joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4114dcd0
Capabilities:
Print debug messages

Disassembly:
cmp rcx, rdx
je 0x4114de1a
push r12
push r13
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x20], r14
mov r13, rdx
xor r14d, r14d
mov r12, rcx
lea rdi, [rcx + 0x40]
nop
nop
nop
lea rcx, [0x412a02a8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rsi, qword [rdi]
test rsi, rsi
je 0x4114ddbc
mov rbp, qword [rdi + 8]
cmp rsi, rbp
je 0x4114ddb4
lea rbx, [rsi + 0x80]
nop
cmp qword [rbx], 8
jb 0x4114dd4f
mov rcx, qword [rbx - 0x18]
call fcn.41210d60
mov qword [rbx], 7
mov qword [rbx - 8], r14
mov word [rbx - 0x18], r14w
cmp qword [rbx - 0x30], 8
jb 0x4114dd6f
mov rcx, qword [rbx - 0x48]
call fcn.41210d60
mov qword [rbx - 0x30], 7
mov qword [rbx - 0x38], r14
mov word [rbx - 0x48], r14w
cmp qword [rbx - 0x58], 8
jb 0x4114dd90
mov rcx, qword [rbx - 0x70]
call fcn.41210d60
mov qword [rbx - 0x58], 7
mov qword [rbx - 0x60], r14
add rsi, 0x98
mov word [rbx - 0x70], r14w
add rbx, 0x98
cmp rsi, rbp
jne 0x4114dd40
mov rcx, qword [rdi]
call fcn.41210d60
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
cmp qword [rdi - 0x18], 8
jb 0x4114ddd7
mov rcx, qword [rdi - 0x30]
call fcn.41210d60
mov qword [rdi - 0x18], 7
mov qword [rdi - 0x20], r14
add r12, 0x58
mov word [rdi - 0x30], r14w
add rdi, 0x58
cmp r12, r13
jne 0x4114dd10
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop r13
pop r12
ret 0
Function at 0x4114e9f0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor r15d, r15d
mov dword [rsp + 0xc0], r15d
mov r12, qword [rax + 0x30]
mov r13, qword [rsp + 0xe0]
cmp rdx, r8
je 0x4114ea7e
mov rsi, qword [rsp + 0xf0]
cmp rbp, r13
je 0x4114ea7e
mov rdx, rbx
mov rcx, rbp
call rsi
test al, al
je 0x4114ea6a
mov rdx, rbp
mov rcx, r12
call fcn.4114cd20
add rbp, 0x58
jmp 0x4114ea79
mov rdx, rbx
mov rcx, r12
call fcn.4114cd20
add rbx, 0x58
cmp rbx, rdi
jne 0x4114ea48
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov rax, qword [r12 + 0x28]
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.4114e210
mov rcx, qword [rax + 0x28]
mov qword [r12 + 0x28], rcx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x4114ebcc
cmp rcx, qword [rsp + 0x70]
je 0x4114ebc7
lea rdi, [rcx + 0x40]
nop
lea rcx, [0x412a02a8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbx, qword [rdi]
test rbx, rbx
je 0x4114eb82
mov rsi, qword [rdi + 8]
cmp rbx, rsi
je 0x4114eb7a
sub rbx, 0xffffffffffffff80
cmp qword [rbx], 8
jb 0x4114eb15
mov rcx, qword [rbx - 0x18]
call fcn.41210d60
mov qword [rbx], 7
mov qword [rbx - 8], r15
mov word [rbx - 0x18], 0
cmp qword [rbx - 0x30], 8
jb 0x4114eb36
mov rcx, qword [rbx - 0x48]
call fcn.41210d60
mov qword [rbx - 0x30], 7
mov qword [rbx - 0x38], r15
mov word [rbx - 0x48], 0
cmp qword [rbx - 0x58], 8
jb 0x4114eb58
mov rcx, qword [rbx - 0x70]
call fcn.41210d60
mov qword [rbx - 0x58], 7
mov qword [rbx - 0x60], r15
mov word [rbx - 0x70], 0
add rbx, 0x98
lea rax, [rbx - 0x80]
cmp rax, rsi
jne 0x4114eb06
mov rcx, qword [rdi]
call fcn.41210d60
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
cmp qword [rdi - 0x18], 8
jb 0x4114eb9d
mov rcx, qword [rdi - 0x30]
call fcn.41210d60
mov qword [rdi - 0x18], 7
mov qword [rdi - 0x20], r15
mov word [rdi - 0x30], 0
add rdi, 0x58
lea rax, [rdi - 0x40]
cmp rax, qword [rsp + 0x70]
jne 0x4114eae0
mov rcx, qword [rsp + 0x60]
call fcn.41210d60
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov rax, qword [r12 + 0x28]
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x28]
mov r8, r13
mov rdx, rbp
mov rcx, r14
call fcn.4114e210
nop
mov rcx, r12
call fcn.4114c8e0
mov rax, r14
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x41152db0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x41152e0e
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x41152dd0
test rbx, rbx
je 0x41152e0e
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x41152e0e
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x41172620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x98], rax
movsxd rsi, r9d
mov r12, r8
mov r8, rcx
mov rcx, qword [r12 + 8]
test rcx, rcx
jne 0x41172666
xor eax, eax
jmp 0x41172672
mov rax, qword [r12 + 0x10]
sub rax, rcx
sar rax, 3
mov rdi, rsi
cmp rax, rsi
jbe 0x41172851
test rcx, rcx
jne 0x41172687
xor eax, eax
jmp 0x41172693
mov rax, qword [r12 + 0x10]
sub rax, rcx
sar rax, 3
movsxd rbx, dword [rsp + 0x110]
mov r15, rbx
cmp rax, rbx
ja 0x41172851
mov rcx, r8
call fcn.4116dc20
test eax, eax
je 0x41172856
mov rax, qword [0x41361250]
test rax, rax
jne 0x411726ea
mov ecx, 0x36a0
call fcn.41211580
mov qword [rsp + 0x20], rax
test rax, rax
je 0x411726e1
mov rcx, rax
call fcn.411711f0
jmp 0x411726e3
xor eax, eax
mov qword [0x41361250], rax
mov rcx, rax
call fcn.41180d50
mov r14, rax
cmp esi, ebx
jge 0x41172851
nop
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x4117271b
mov rax, qword [r12 + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x41172720
call fcn.41211d60
mov rax, qword [r12 + 8]
mov rbx, qword [rax + rdi*8]
lea rdx, [rbx + 0x70]
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], 0
mov word [rsp + 0x78], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x70]
call fcn.41022de0
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.41144510
mov r13, qword [r14 + 8]
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x41172783
cmp rsi, r14
je 0x41172788
call fcn.41211d60
mov rbp, qword [rsp + 0x28]
cmp rbp, r13
je 0x4117282f
test rsi, rsi
jne 0x411727a0
call fcn.41211d60
cmp rbp, qword [rsi + 8]
jne 0x411727ab
call fcn.41211d60
mov eax, dword [rbp + 0x40]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x44]
mov dword [rsp + 0x3c], eax
mov eax, dword [rbp + 0x48]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0x4c]
mov dword [rsp + 0x44], eax
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], 0
mov word [rsp + 0x50], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x48]
call fcn.41022de0
mov edx, dword [rbx + 0x18]
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
cmp edx, eax
jbe 0x4117280c
lea eax, [rdx + rcx]
mov dword [rbx + 0x18], eax
jmp 0x4117280f
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], ecx
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0xec], eax
cmp qword [rsp + 0x68], 8
jb 0x4117282f
mov rcx, qword [rsp + 0x50]
call fcn.41210d60
nop
cmp qword [rsp + 0x90], 8
jb 0x41172844
mov rcx, qword [rsp + 0x78]
call fcn.41210d60
add rdi, 1
cmp rdi, r15
jl 0x41172700
mov eax, 1
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.41211b80
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x41181330
Capabilities:
Reference sql statements

Disassembly:
push r12
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov r12, rdx
mov rsi, rcx
cmp qword [rcx + 0x20], 0x10
jb 0x41181366
mov rbp, qword [rcx + 8]
jmp 0x4118136a
lea rbp, [rcx + 8]
mov ebx, 0xf
mov qword [rsp + 0x48], rbx
xor r8d, r8d
mov qword [rsp + 0x40], r8
mov byte [rsp + 0x30], r8b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp rcx, 0xfffffffffffffffe
jbe 0x411813ab
call fcn.4120fbc0
mov rbx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
cmp rbx, rdi
jae 0x411813c4
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.41001870
mov rbx, qword [rsp + 0x48]
jmp 0x411813e7
test rdi, rdi
jne 0x411813e7
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x30]
cmp rbx, 0x10
cmovae rax, qword [rsp + 0x30]
mov byte [rax], dil
mov rbx, qword [rsp + 0x48]
jmp 0x41181428
test rdi, rdi
je 0x41181428
lea rcx, [rsp + 0x30]
cmp rbx, 0x10
cmovae rcx, qword [rsp + 0x30]
mov r9, rdi
mov r8, rbp
mov rdx, rbx
call fcn.412118b0
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rax, qword [rsp + 0x30]
mov byte [rax + rdi], 0
mov rbx, qword [rsp + 0x48]
xor edx, edx
mov r8d, 0x190
lea rcx, [rsi + 0x2c]
call fcn.412121c0
lea r8, [rsp + 0x30]
cmp rbx, 0x10
cmovae r8, qword [rsp + 0x30]
lea rdx, str.SELECT_count___FROM_sqlite_master_WHERE_typetable_AND_name_s_
lea rcx, [rsi + 0x2c]
call fcn.41212990
mov rcx, qword [rsi + 0x1e8]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsi + 0x2c]
call qword [rax + 0x60]
xor edi, edi
test eax, eax
setne dil
cmp qword [rsp + 0x48], 0x10
jb 0x41181489
mov rcx, qword [rsp + 0x30]
call fcn.41210d60
test edi, edi
je 0x4118149c
mov dword [r12], 1
mov eax, 1
jmp 0x411814ac
mov dword [r12], 0
mov rcx, rsi
call fcn.41180fe0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x41185fe0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.412121c0
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x140], 0
call fcn.412121c0
lea rdx, [rsp + 0x140]
mov rcx, rdi
call fcn.41035a70
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4118605e
mov rcx, rdi
call fcn.410522e0
lea r9, str.UserData.db
lea r8, [rsp + 0x140]
lea rdx, [0x412b7a74]
lea rcx, [rsp + 0x30]
call fcn.41212990
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdx
lea rdi, [0x412b7a70]
lea rdx, [0x4129b970]
mov r9, rdi
mov r8d, 0xcea
mov qword [rsp + 0x20], rdi
call qword [rax]
test eax, eax
jne 0x411860b4
xor eax, eax
jmp 0x41186132
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x68]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x104
call fcn.412121c0
lea r9, str.UserFreqData.db
lea r8, [rsp + 0x140]
lea rdx, [0x412b7a74]
lea rcx, [rsp + 0x30]
call fcn.41212990
mov rcx, qword [rbx + 0x18]
lea r10, [rsp + 0x30]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r10
lea rdx, [0x4129b970]
mov r9, rdi
mov r8d, 0xcea
mov qword [rsp + 0x20], rdi
call qword [rax]
test eax, eax
je 0x411860b0
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.41211b80
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
Function at 0x411c0300
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x250
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 4], 0
mov rbx, rcx
je 0x411c049b
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov qword [r11 - 0x18], r13
mov word [rsp + 0x20], 0
call fcn.412121c0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
or r13, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbp, rcx
je 0x411c0439
mov r9, qword [rbx + 0x40]
test r9, r9
je 0x411c047b
cmp rcx, r9
ja 0x411c047b
mov eax, 1
sub rax, rcx
add r9, rax
cmp qword [rbx + 0x48], 8
jb 0x411c03b6
mov r11, qword [rbx + 0x30]
lea rsi, [rbx + 0x30]
jmp 0x411c03bd
lea rsi, [rbx + 0x30]
mov r11, rsi
movzx r10d, word [rsp + 0x20]
nop
nop
nop
nop
test r9, r9
mov rax, r9
mov rdx, r11
je 0x411c047b
nop
cmp word [rdx], r10w
je 0x411c03f5
add rdx, 2
sub rax, 1
jne 0x411c03e0
jmp 0x411c047b
test rdx, rdx
je 0x411c047b
test rbp, rbp
mov rcx, rbp
lea rdi, [rsp + 0x20]
mov r8, rdx
je 0x411c0427
nop
movzx eax, word [rdi]
cmp word [r8], ax
jne 0x411c0446
add r8, 2
add rdi, 2
sub rcx, 1
jne 0x411c0410
cmp qword [rbx + 0x48], 8
jb 0x411c0431
mov rsi, qword [rsi]
sub rdx, rsi
sar rdx, 1
jne 0x411c047b
cmp qword [rbx + 0x48], 8
jb 0x411c0472
mov rcx, qword [rbx + 0x30]
jmp 0x411c0476
cmp word [r8], ax
mov ecx, 1
cmovb ecx, r13d
test ecx, ecx
je 0x411c0427
mov rcx, rdx
mov rax, r13
sub rcx, r11
lea r11, [rdx + 2]
sar rcx, 1
sub rax, rcx
add r9, rax
jmp 0x411c03d0
lea rcx, [rbx + 0x30]
call fcn.41035fe0
mov rdi, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x268]
mov r13, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.41211b80
add rsp, 0x250
pop rbx
ret
Function at 0x411c8640
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x250
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 0x260], 0
mov rbx, rcx
je 0x411c87e7
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov qword [r11 - 0x18], r13
mov word [rsp + 0x20], 0
call fcn.412121c0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
or r13, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbp, rcx
je 0x411c877c
mov r9, qword [rbx + 0x280]
test r9, r9
je 0x411c87c7
cmp rcx, r9
ja 0x411c87c7
mov eax, 1
sub rax, rcx
add r9, rax
cmp qword [rbx + 0x288], 8
jb 0x411c8701
lea rsi, [rbx + 0x270]
mov r11, qword [rsi]
jmp 0x411c870b
lea rsi, [rbx + 0x270]
mov r11, rsi
movzx r10d, word [rsp + 0x20]
test r9, r9
mov rax, r9
mov rdx, r11
je 0x411c87c7
cmp word [rdx], r10w
je 0x411c8735
add rdx, 2
sub rax, 1
jne 0x411c8720
jmp 0x411c87c7
test rdx, rdx
je 0x411c87c7
test rbp, rbp
mov rcx, rbp
lea rdi, [rsp + 0x20]
mov r8, rdx
je 0x411c8767
nop
movzx eax, word [rdi]
cmp word [r8], ax
jne 0x411c878f
add r8, 2
add rdi, 2
sub rcx, 1
jne 0x411c8750
cmp qword [rbx + 0x288], 8
jb 0x411c8774
mov rsi, qword [rsi]
sub rdx, rsi
sar rdx, 1
jne 0x411c87c7
cmp qword [rbx + 0x288], 8
jb 0x411c87bb
mov rcx, qword [rbx + 0x270]
jmp 0x411c87c2
cmp word [r8], ax
mov ecx, 1
cmovb ecx, r13d
test ecx, ecx
je 0x411c8767
mov rcx, rdx
mov rax, r13
sub rcx, r11
lea r11, [rdx + 2]
sar rcx, 1
sub rax, rcx
add r9, rax
jmp 0x411c8711
lea rcx, [rbx + 0x270]
call fcn.41035fe0
mov rdi, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x268]
mov r13, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.41211b80
add rsp, 0x250
pop rbx
ret
Function at 0x411c96f0
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x2b0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rdx, r8
lea rcx, str.LoadCopy_DictName___s
call fcn.41050860
test rsi, rsi
je 0x411c9943
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411c9943
mov qword [rsp + 0x88], 7
xor r12d, r12d
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], r12w
mov dword [rsp + 0x30], r12d
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x68]
mov rdx, rbx
mov rcx, rsi
call fcn.411fc140
test eax, eax
jne 0x411c97a2
cmp qword [rsp + 0x88], 8
jb 0x411c979b
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
xor eax, eax
jmp 0x411c9945
mov edx, 0x3e8
mov ecx, 0xa
call fcn.41035af0
mov ebp, eax
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], 0
lea r9, [rsp + 0x40]
mov r8d, eax
mov rdx, rbx
mov rcx, rsi
call fcn.411fc800
test eax, eax
jne 0x411c9822
cmp qword [rsp + 0x60], 8
jb 0x411c97f1
mov rcx, qword [rsp + 0x48]
call fcn.41210d60
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], 0
cmp qword [rsp + 0x88], 8
jb 0x411c981b
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
xor eax, eax
jmp 0x411c9945
mov dword [rsp + 0x20], ebp
mov r9, rbx
lea r8, str.SmartCloudInput
lea rdx, str._s_s_Copy_d
lea rcx, [rsp + 0x90]
call fcn.412122b0
lea rcx, [rdi + 0x268]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.41022de0
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea r8, [rsp + 0x90]
mov rcx, rdi
call fcn.41200790
test eax, eax
je 0x411c989b
mov rcx, rdi
call fcn.41067ca0
mov qword [rdi + 0x230], rax
add rax, 0xe
mov qword [rdi + 0x228], rax
mov rsi, qword [rdi + 0x230]
test rsi, rsi
je 0x411c9903
cmp dword [rsi + 0xa], 0x4e20
jne 0x411c9903
lea rdi, str.__GS__
mov ecx, 7
repe cmpsb byte [rsi], byte [rdi]
jne 0x411c9903
cmp qword [rsp + 0x60], 8
jb 0x411c98d2
mov rcx, qword [rsp + 0x48]
call fcn.41210d60
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], 0
cmp qword [rsp + 0x88], 8
jb 0x411c98fc
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
mov eax, 1
jmp 0x411c9945
cmp qword [rsp + 0x60], 8
jb 0x411c9915
mov rcx, qword [rsp + 0x48]
call fcn.41210d60
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], 0
cmp qword [rsp + 0x88], 8
jb 0x411c993f
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
xor eax, eax
jmp 0x411c9945
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.41211b80
add rsp, 0x2b0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x411cbff0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x250
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 0x15e8], 0
mov rbx, rcx
je 0x411cc197
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov qword [r11 - 0x18], r13
mov word [rsp + 0x20], 0
call fcn.412121c0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
or r13, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbp, rcx
je 0x411cc12c
mov r9, qword [rbx + 0x1608]
test r9, r9
je 0x411cc177
cmp rcx, r9
ja 0x411cc177
mov eax, 1
sub rax, rcx
add r9, rax
cmp qword [rbx + 0x1610], 8
jb 0x411cc0b1
lea rsi, [rbx + 0x15f8]
mov r11, qword [rsi]
jmp 0x411cc0bb
lea rsi, [rbx + 0x15f8]
mov r11, rsi
movzx r10d, word [rsp + 0x20]
test r9, r9
mov rax, r9
mov rdx, r11
je 0x411cc177
cmp word [rdx], r10w
je 0x411cc0e5
add rdx, 2
sub rax, 1
jne 0x411cc0d0
jmp 0x411cc177
test rdx, rdx
je 0x411cc177
test rbp, rbp
mov rcx, rbp
lea rdi, [rsp + 0x20]
mov r8, rdx
je 0x411cc117
nop
movzx eax, word [rdi]
cmp word [r8], ax
jne 0x411cc13f
add r8, 2
add rdi, 2
sub rcx, 1
jne 0x411cc100
cmp qword [rbx + 0x1610], 8
jb 0x411cc124
mov rsi, qword [rsi]
sub rdx, rsi
sar rdx, 1
jne 0x411cc177
cmp qword [rbx + 0x1610], 8
jb 0x411cc16b
mov rcx, qword [rbx + 0x15f8]
jmp 0x411cc172
cmp word [r8], ax
mov ecx, 1
cmovb ecx, r13d
test ecx, ecx
je 0x411cc117
mov rcx, rdx
mov rax, r13
sub rcx, r11
lea r11, [rdx + 2]
sar rcx, 1
sub rax, rcx
add r9, rax
jmp 0x411cc0c1
lea rcx, [rbx + 0x15f8]
call fcn.41035fe0
mov rdi, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x268]
mov r13, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.41211b80
add rsp, 0x250
pop rbx
ret
Function at 0x411cec80
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x2b0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x411cee91
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411cee91
mov qword [rsp + 0x88], 7
xor r12d, r12d
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], r12w
mov dword [rsp + 0x30], r12d
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x68]
mov rdx, rdi
mov rcx, rbx
call fcn.411fc140
test eax, eax
jne 0x411ced23
cmp qword [rsp + 0x88], 8
jb 0x411ced1c
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
xor eax, eax
jmp 0x411cee93
mov edx, 0x3e8
mov ecx, 0xa
call fcn.41035af0
mov ebp, eax
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], 0
lea r9, [rsp + 0x40]
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.411fc800
test eax, eax
jne 0x411ceda3
cmp qword [rsp + 0x60], 8
jb 0x411ced72
mov rcx, qword [rsp + 0x48]
call fcn.41210d60
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], 0
cmp qword [rsp + 0x88], 8
jb 0x411ced9c
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
xor eax, eax
jmp 0x411cee93
mov dword [rsp + 0x20], ebp
mov r9, rdi
lea r8, str.SmartCloudInput
lea rdx, str._s_s_Copy_d
lea rcx, [rsp + 0x90]
call fcn.412122b0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsi + 0x15f0]
call fcn.41022de0
cmp qword [rsi + 0x1610], 8
jb 0x411cedf0
mov rdx, qword [rsi + 0x15f8]
jmp 0x411cedf7
lea rdx, [rsi + 0x15f8]
lea r8, [rsp + 0x90]
mov rcx, rsi
call fcn.411cdb30
test eax, eax
je 0x411cee4e
cmp qword [rsp + 0x60], 8
jb 0x411cee1d
mov rcx, qword [rsp + 0x48]
call fcn.41210d60
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], 0
cmp qword [rsp + 0x88], 8
jb 0x411cee47
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
mov eax, 1
jmp 0x411cee93
cmp qword [rsp + 0x60], 8
jb 0x411cee60
mov rcx, qword [rsp + 0x48]
call fcn.41210d60
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], 0
cmp qword [rsp + 0x88], 8
jb 0x411cee8a
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
mov eax, 1
jmp 0x411cee93
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.41211b80
add rsp, 0x2b0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret