joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f3a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50ca41
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x26c]
call fcn.00442f80
cmp word [eax + 0x4d4], 0
lea esi, [eax + 0x4d4]
jne 0x40f41d
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x40f41d
push esi
push 1
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x40f41d
xor esi, esi
lea ecx, [esp + 0x14]
call fcn.0043a090
mov eax, esi
lea edx, [esp + 0x14]
call fcn.0043a2e0
mov dword [esp + 0x264], 1
cmp dword [esp + 0x18], 0
je 0x40f4a7
cmp byte [esp + 0x130], 0
lea eax, [esp + 0x20]
jne 0x40f455
mov eax, dword [esp + 0x1c]
lea ebx, [eax + 4]
lea edi, [esp + 0x13c]
call fcn.004024a0
mov eax, str.SogouInputComponentsPicface
mov esi, edi
mov byte [esp + 0x264], 2
call fcn.00401540
cmp dword [esp + 0x13c], 0
jne 0x40f4d2
cmp byte [esp + 0x24e], 0
jne 0x40f4a7
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x40f4a7
push eax
call fcn.004ccef0
add esp, 4
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x40f4ce
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40f4ce
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x40f550
push 0
lea ecx, [esp + 0x140]
call fcn.00401a90
cmp byte [esp + 0x24e], 0
lea eax, [esp + 0x140]
jne 0x40f4f8
mov eax, dword [esp + 0x248]
add eax, 4
mov edx, ebp
call fcn.00402510
cmp byte [esp + 0x24e], 0
jne 0x40f527
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x40f527
push eax
call fcn.004ccef0
add esp, 4
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x40f54e
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40f54e
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004ccee1
add esp, 0x254
ret 4
Function at 0x40f580
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50ca41
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x26c]
call fcn.00442f80
cmp word [eax + 0x4d4], 0
lea esi, [eax + 0x4d4]
jne 0x40f5fd
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x40f5fd
push esi
push 1
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x40f5fd
xor esi, esi
lea ecx, [esp + 0x14]
call fcn.0043a090
mov eax, esi
lea edx, [esp + 0x14]
call fcn.0043a2e0
mov dword [esp + 0x264], 1
cmp dword [esp + 0x18], 0
je 0x40f687
cmp byte [esp + 0x130], 0
lea eax, [esp + 0x20]
jne 0x40f635
mov eax, dword [esp + 0x1c]
lea ebx, [eax + 4]
lea edi, [esp + 0x13c]
call fcn.004024a0
mov eax, str.SogouInputComponentsPicfaceJson
mov esi, edi
mov byte [esp + 0x264], 2
call fcn.00401540
cmp dword [esp + 0x13c], 0
jne 0x40f6b2
cmp byte [esp + 0x24e], 0
jne 0x40f687
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x40f687
push eax
call fcn.004ccef0
add esp, 4
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x40f6ae
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40f6ae
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x40f730
push 0
lea ecx, [esp + 0x140]
call fcn.00401a90
cmp byte [esp + 0x24e], 0
lea eax, [esp + 0x140]
jne 0x40f6d8
mov eax, dword [esp + 0x248]
add eax, 4
mov edx, ebp
call fcn.00402510
cmp byte [esp + 0x24e], 0
jne 0x40f707
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x40f707
push eax
call fcn.004ccef0
add esp, 4
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x40f72e
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40f72e
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004ccee1
add esp, 0x254
ret 4
Function at 0x40f760
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50c9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402510
mov eax, str.SGPicFaceTpBq
call fcn.00401540
mov eax, 0x52368c
call fcn.00401540
lea ecx, [esp + 0xc]
call fcn.0043a090
mov dword [esp + 0x34c], 0
mov eax, dword [0x548be0]
test eax, eax
jne 0x40f848
push 0x18
call fcn.004cf589
add esp, 4
test eax, eax
je 0x40f83d
or ecx, 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], 1
mov dword [eax + 0x14], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x40f83f
xor eax, eax
mov dword [0x548be0], eax
test eax, eax
jne 0x40f848
mov eax, dword [eax + 0x14]
push eax
push 0x5221b8
lea edx, [esp + 0x14]
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x40f86f
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401540
cmp dword [esi], 0
jne 0x40f8c2
mov ecx, edi
call fcn.00439450
push 0x5236a0
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x40f8be
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x40f8be
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x40f925
mov ecx, esi
call fcn.004016a0
test al, al
jne 0x40f8fc
cmp byte [esp + 0x354], al
je 0x40f8fc
push 1
mov ecx, esi
call fcn.00401a90
test al, al
jne 0x40f8fc
push 0x5236a0
mov ecx, edi
call fcn.00402960
lea ecx, [esp + 0xc]
call fcn.0043a230
xor al, al
jmp 0x40f925
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x40f923
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x40f923
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004ccee1
add esp, 0x348
ret 4
Function at 0x40f950
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50c9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402510
mov eax, str.SGPicFaceTpBq
call fcn.00401540
mov eax, str.ToolPicFace
call fcn.00401540
lea ecx, [esp + 0xc]
call fcn.0043a090
mov dword [esp + 0x34c], 0
mov eax, dword [0x548be0]
test eax, eax
jne 0x40fa38
