ebp - 0x78]
mov ecx, edi
call fcn.004085a8
test eax, eax
je 0x40a033
push str.SmartCloudIME
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp + 0x5a4]
push str._s_s_
push eax
call fcn.0043c3b0
add esp, 0x10
lea eax, [ebp + 0x5a4]
push eax
call esi
test eax, eax
jne 0x40a022
lea eax, [ebp + 0x5a4]
push eax
call fcn.0040a3fc
pop ecx
lea eax, [ebp + 0x5a4]
push eax
lea ecx, [edi + 0x40]
call fcn.00402966
jmp 0x40a03b
mov ecx, dword [ebp - 0x78]
call fcn.00409bc4
mov ecx, dword [ebp + 0xbbc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bcca
add ebp, 0xbc0
leave
ret
Function at 0x40a053
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xbc0]
sub esp, 0xc40
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp + 0xbbc], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov dword [ebp - 0x78], ecx
xor ebx, ebx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov word [ebp - 0x74], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x39e]
push edi
push eax
mov word [ebp + 0x39c], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x7ae]
push edi
push eax
mov word [ebp + 0x7ac], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov word [ebp + 0x194], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x9b6]
push edi
push eax
mov word [ebp + 0x9b4], di
call fcn.0043c2f0
push esi
lea eax, [ebp + 0x5a6]
push edi
push eax
mov word [ebp + 0x5a4], di
call fcn.0043c2f0
add esp, 0x48
push edi
push 0x1a
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x9b4]
push eax
call fcn.0043c394
lea eax, [ebp + 0x9b4]
push eax
call fcn.0043c2da
lea eax, [ebp + 0x9b4]
push 0x5c
push eax
call fcn.0043e0de
add esp, 0x14
cmp eax, edi
je 0x40a25c
mov word [eax], di
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.0043c394
lea eax, [ebp + 0x39c]
push str.Local
push eax
call fcn.0043c36a
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp + 0x39c]
push eax
call esi
test eax, eax
je 0x40a17f
inc ebx
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x7ac]
push eax
call fcn.0043c394
lea eax, [ebp + 0x7ac]
push str.LocalLow
push eax
call fcn.0043c36a
add esp, 0x10
lea eax, [ebp + 0x7ac]
push eax
call esi
test eax, eax
je 0x40a1ba
mov dword [ebp - 0x80], 1
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.0043c394
lea eax, [ebp + 0x194]
push str.Roaming
push eax
call fcn.0043c36a
add esp, 0x10
lea eax, [ebp + 0x194]
push eax
call esi
test eax, eax
je 0x40a1f5
mov dword [ebp - 0x7c], 1
cmp ebx, edi
je 0x40a25c
cmp dword [ebp - 0x80], edi
je 0x40a25c
cmp dword [ebp - 0x7c], edi
je 0x40a25c
mov edi, dword [ebp - 0x78]
mov ecx, edi
call fcn.004085a8
test eax, eax
je 0x40a25c
push str.SmartCloudIME.users
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp + 0x5a4]
push str._s_s_
push eax
call fcn.0043c3b0
add esp, 0x10
lea eax, [ebp + 0x5a4]
push eax
call esi
test eax, eax
jne 0x40a24b
lea eax, [ebp + 0x5a4]
push eax
call fcn.0040a3fc
pop ecx
lea eax, [ebp + 0x5a4]
push eax
lea ecx, [edi + 0x24]
call fcn.00402966
jmp 0x40a264
mov ecx, dword [ebp - 0x78]
call fcn.00409c90
mov ecx, dword [ebp + 0xbbc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043bcca
add ebp, 0xbc0
leave
ret
Function at 0x40a27c
Capabilities:
Check if file exists

Disassembly:
push esi
push 0xffffffffffffffff
lea esi, [ecx + 0x78]
add ecx, 0x40
push 0
push ecx
mov ecx, esi
call fcn.0040210f
push str.Skin_
mov ecx, esi
call fcn.00402ca5
cmp dword [esi + 0x18], 8
jb 0x40a2a6
mov eax, dword [esi + 4]
jmp 0x40a2a9
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a2c9
cmp dword [esi + 0x18], 8
jb 0x40a2bf
mov esi, dword [esi + 4]
jmp 0x40a2c2
add esi, 4
push esi
call fcn.0040a3fc
pop ecx
pop esi
ret

Function at 0x40a2cb
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x580e04]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov esi, ecx
call fcn.0043c2f0
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
add esi, 0x120
push eax
mov ecx, esi
call fcn.00402966
push 0x52dca8
mov ecx, esi
call fcn.00402ca5
cmp dword [esi + 0x18], 8
jb 0x40a33d
mov eax, dword [esi + 4]
jmp 0x40a340
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a357
push str.C:Program_Files_
mov ecx, esi
call fcn.00402966
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043bcca
leave
ret

Function at 0x40a3fc
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
call fcn.0043c2da
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041b8d2
push dword [esp + 0x1c]
mov esi, eax
push esi
call fcn.0043c394
add esp, 0x10
xor ebp, ebp
test edi, edi
mov bl, 1
jl 0x40a46b
cmp word [esi + ebp*2], 0x5c
jne 0x40a462
and word [esi + ebp*2], 0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a45c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40a469
mov word [esi + ebp*2], 0x5c
inc ebp
cmp ebp, edi
jle 0x40a439
jmp 0x40a46b
xor bl, bl
push esi
call fcn.0041b8d7
pop ecx
pop edi
pop esi
pop ebp
movzx eax, bl
pop ebx
ret