joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f9c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b421
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x26c]
call fcn.0043e400
cmp word [eax + 0x4d4], 0
lea esi, [eax + 0x4d4]
jne 0x40fa3d
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x40fa3d
push esi
push 1
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x40fa3d
xor esi, esi
lea ecx, [esp + 0x14]
call fcn.00438f20
mov eax, esi
lea edx, [esp + 0x14]
call fcn.00439130
mov dword [esp + 0x264], 1
cmp dword [esp + 0x18], 0
je 0x40fac7
cmp byte [esp + 0x130], 0
lea eax, [esp + 0x20]
jne 0x40fa75
mov eax, dword [esp + 0x1c]
lea ebx, [eax + 4]
lea edi, [esp + 0x13c]
call fcn.004024b0
mov eax, str.SogouInputComponentsPicface
mov esi, edi
mov byte [esp + 0x264], 2
call fcn.00401520
cmp dword [esp + 0x13c], 0
jne 0x40faf2
cmp byte [esp + 0x24e], 0
jne 0x40fac7
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x40fac7
push eax
call fcn.004cc2c0
add esp, 4
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x40faee
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40faee
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x40fb70
push 0
lea ecx, [esp + 0x140]
call fcn.00401aa0
cmp byte [esp + 0x24e], 0
lea eax, [esp + 0x140]
jne 0x40fb18
mov eax, dword [esp + 0x248]
add eax, 4
mov edx, ebp
call fcn.00402540
cmp byte [esp + 0x24e], 0
jne 0x40fb47
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x40fb47
push eax
call fcn.004cc2c0
add esp, 4
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x40fb6e
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40fb6e
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x254
ret 4
Function at 0x40fba0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b421
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x26c]
call fcn.0043e400
cmp word [eax + 0x4d4], 0
lea esi, [eax + 0x4d4]
jne 0x40fc1d
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x40fc1d
push esi
push 1
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x40fc1d
xor esi, esi
lea ecx, [esp + 0x14]
call fcn.00438f20
mov eax, esi
lea edx, [esp + 0x14]
call fcn.00439130
mov dword [esp + 0x264], 1
cmp dword [esp + 0x18], 0
je 0x40fca7
cmp byte [esp + 0x130], 0
lea eax, [esp + 0x20]
jne 0x40fc55
mov eax, dword [esp + 0x1c]
lea ebx, [eax + 4]
lea edi, [esp + 0x13c]
call fcn.004024b0
mov eax, str.SogouInputComponentsPicfaceJson
mov esi, edi
mov byte [esp + 0x264], 2
call fcn.00401520
cmp dword [esp + 0x13c], 0
jne 0x40fcd2
cmp byte [esp + 0x24e], 0
jne 0x40fca7
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x40fca7
push eax
call fcn.004cc2c0
add esp, 4
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x40fcce
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40fcce
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x40fd50
push 0
lea ecx, [esp + 0x140]
call fcn.00401aa0
cmp byte [esp + 0x24e], 0
lea eax, [esp + 0x140]
jne 0x40fcf8
mov eax, dword [esp + 0x248]
add eax, 4
mov edx, ebp
call fcn.00402540
cmp byte [esp + 0x24e], 0
jne 0x40fd27
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x40fd27
push eax
call fcn.004cc2c0
add esp, 4
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x40fd4e
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40fd4e
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x254
ret 4
Function at 0x40fd80
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b38b
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402540
mov eax, str.SGPicFaceTpBq
call fcn.00401520
mov eax, 0x521504
call fcn.00401520
lea ecx, [esp + 0xc]
call fcn.00438f20
mov dword [esp + 0x34c], 0
mov eax, dword [0x547654]
test eax, eax
jne 0x40fe61
push 0x14
call fcn.004cf9e8
add esp, 4
test eax, eax
je 0x40fe56
or ecx, 0xffffffff
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov byte [eax + 0xc], 1
mov dword [eax + 0x10], ecx
mov dword [eax], 0
jmp 0x40fe58
xor eax, eax
mov dword [0x547654], eax
test eax, eax
jne 0x40fe61
mov eax, dword [eax + 0x10]
push eax
push 0x51ff34
lea edx, [esp + 0x14]
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x40fe88
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401520
cmp dword [esi], 0
jne 0x40fedb
mov ecx, edi
call fcn.00438300
push 0x521518
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x40fed7
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x40fed7
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x40ff3e
mov ecx, esi
call fcn.00401680
test al, al
jne 0x40ff15
cmp byte [esp + 0x354], al
je 0x40ff15
push 1
mov ecx, esi
call fcn.00401aa0
test al, al
jne 0x40ff15
push 0x521518
mov ecx, edi
call fcn.00402790
lea ecx, [esp + 0xc]
call fcn.00439080
xor al, al
jmp 0x40ff3e
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x40ff3c
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x40ff3c
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x348
ret 4
Function at 0x40ff70
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b38b
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402540
mov eax, str.SGPicFaceTpBq
call fcn.00401520
mov eax, str.ToolPicFace
call fcn.00401520
lea ecx, [esp + 0xc]
call fcn.00438f20
mov dword [esp + 0x34c], 0
mov eax, dword [0x547654]
test eax, eax
jne 0x410051
push 0x14
call fcn.004cf9e8
add esp, 4
test eax, eax
je 0x410046
or ecx, 0xffffffff
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov byte [eax + 0xc], 1
mov dword [eax + 0x10], ecx
mov dword [eax], 0
jmp 0x410048
xor eax, eax
mov dword [0x547654], eax
test eax, eax
jne 0x410051
mov eax, dword [eax + 0x10]
push eax
push 0x51ff34
lea edx, [esp + 0x14]
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x410078
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401520
cmp dword [esi], 0
jne 0x4100cb
mov ecx, edi
call fcn.00438300
push 0x521518
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x4100c7
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x4100c7
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x41012e
mov ecx, esi
call fcn.00401680
test al, al
jne 0x410105
cmp byte [esp + 0x354], al
je 0x410105
push 1
mov ecx, esi
call fcn.00401aa0
test al, al
jne 0x410105
push 0x521518
mov ecx, edi
call fcn.00402790
lea ecx, [esp + 0xc]
call fcn.00439080
xor al, al
jmp 0x41012e
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x41012c
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x41012c
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x348
ret 4
Function at 0x4104f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b38b
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402540
mov eax, str.SGPicFaceTpBq
call fcn.00401520
mov eax, str.SysCell
call fcn.00401520
lea ecx, [esp + 0xc]
call fcn.00438f20
mov dword [esp + 0x34c], 0
mov eax, dword [0x547654]
test eax, eax
jne 0x4105d1
push 0x14
call fcn.004cf9e8
add esp, 4
test eax, eax
je 0x4105c6
or ecx, 0xffffffff
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov byte [eax + 0xc], 1
mov dword [eax + 0x10], ecx
mov dword [eax], 0
jmp 0x4105c8
xor eax, eax
mov dword [0x547654], eax
test eax, eax
jne 0x4105d1
mov eax, dword [eax + 0x10]
push eax
push 0x51ff34
lea edx, [esp + 0x14]
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x4105f8
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401520
cmp dword [esi], 0
jne 0x41064b
mov ecx, edi
call fcn.00438300
push 0x521518
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410647
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x410647
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x4106ae
mov ecx, esi
call fcn.00401680
test al, al
jne 0x410685
cmp byte [esp + 0x354], al
je 0x410685
push 1
mov ecx, esi
call fcn.00401aa0
test al, al
jne 0x410685
push 0x521518
mov ecx, edi
call fcn.00402790
lea ecx, [esp + 0xc]
call fcn.00439080
xor al, al
jmp 0x4106ae
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x4106ac
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x4106ac
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x348
ret 4
Function at 0x4106e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b38b
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402540
mov eax, str.SGPicFaceTpBq
call fcn.00401520
mov eax, str.QQPackage
call fcn.00401520
lea ecx, [esp + 0xc]
call fcn.00438f20
mov dword [esp + 0x34c], 0
mov eax, dword [0x547654]
test eax, eax
jne 0x4107c1
push 0x14
call fcn.004cf9e8
add esp, 4
test eax, eax
je 0x4107b6
or ecx, 0xffffffff
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov byte [eax + 0xc], 1
mov dword [eax + 0x10], ecx
mov dword [eax], 0
jmp 0x4107b8
xor eax, eax
mov dword [0x547654], eax
test eax, eax
jne 0x4107c1
mov eax, dword [eax + 0x10]
push eax
push 0x51ff34
lea edx, [esp + 0x14]
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x4107e8
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401520
cmp dword [esi], 0
jne 0x41083b
mov ecx, edi
call fcn.00438300
push 0x521518
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410837
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x410837
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x41089e
mov ecx, esi
call fcn.00401680
test al, al
jne 0x410875
cmp byte [esp + 0x354], al
je 0x410875
push 1
mov ecx, esi
call fcn.00401aa0
test al, al
jne 0x410875
push 0x521518
mov ecx, edi
call fcn.00402790
lea ecx, [esp + 0xc]
call fcn.00439080
xor al, al
jmp 0x41089e
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x41089c
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x41089c
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x348
ret 4
Function at 0x4108d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b38b
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402540
mov eax, str.SGPicFaceTpBq
call fcn.00401520
mov eax, str.CloudCell
call fcn.00401520
lea ecx, [esp + 0xc]
call fcn.00438f20
mov dword [esp + 0x34c], 0
mov eax, dword [0x547654]
test eax, eax
jne 0x4109b1
push 0x14
call fcn.004cf9e8
add esp, 4
test eax, eax
je 0x4109a6
or ecx, 0xffffffff
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov byte [eax + 0xc], 1
mov dword [eax + 0x10], ecx
mov dword [eax], 0
jmp 0x4109a8
xor eax, eax
mov dword [0x547654], eax
test eax, eax
jne 0x4109b1
mov eax, dword [eax + 0x10]
push eax
push 0x51ff34
lea edx, [esp + 0x14]
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x4109d8
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401520
cmp dword [esi], 0
jne 0x410a2b
mov ecx, edi
call fcn.00438300
push 0x521518
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410a27
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x410a27
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x410a8e
mov ecx, esi
call fcn.00401680
test al, al
jne 0x410a65
cmp byte [esp + 0x354], al
je 0x410a65
push 1
mov ecx, esi
call fcn.00401aa0
test al, al
jne 0x410a65
push 0x521518
mov ecx, edi
call fcn.00402790
lea ecx, [esp + 0xc]
call fcn.00439080
xor al, al
jmp 0x410a8e
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410a8c
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x410a8c
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x348
ret 4
Function at 0x410ac0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b38b
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402540
mov eax, str.SGPicFaceTpBq
call fcn.00401520
mov eax, str.UserCell
call fcn.00401520
lea ecx, [esp + 0xc]
call fcn.00438f20
mov dword [esp + 0x34c], 0
mov eax, dword [0x547654]
test eax, eax
jne 0x410ba1
push 0x14
call fcn.004cf9e8
add esp, 4
test eax, eax
je 0x410b96
or ecx, 0xffffffff
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov byte [eax + 0xc], 1
mov dword [eax + 0x10], ecx
mov dword [eax], 0
jmp 0x410b98
xor eax, eax
mov dword [0x547654], eax
test eax, eax
jne 0x410ba1
mov eax, dword [eax + 0x10]
push eax
push 0x51ff34
lea edx, [esp + 0x14]
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x410bc8
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401520
cmp dword [esi], 0
jne 0x410c1b
mov ecx, edi
call fcn.00438300
push 0x521518
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410c17
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x410c17
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x410c7e
mov ecx, esi
call fcn.00401680
test al, al
jne 0x410c55
cmp byte [esp + 0x354], al
je 0x410c55
push 1
mov ecx, esi
call fcn.00401aa0
test al, al
jne 0x410c55
push 0x521518
mov ecx, edi
call fcn.00402790
lea ecx, [esp + 0xc]
call fcn.00439080
xor al, al
jmp 0x410c7e
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410c7c
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x410c7c
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x348
ret 4
Function at 0x410cb0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b38b
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402540
mov eax, str.SGPicFaceTpBq
call fcn.00401520
mov eax, str.PkgMapZip
call fcn.00401520
lea ecx, [esp + 0xc]
call fcn.00438f20
mov dword [esp + 0x34c], 0
mov eax, dword [0x547654]
test eax, eax
jne 0x410d91
push 0x14
call fcn.004cf9e8
add esp, 4
test eax, eax
je 0x410d86
or ecx, 0xffffffff
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov byte [eax + 0xc], 1
mov dword [eax + 0x10], ecx
mov dword [eax], 0
jmp 0x410d88
xor eax, eax
mov dword [0x547654], eax
test eax, eax
jne 0x410d91
mov eax, dword [eax + 0x10]
push eax
push 0x51ff34
lea edx, [esp + 0x14]
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x410db8
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401520
cmp dword [esi], 0
jne 0x410e0b
mov ecx, edi
call fcn.00438300
push 0x521518
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410e07
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x410e07
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x410e6e
mov ecx, esi
call fcn.00401680
test al, al
jne 0x410e45
cmp byte [esp + 0x354], al
je 0x410e45
push 1
mov ecx, esi
call fcn.00401aa0
test al, al
jne 0x410e45
push 0x521518
mov ecx, edi
call fcn.00402790
lea ecx, [esp + 0xc]
call fcn.00439080
xor al, al
jmp 0x410e6e
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x410e6c
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x410e6c
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x348
ret 4
Function at 0x412e60
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50b38b
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x334], eax
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x13e]
push ecx
mov word [esp + 0x140], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x134]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x134]
mov edx, esi
call fcn.00402540
mov eax, str.SGPicFaceTpBq
call fcn.00401520
mov eax, str.CandBlackList
call fcn.00401520
lea ecx, [esp + 0xc]
call fcn.00438f20
mov dword [esp + 0x34c], 0
mov eax, dword [0x547654]
test eax, eax
jne 0x412f41
push 0x14
call fcn.004cf9e8
add esp, 4
test eax, eax
je 0x412f36
or ecx, 0xffffffff
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov byte [eax + 0xc], 1
mov dword [eax + 0x10], ecx
mov dword [eax], 0
jmp 0x412f38
xor eax, eax
mov dword [0x547654], eax
test eax, eax
jne 0x412f41
mov eax, dword [eax + 0x10]
push eax
push 0x51ff34
lea edx, [esp + 0x14]
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x412f68
mov eax, dword [esp + 0x14]
add eax, 4
call fcn.00401520
cmp dword [esi], 0
jne 0x412fbb
mov ecx, edi
call fcn.00438300
push 0x521518
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x412fb7
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x412fb7
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x41301e
mov ecx, esi
call fcn.00401680
test al, al
jne 0x412ff5
cmp byte [esp + 0x354], al
je 0x412ff5
push 1
mov ecx, esi
call fcn.00401aa0
test al, al
jne 0x412ff5
push 0x521518
mov ecx, edi
call fcn.00402790
lea ecx, [esp + 0xc]
call fcn.00439080
xor al, al
jmp 0x41301e
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x41301c
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x41301c
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x348
ret 4