push 0x18
call fcn.004cf589
add esp, 4
test eax, eax
je 0x40fa2d
or ecx, 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], 1
mov dword [eax + 0x14], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x40fa2f
xor eax, eax
mov dword [0x548be0], eax
test eax, eax
jne 0x40fa38
mov eax, dword [eax + 0x14]
push eax
push 0x5221b8
lea edx, [esp + 0x14]
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x40fa5f
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401540
cmp dword [esi], 0
jne 0x40fab2
mov ecx, edi
call fcn.00439450
push 0x5236a0
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x40faae
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x40faae
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x40fb15
mov ecx, esi
call fcn.004016a0
test al, al
jne 0x40faec
cmp byte [esp + 0x354], al
je 0x40faec
push 1
mov ecx, esi
call fcn.00401a90
test al, al
jne 0x40faec
push 0x5236a0
mov ecx, edi
call fcn.00402960
lea ecx, [esp + 0xc]
call fcn.0043a230
xor al, al
jmp 0x40fb15
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x40fb13
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x40fb13
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004ccee1
add esp, 0x348
ret 4
Function at 0x40fed0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50c9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402510
mov eax, str.SGPicFaceTpBq
call fcn.00401540
mov eax, str.SysCell
call fcn.00401540
lea ecx, [esp + 0xc]
call fcn.0043a090
mov dword [esp + 0x34c], 0
mov eax, dword [0x548be0]
test eax, eax
jne 0x40ffb8
push 0x18
call fcn.004cf589
add esp, 4
test eax, eax
je 0x40ffad
or ecx, 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], 1
mov dword [eax + 0x14], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x40ffaf
xor eax, eax
mov dword [0x548be0], eax
test eax, eax
jne 0x40ffb8
mov eax, dword [eax + 0x14]
push eax
push 0x5221b8
lea edx, [esp + 0x14]
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x40ffdf
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401540
cmp dword [esi], 0
jne 0x410032
mov ecx, edi
call fcn.00439450
push 0x5236a0
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x41002e
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x41002e
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x410095
mov ecx, esi
call fcn.004016a0
test al, al
jne 0x41006c
cmp byte [esp + 0x354], al
je 0x41006c
push 1
mov ecx, esi
call fcn.00401a90
test al, al
jne 0x41006c
push 0x5236a0
mov ecx, edi
call fcn.00402960
lea ecx, [esp + 0xc]
call fcn.0043a230
xor al, al
jmp 0x410095
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410093
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x410093
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004ccee1
add esp, 0x348
ret 4
Function at 0x4100c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50c9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402510
mov eax, str.SGPicFaceTpBq
call fcn.00401540
mov eax, str.QQPackage
call fcn.00401540
lea ecx, [esp + 0xc]
call fcn.0043a090
mov dword [esp + 0x34c], 0
mov eax, dword [0x548be0]
test eax, eax
jne 0x4101a8
push 0x18
call fcn.004cf589
add esp, 4
test eax, eax
je 0x41019d
or ecx, 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], 1
mov dword [eax + 0x14], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x41019f
xor eax, eax
mov dword [0x548be0], eax
test eax, eax
jne 0x4101a8
mov eax, dword [eax + 0x14]
push eax
push 0x5221b8
lea edx, [esp + 0x14]
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x4101cf
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401540
cmp dword [esi], 0
jne 0x410222
mov ecx, edi
call fcn.00439450
push 0x5236a0
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x41021e
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x41021e
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x410285
mov ecx, esi
call fcn.004016a0
test al, al
jne 0x41025c
cmp byte [esp + 0x354], al
je 0x41025c
push 1
mov ecx, esi
call fcn.00401a90
test al, al
jne 0x41025c
push 0x5236a0
mov ecx, edi
call fcn.00402960
lea ecx, [esp + 0xc]
call fcn.0043a230
xor al, al
jmp 0x410285
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410283
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x410283
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004ccee1
add esp, 0x348
ret 4
Function at 0x4102b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50c9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402510
mov eax, str.SGPicFaceTpBq
call fcn.00401540
mov eax, str.CloudCell
call fcn.00401540
lea ecx, [esp + 0xc]
call fcn.0043a090
mov dword [esp + 0x34c], 0
mov eax, dword [0x548be0]
test eax, eax
jne 0x410398
push 0x18
call fcn.004cf589
add esp, 4
test eax, eax
je 0x41038d
or ecx, 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], 1
mov dword [eax + 0x14], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x41038f
xor eax, eax
mov dword [0x548be0], eax
test eax, eax
jne 0x410398
mov eax, dword [eax + 0x14]
push eax
push 0x5221b8
lea edx, [esp + 0x14]
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x4103bf
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401540
cmp dword [esi], 0
jne 0x410412
mov ecx, edi
call fcn.00439450
push 0x5236a0
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x41040e
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x41040e
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x410475
mov ecx, esi
call fcn.004016a0
test al, al
jne 0x41044c
cmp byte [esp + 0x354], al
je 0x41044c
push 1
mov ecx, esi
call fcn.00401a90
test al, al
jne 0x41044c
push 0x5236a0
mov ecx, edi
call fcn.00402960
lea ecx, [esp + 0xc]
call fcn.0043a230
xor al, al
jmp 0x410475
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410473
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x410473
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004ccee1
add esp, 0x348
ret 4
Function at 0x4104a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50c9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402510
mov eax, str.SGPicFaceTpBq
call fcn.00401540
mov eax, str.UserCell
call fcn.00401540
lea ecx, [esp + 0xc]
call fcn.0043a090
mov dword [esp + 0x34c], 0
mov eax, dword [0x548be0]
test eax, eax
jne 0x410588
push 0x18
call fcn.004cf589
add esp, 4
test eax, eax
je 0x41057d
or ecx, 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], 1
mov dword [eax + 0x14], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x41057f
xor eax, eax
mov dword [0x548be0], eax
test eax, eax
jne 0x410588
mov eax, dword [eax + 0x14]
push eax
push 0x5221b8
lea edx, [esp + 0x14]
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x4105af
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401540
cmp dword [esi], 0
jne 0x410602
mov ecx, edi
call fcn.00439450
push 0x5236a0
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x4105fe
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x4105fe
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x410665
mov ecx, esi
call fcn.004016a0
test al, al
jne 0x41063c
cmp byte [esp + 0x354], al
je 0x41063c
push 1
mov ecx, esi
call fcn.00401a90
test al, al
jne 0x41063c
push 0x5236a0
mov ecx, edi
call fcn.00402960
lea ecx, [esp + 0xc]
call fcn.0043a230
xor al, al
jmp 0x410665
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410663
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x410663
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004ccee1
add esp, 0x348
ret 4
Function at 0x410690
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50c9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402510
mov eax, str.SGPicFaceTpBq
call fcn.00401540
mov eax, str.PkgMapZip
call fcn.00401540
lea ecx, [esp + 0xc]
call fcn.0043a090
mov dword [esp + 0x34c], 0
mov eax, dword [0x548be0]
test eax, eax
jne 0x410778
push 0x18
call fcn.004cf589
add esp, 4
test eax, eax
je 0x41076d
or ecx, 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], 1
mov dword [eax + 0x14], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x41076f
xor eax, eax
mov dword [0x548be0], eax
test eax, eax
jne 0x410778
mov eax, dword [eax + 0x14]
push eax
push 0x5221b8
lea edx, [esp + 0x14]
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x41079f
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401540
cmp dword [esi], 0
jne 0x4107f2
mov ecx, edi
call fcn.00439450
push 0x5236a0
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x4107ee
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x4107ee
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x410855
mov ecx, esi
call fcn.004016a0
test al, al
jne 0x41082c
cmp byte [esp + 0x354], al
je 0x41082c
push 1
mov ecx, esi
call fcn.00401a90
test al, al
jne 0x41082c
push 0x5236a0
mov ecx, edi
call fcn.00402960
lea ecx, [esp + 0xc]
call fcn.0043a230
xor al, al
jmp 0x410855
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410853
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x410853
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004ccee1
add esp, 0x348
ret 4
Function at 0x4127c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50c9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402510
mov eax, str.SGPicFaceTpBq
call fcn.00401540
mov eax, str.CandBlackList
call fcn.00401540
lea ecx, [esp + 0xc]
call fcn.0043a090
mov dword [esp + 0x34c], 0
mov eax, dword [0x548be0]
test eax, eax
jne 0x4128a8
push 0x18
call fcn.004cf589
add esp, 4
test eax, eax
je 0x41289d
or ecx, 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], 1
mov dword [eax + 0x14], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x41289f
xor eax, eax
mov dword [0x548be0], eax
test eax, eax
jne 0x4128a8
mov eax, dword [eax + 0x14]
push eax
push 0x5221b8
lea edx, [esp + 0x14]
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x4128cf
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401540
cmp dword [esi], 0
jne 0x412922
mov ecx, edi
call fcn.00439450
push 0x5236a0
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x41291e
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x41291e
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x412985
mov ecx, esi
call fcn.004016a0
test al, al
jne 0x41295c
cmp byte [esp + 0x354], al
je 0x41295c
push 1
mov ecx, esi
call fcn.00401a90
test al, al
jne 0x41295c
push 0x5236a0
mov ecx, edi
call fcn.00402960
lea ecx, [esp + 0xc]
call fcn.0043a230
xor al, al
jmp 0x412985
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x412983
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x412983
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004ccee1
add esp, 0x348
ret 4