joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4178f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x42aa1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 8]
mov dword [esp + 0x1c], 2
call fcn.00428122
lea ecx, [esi + 0xc]
mov byte [esp + 0x1c], 3
call fcn.00428122
lea ecx, [esi + 0x10]
mov byte [esp + 0x1c], 4
call fcn.00428122
lea ecx, [esi + 0x14]
mov byte [esp + 0x1c], 5
call fcn.00428122
lea ecx, [esi + 0x18]
mov byte [esp + 0x1c], 6
call fcn.00428122
lea ecx, [esi + 0x1c]
mov byte [esp + 0x1c], 7
call fcn.00428122
lea ebp, [esi + 0x28]
mov byte [esp + 0x1c], 8
mov ecx, ebp
call fcn.00428122
xor ebx, ebx
lea ecx, [esi + 0x5c]
push ebx
push ebx
push ebx
push ebx
push ebx
push str.QQ_Bug_Report_Tool
mov byte [esp + 0x34], 9
call fcn.004283b6
lea ecx, [esi + 0x78]
mov byte [esp + 0x1c], 0xa
call fcn.00428122
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1c], 0xb
call fcn.00428122
lea edi, [esi + 0x80]
mov byte [esp + 0x1c], 0xc
mov ecx, edi
call fcn.00428122
push 0xb9f
lea ecx, [esi + 0x78]
mov byte [esp + 0x20], 0xd
mov dword [esi], 0x42d324
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
call sub.MFC42.DLL_CString::LoadStringA
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebp
mov dword [esi + 4], eax
call fcn.00428116
push 0x5c
lea ecx, [esp + 0x2c]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call sub.MFC42.DLL_CString::ReverseFind
cmp eax, 0xffffffff
je 0x417a4f
lea edx, [esp + 0x24]
push eax
push edx
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esi + 0x7c]
mov byte [esp + 0x20], 0xe
call fcn.00428116
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0xd
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x30]
mov ecx, edi
push eax
call fcn.00428116
mov ecx, edi
call sub.MFC42.DLL_CString::TrimLeft
mov ecx, edi
call sub.MFC42.DLL_CString::TrimRight
lea ecx, [esp + 0x24]
push 0xff
push ecx
mov ecx, edi
call sub.MFC42.DLL_CString::Left
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x28]
lea ecx, [esi + 0x1c]
push edx
call fcn.00428116
mov ecx, esi
call fcn.004193b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x417c48
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x42aaf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call fcn.00428122
lea ecx, [esp + 0xc]
mov dword [esp + 0x58], 0
call fcn.00428122
mov eax, dword [esi + 0x1c]
mov byte [esp + 0x58], 1
push eax
lea eax, [esp + 0x30]
push 0x21
push eax
push 0x433278
push str.NormalModeHash
push str.ExceptionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x417c9c
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0042811c
lea ecx, [esp + 8]
call fcn.00428122
lea ecx, [esp + 4]
mov byte [esp + 0x58], 2
call fcn.00428122
mov edx, dword [esi + 0x50]
lea eax, [esp + 8]
push edx
push str.AppBuild_d
push eax
mov byte [esp + 0x64], 3
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push 0x432b04
push ecx
push edx
call sub.MFC42.DLL_operator_1
add esi, 0xc
mov byte [esp + 0x58], 4
push esi
push eax
lea eax, [esp + 0x1c]
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x5c], 5
call fcn.00428116
lea ecx, [esp + 0x14]
mov byte [esp + 0x58], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::MakeLower
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov eax, dword [ecx - 8]
mov ecx, dword [edx - 8]
push eax
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00429879
add esp, 0xc
lea ecx, [esp + 4]
push 0xffffffffffffffff
call sub.MFC42.DLL_CString::ReleaseBuffer
xor esi, esi
xor ecx, ecx
lea edx, [esp + 8]
mov cl, byte [esp + esi + 0x1c]
push ecx
push str._02X
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::operator_1
inc esi
cmp esi, 0x10
jl 0x417d5e
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
mov byte [esp + 0x58], 2
test eax, eax
pop esi
lea ecx, [esp]
jne 0x417df2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x54], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x54], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
add esp, 0x58
ret
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x54], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x54], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x4c]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x58
ret
Function at 0x419010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42ad27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
xor esi, esi
mov dword [esp + 0x14], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 1
call fcn.00428122
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.00428122
lea ecx, [esp + 4]
mov byte [esp + 0x30], 3
call fcn.00428122
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 8]
push eax
push str.AppBuild_d
push ecx
mov byte [esp + 0x3c], 4
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push 0x432b04
push edx
push eax
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 0x40]
lea edx, [esp + 0x3c]
push ecx
push eax
push edx
mov byte [esp + 0x3c], 5
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x34], 6
call fcn.00428116
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::MakeLower
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [ecx - 8]
push eax
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
lea edx, [esp + 0x1c]
push eax
push edx
call fcn.00429879
add esp, 0xc
lea ecx, [esp + 4]
push 0xffffffffffffffff
call sub.MFC42.DLL_CString::ReleaseBuffer
xor eax, eax
lea ecx, [esp + 8]
mov al, byte [esp + esi + 0x18]
push eax
push str._02X
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
call sub.MFC42.DLL_CString::operator_1
inc esi
cmp esi, 0x10
jl 0x419107
mov esi, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 4]
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 0xc

Function at 0x4192a0
Capabilities:
Read .ini file

Disassembly:
push ecx
mov ecx, dword [ecx + 0x1c]
push ebx
push esi
push ecx
lea eax, [esp + 0xe]
push 2
push eax
push 0
push str.Original
push str.ExceptionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, 0x43267c
lea eax, [esp + 0xa]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4192fc
test cl, cl
je 0x4192ed
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4192fc
add eax, 2
add esi, 2
test cl, cl
jne 0x4192c9
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
pop esi
mov eax, ecx
pop ebx
pop ecx
ret
sbb eax, eax
pop esi
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
pop ebx
pop ecx
ret
Function at 0x419b80
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
lea eax, [esp]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x170]
push 0x4410
push 0x160
push eax
push 0x80
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x168]
push 0
push edx
push 0
push 0
push eax
push ecx
push 3
mov ecx, esi
call sub.MFC42.DLL_CListCtrl::InsertItem
pop esi
add esp, 0x160
ret 0xc

Function at 0x419c20
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
push ebx
push esi
push edi
push 0
push 0x40
mov esi, ecx
push 0
call sub.MFC42.DLL_CWnd::ModifyStyle
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0x4011
lea eax, [esp + 0x10]
push 0x160
push eax
push 0x80
push str.1.txt
call ebx
push 0x4010
lea ecx, [esp + 0x10]
push 0x160
push ecx
push 0x80
push str.1.txt
mov edi, eax
call ebx
mov edx, dword [esp + 0xc]
mov ebx, eax
push edx
call dword [sym.imp.USER32.dll_DestroyIcon]
test edi, edi
je 0x419cdd
test ebx, ebx
je 0x419cdd
push edi
call sub.MFC42.DLL_CImageList::FromHandle
test eax, eax
je 0x419c96
mov eax, dword [eax + 4]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov eax, dword [esi + 0x20]
push 1
push 0x1003
push eax
call edi
push eax
call sub.MFC42.DLL_CImageList::FromHandle
push ebx
call sub.MFC42.DLL_CImageList::FromHandle
test eax, eax
je 0x419cbd
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x20]
push eax
push 0
push 0x1003
push ecx
call edi
push eax
call sub.MFC42.DLL_CImageList::FromHandle
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x160
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x160
ret
Function at 0x41f80c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x41f853
cmp edx, 0x10
jl 0x41f83f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x41f82c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x41f853
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x41f84b
and edx, 3
cmp edx, 3
jne 0x41f867
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x41f86c
cmp edx, 2
jne 0x41f878
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x41f87d
cmp edx, 1
jne 0x41f883
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4231e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, 0x8000
xor cx, cx
push edi
mov edi, dword [esp + 0xc]
mov word [edi + 0x3c], ax
mov esi, dword [edi + 0x14]
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], eax
movzx eax, cx
inc cx
xor edx, edx
mov dl, byte [eax + esi + 0x8000]
mov eax, dword [edi + 0x20]
shl eax, 5
xor edx, eax
and edx, 0x7fff
cmp cx, 2
mov dword [edi + 0x20], edx
jb 0x4231ff
pop edi
pop esi
ret
Function at 0x428660
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x1c]
or al, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x34], 0
jne 0x42867d
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp + 0x34], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp + 0x34]
test eax, eax
jne 0x4286b0
xor eax, eax
jmp 0x428728
cmp dword [ebp + 0x30], 0
je 0x4286ca
mov eax, dword [ebp + 0x30]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x4286d1
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x30]
push edx
call fcn.004285c0
push eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00428730
add esp, 0x14
test eax, eax
jne 0x4286f7
xor eax, eax
jmp 0x428728
cmp dword [ebp + 0x2c], 0
je 0x42870f
push 0x10
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x2c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0x1c]
and ecx, 4
test ecx, ecx
jne 0x428723
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x30
Function at 0x428bcf
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call sub.MSVCRT.dll_memset
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x401ac0
Capabilities:
Create process on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x7f02
push 0
call dword [0x4d67d8]
mov edi, dword [0x4d67dc]
push eax
call edi
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ebx, eax
mov eax, dword [esp + 0x1c]
push 5
push eax
push 0
push ebp
push ecx
call dword [0x4d67d4]
push eax
call dword [0x4d6544]
push ebx
mov esi, eax
call edi
cmp esi, 0x1b
je 0x401b18
cmp esi, 0x1f
je 0x401b18
xor eax, eax
cmp esi, 0x20
pop edi
pop esi
pop ebp
pop ebx
setg al
ret
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 1
push edx
push ebp
push eax
call fcn.004018d0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403050
Capabilities:
Set registry value

Disassembly:
sub esp, 0x5c
mov edx, dword [esp + 0x60]
lea eax, [esp + 8]
lea ecx, [esp + 0x60]
push eax
push ecx
push 0
push 0x20006
push 0
push 0x4f55a8
push 0
push edx
push 0x80000001
call dword [0x4d602c]
test eax, eax
je 0x403087
xor eax, eax
add esp, 0x5c
ret
mov eax, dword [esp + 0x68]
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0x40c
push eax
call dword [0x4d67a0]
mov ebp, eax
lea ecx, [ebp + ebp*2]
lea eax, [ecx*4 + 4]
push eax
mov dword [esp + 0x18], eax
call fcn.004bd49b
mov edi, eax
add esp, 4
xor ebx, ebx
mov dword [esp + 0x10], edi
test ebp, ebp
mov dword [edi], ebp
lea esi, [edi + 4]
jle 0x40311d
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x78]
push edx
push ebx
push 0x41d
push eax
mov dword [esp + 0x2c], 0x50
mov dword [esp + 0x30], 0x141
call dword [0x4d67a0]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x24]
mov dword [esi], ecx
mov dword [esi + 8], edx
mov dword [esi + 4], eax
add esi, 0xc
inc ebx
cmp ebx, ebp
jl 0x4030ca
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
push ecx
push edi
push 3
push 0
push edx
push eax
call dword [0x4d6030]
push edi
mov esi, eax
call fcn.004bd4c4
mov ecx, dword [esp + 0x74]
add esp, 4
push ecx
call dword [0x4d6018]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
setge al
pop ebx
add esp, 0x5c
ret
Function at 0x403160
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x68
lea eax, [esp]
push ebp
xor ebp, ebp
push eax
push 0x20019
push ebp
push ecx
push 0x80000001
call dword [0x4d6024]
test eax, eax
jne 0x4032f1
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [0x4d6028]
lea edx, [esp + 0x78]
push esi
mov esi, dword [esp + 0x7c]
push edx
lea eax, [esp + 0x1c]
push ebp
push eax
push ebp
push esi
push ecx
call ebx
test eax, eax
jne 0x4032dd
mov edx, dword [esp + 0x7c]
push edi
push edx
call fcn.004bd49b
mov edx, dword [esp + 0x14]
add esp, 4
mov edi, eax
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
push ebp
push esi
push edx
mov dword [esp + 0x38], edi
call ebx
test eax, eax
jne 0x4032d3
mov eax, dword [edi]
lea ecx, [eax + eax*2]
lea edx, [ecx*4 + 4]
mov ecx, dword [esp + 0x80]
cmp ecx, edx
jne 0x4032d3
lea ecx, [edi + 4]
cmp eax, ebp
mov dword [esp + 0x24], 1
mov dword [esp + 0x14], ebp
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x18], ebp
jle 0x4032cf
mov ebx, dword [esp + 0x84]
mov ebp, dword [0x4d67a0]
mov edx, dword [esp + 0x7c]
push 0
mov eax, dword [edx]
push eax
push 0x410
push ebx
call ebp
mov esi, eax
test esi, esi
jl 0x4032b1
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0x50
push ecx
push esi
push 0x41d
push ebx
mov dword [esp + 0x3c], 0x41
call ebp
mov eax, dword [esp + 0x7c]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x54], edx
xor ecx, eax
lea edx, [esp + 0x28]
and ecx, 1
push edx
push esi
xor eax, ecx
push 0x406
push ebx
mov dword [esp + 0x40], eax
call ebp
mov ecx, dword [esp + 0x14]
mov eax, ecx
inc ecx
push eax
push esi
push 0x427
push ebx
mov dword [esp + 0x24], ecx
call ebp
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x18]
mov ecx, dword [edi]
add esi, 0xc
inc eax
mov dword [esp + 0x7c], esi
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x40322b
mov ebp, dword [esp + 0x24]
push edi
call fcn.004bd4c4
add esp, 4
pop edi
mov eax, dword [esp + 0xc]
push eax
call dword [0x4d6018]
pop esi
mov eax, ebp
pop ebx
pop ebp
add esp, 0x68
ret
mov eax, ebp
pop ebp
add esp, 0x68
ret
Function at 0x40fc4d
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4d1988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push ebx
push esi
mov esi, ecx
push eax
lea ecx, [esi + 0x1724]
call fcn.0041d730
xor ebx, ebx
mov dword [esp + 0x34], eax
cmp eax, ebx
je 0x40fe84
push ebp
push edi
push 0x80
mov dword [esp + 0x14], vtable.Table_class_DirEntry_.0
call fcn.004bd49b
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0x1f
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x10], vtable.DirTable.0
lea edi, [esi + 0x1b88]
mov dword [esp + 0x34], ebx
mov ecx, edi
call fcn.00431cf0
test eax, eax
jne 0x40fcf6
lea ecx, [esi + 0x2548]
call fcn.0042b570
test eax, eax
jne 0x40fd04
lea ecx, [esi + 0x2690]
call fcn.00429c90
test eax, eax
jne 0x40fd04
lea ecx, [esi + 0x27d4]
call fcn.0044f210
test eax, eax
jne 0x40fd04
lea ecx, [esi + 0x1a54]
call fcn.0042b570
test eax, eax
jne 0x40fd04
lea ecx, [esp + 0x10]
push 1
push ecx
mov ecx, edi
call fcn.0042d950
mov eax, dword [esi + 0x140]
mov ebp, dword [0x4d6358]
cmp eax, ebx
mov ebx, dword [0x4d63a4]
je 0x40fd57
mov edx, dword [esi + 0x13c]
push edx
call ebp
mov eax, dword [esi + 0x140]
push 0xbb8
push eax
call ebx
cmp eax, 0x102
jne 0x40fd40
push 0x40
call dword [0x4d6734]
mov ecx, dword [esi + 0x140]
push ecx
call dword [0x4d6384]
mov dword [esi + 0x140], 0
mov edx, dword [esp + 0x3c]
mov ecx, dword [esi + 0xcc]
lea eax, [esp + 0x10]
push edx
push eax
push ecx
lea ecx, [esi + 0x1724]
call fcn.0041d780
test eax, eax
je 0x40fd80
push 1
mov ecx, edi
call fcn.0042efe0
mov edx, dword [0x4f83ec]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
mov al, byte [ecx + 0x2ca]
test al, al
je 0x40fe31
mov ecx, dword [esi + 0x14c]
test ecx, ecx
je 0x40fe31
mov edx, dword [ecx]
call dword [edx + 0x10]
test eax, eax
jne 0x40fe31
mov eax, dword [esi + 0x140]
test eax, eax
je 0x40fe05
mov eax, dword [esi + 0x13c]
push eax
call ebp
mov ecx, dword [esi + 0x140]
push 0xbb8
push ecx
call ebx
cmp eax, 0x102
jne 0x40fde4
push 0x40
call dword [0x4d6734]
mov edx, dword [esi + 0x140]
push edx
call dword [0x4d6384]
mov dword [esi + 0x140], 0
mov eax, dword [esi + 0x140]
test eax, eax
jne 0x40fe31
mov eax, dword [esi + 0x13c]
push eax
call dword [0x4d63b4]
lea ecx, [esp + 0x3c]
push ecx
push 0
push esi
push 0x40c360
push 0
push 0
call fcn.004a899b
add esp, 0x18
mov dword [esi + 0x140], eax
mov eax, dword [esp + 0x20]
pop edi
test eax, eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0xc], vtable.Table_class_DirEntry_.0
pop ebp
je 0x40fe77
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jle 0x40fe77
cmp esi, eax
jge 0x40fe72
test esi, esi
jl 0x40fe72
mov edx, dword [esp + 0xc]
mov ecx, dword [edx + esi*4]
test ecx, ecx
je 0x40fe72
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x40fe59
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004bd4c4
add esp, 4
mov ecx, dword [esp + 0x24]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x416b00
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14c]
test ecx, ecx
je 0x416ba4
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x416ba4
mov eax, dword [esi + 0x140]
test eax, eax
je 0x416b78
mov ecx, dword [esi + 0x13c]
push ecx
call dword [0x4d6358]
mov edx, dword [esi + 0x140]
push 0xbb8
push edx
call dword [0x4d63a4]
cmp eax, 0x102
jne 0x416b57
push 0x40
call dword [0x4d6734]
mov eax, dword [esi + 0x140]
push eax
call dword [0x4d6384]
mov dword [esi + 0x140], 0
mov eax, dword [esi + 0x140]
test eax, eax
jne 0x416ba4
mov ecx, dword [esi + 0x13c]
push ecx
call dword [0x4d63b4]
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x40c360
push 0
push 0
call fcn.004a899b
add esp, 0x18
mov dword [esi + 0x140], eax
pop esi
pop ecx
ret

Function at 0x417b80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
push eax
call dword [0x4d67a4]
mov ecx, dword [0x4f83ec]
mov edx, dword fs:[0x2c]
mov ebp, dword [0x4d637c]
mov ebx, dword [edx + ecx*4]
lea edi, [ebx + 0x15]
push edi
call ebp
test eax, eax
je 0x417bd5
mov al, byte [ebx + 0x14]
test al, al
je 0x417bd5
push 0
push 0
push 1
push edi
mov ecx, esi
call fcn.00413710
test eax, eax
jne 0x417c4d
lea ebx, [ebx + 0x119]
push ebx
call ebp
test eax, eax
je 0x417bf4
push 0
push 0
push 1
push ebx
mov ecx, esi
call fcn.00413710
test eax, eax
jne 0x417c4d
mov edi, dword [0x4d634c]
lea eax, [esp + 0x10]
push eax
push 0x105
call edi
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x27
push 0
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
push 0
push 0
lea edx, [esp + 0x18]
push 1
push edx
mov ecx, esi
call fcn.00413710
test eax, eax
jne 0x417c4d
lea eax, [esp + 0x10]
push eax
push 0x105
call edi
push 0
push 0
lea ecx, [esp + 0x18]
push 1
push ecx
mov ecx, esi
call fcn.00413710
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret