joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034f00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
js 0x100350d4
lea eax, [ebx - 0x1e]
cmp eax, 0x13
ja 0x10034f51
mov esi, 0x1e
lea edi, [ecx + 8]
push ecx
push esi
mov ecx, edi
call fcn.10035840
test eax, eax
je 0x10034f42
mov ecx, eax
cmp esi, ebx
jne 0x10034f3b
push 1
jmp 0x10034f3d
push 0
call fcn.1005c7f6
inc esi
cmp esi, 0x2d
jle 0x10034f24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add ecx, 8
mov edi, 1
mov dword [ebp - 0xc], ecx
nop dword [eax]
push 0xffffffffffffffff
push edi
call fcn.10058ab6
mov esi, eax
test esi, esi
je 0x10034f9c
mov edx, dword [esi]
mov ecx, esi
push str.radio
call dword [edx + 4]
test eax, eax
je 0x10034f9c
mov ecx, esi
cmp edi, ebx
jne 0x10034f90
push 1
call fcn.1005c7f6
jmp 0x100350c7
push 0
call fcn.1005c7f6
jmp 0x100350c7
mov ecx, dword [0x10282acc]
test ecx, ecx
je 0x10034faf
call fcn.1004f683
mov esi, eax
jmp 0x10034fb1
xor esi, esi
push 0x2801
call fcn.100b7336
add esp, 4
mov ebx, eax
push 0x5002
call fcn.100b7336
add esp, 4
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push edi
push str.radio
push str.FindChildByID2_Failed__no_window_of_class___s__with_id_of___d__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push eax
call fcn.10026770
add esp, 0x1c
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov eax, dword [ebp - 8]
cmp eax, 0x2800
jge 0x1003502d
push 0
push 0
push ecx
push ebx
push eax
push dword [ebp - 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0
push dword [ebp - 4]
call fcn.100b7331
add esp, 4
test esi, esi
je 0x10035073
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x10035073
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByID2
push 0x22a
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push ebx
push str.soui
push 1
push 0
call dword [edx + 0x34]
jmp 0x100350bb
push 0x2801
call fcn.100b7336
add esp, 4
mov esi, eax
push 0x22a
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push str.SOUI::SWindow::FindChildByID2
push ebx
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.100267d0
add esp, 0x20
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.100b7331
add esp, 4
push ebx
call fcn.100b7331
mov ebx, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 0xc]
inc edi
cmp edi, 4
jle 0x10034f60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10035570
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10058b23
mov esi, eax
test esi, esi
je 0x1003559b
mov edx, dword [esi]
mov ecx, esi
push str.window
call dword [edx + 4]
test eax, eax
je 0x1003559b
mov eax, esi
pop esi
pop ebp
ret 8
mov ecx, dword [0x10282acc]
test ecx, ecx
je 0x100355ae
call fcn.1004f683
mov esi, eax
jmp 0x100355b0
xor esi, esi
push ebx
push edi
push 0x2801
call fcn.100b7336
push 0x5002
mov edi, eax
call fcn.100b7336
push 0xffffffffffffffff
push dword [ebp + 8]
mov ebx, eax
push str.window
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.10026770
add esp, 0x24
mov dword [ebp + 8], eax
push 0
push 0
push 0
push 0
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov eax, dword [ebp + 8]
cmp eax, 0x2800
jge 0x10035625
push 0
push 0
push ecx
push edi
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 8]
mov byte [eax + edi], 0
push ebx
call fcn.100b7331
add esp, 4
test esi, esi
je 0x10035679
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x10035679
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 8
push 0x2801
call fcn.100b7336
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.100267d0
add esp, 0x24
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.100b7331
add esp, 4
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 8
Function at 0x100356d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xffffffffffffffff
push str.text_slider
call fcn.10058b23
mov esi, eax
test esi, esi
je 0x10035700
mov edx, dword [esi]
mov ecx, esi
push str.sliderbar
call dword [edx + 4]
test eax, eax
je 0x10035700
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x10282acc]
test ecx, ecx
je 0x10035713
call fcn.1004f683
mov esi, eax
jmp 0x10035715
xor esi, esi
push ebx
push edi
push 0x2801
call fcn.100b7336
push 0x5002
mov edi, eax
call fcn.100b7336
push 0xffffffffffffffff
push str.text_slider
push str.sliderbar
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
push 0xffffffffffffffff
mov ebx, eax
push 0x2800
push ebx
call fcn.10026770
add esp, 0x24
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov eax, dword [ebp - 4]
cmp eax, 0x2800
jge 0x1003578c
push 0
push 0
push ecx
push edi
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 4]
mov byte [eax + edi], 0
push ebx
call fcn.100b7331
add esp, 4
test esi, esi
je 0x100357e2
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x100357e2
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByName2
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x2801
call fcn.100b7336
push 0x24f
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push str.SOUI::SWindow::FindChildByName2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.100267d0
add esp, 0x24
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.100b7331
add esp, 4
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10035840
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10058ab6
mov esi, eax
test esi, esi
je 0x10035871
mov edx, dword [esi]
mov ecx, esi
push str.radio
call dword [edx + 4]
test eax, eax
je 0x10035871
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov ecx, dword [0x10282acc]
test ecx, ecx
je 0x10035884
call fcn.1004f683
mov esi, eax
jmp 0x10035886
xor esi, esi
push 0x2801
call fcn.100b7336
add esp, 4
mov edi, eax
push 0x5002
call fcn.100b7336
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
push dword [ebp + 8]
push str.radio
push str.FindChildByID2_Failed__no_window_of_class___s__with_id_of___d__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.10026770
add esp, 0x1c
mov dword [ebp + 8], eax
push 0
push 0
push 0
push 0
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov eax, dword [ebp + 8]
cmp eax, 0x2800
jge 0x100358ff
push 0
push 0
push ecx
push edi
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 8]
mov byte [eax + edi], 0
push ebx
call fcn.100b7331
add esp, 4
test esi, esi
je 0x10035954
mov eax, dword [esi]
mov ecx, esi
push 1
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x10035954
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push str.SOUI::SWindow::FindChildByID2
push 0x22a
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push edi
push str.soui
push 1
push 0
call dword [edx + 0x34]
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push 0x2801
call fcn.100b7336
add esp, 4
mov esi, eax
push 0x22a
push str.E:GitWorkingCodeScreenshot_PM_screencaptureThirdParty_soui_souiincludecore_SWnd.h
push str.SOUI::SWindow::FindChildByID2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.100267d0
add esp, 0x20
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.100b7331
add esp, 4
push edi
call fcn.100b7331
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x10040146
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x1004016a
cmp dword [esi + 8], edi
jge 0x10040162
push esi
call fcn.1003d16a
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x10040193
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x10040176
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x100401ad
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x1004019e
xor dl, dl
jmp 0x100401a3
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x10040195
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x100401e1
mov dword [0x102820b0], str.zlib_corrupt
xor eax, eax
jmp 0x10040223
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x100401f6
mov dword [0x102820b0], str.read_past_buffer
jmp 0x100401dd
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x1004020d
push edi
push esi
call fcn.10042669
pop ecx
pop ecx
test eax, eax
je 0x100401dd
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.100ae520
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x1004502b
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x101e3678
call fcn.10043cd5
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.100aeaa0
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10045088
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.10022720
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x100450ce
mov eax, dword [esi]
jmp 0x100450d0
mov eax, esi
push ebx
push eax
call fcn.100b7b65
pop ecx
pop ecx
test eax, eax
jne 0x1004511c
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x10045100
call fcn.10044f47
jmp 0x10045105
call fcn.10045001
push eax
mov ecx, esi
call fcn.100226a0
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.10022850
mov eax, esi
call fcn.10043c90
ret 0x10
Function at 0x10045d38
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.100aeaa0
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10045d71
mov eax, dword [eax]
push str.SoftConfig
push eax
lea eax, [ebp - 0x20c]
push 0x101ebd4c
push eax
call fcn.10023900
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10045da9
lea eax, [ebp - 0x20c]
push eax
call fcn.100467e4
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.100aeaa0
push str.SoftUse.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x101ebd00
push eax
call fcn.10023900
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x10045de8
mov eax, esi
jmp 0x10045df5
lea eax, [ebp - 0x414]
push eax
call fcn.100b7bc7
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.100229b0
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.100aeaa0
push str.UseCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x101ebd00
push eax
call fcn.10023900
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x10045e47
mov eax, esi
jmp 0x10045e54
lea eax, [ebp - 0x61c]
push eax
call fcn.100b7bc7
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.100229b0
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.100aeaa0
lea eax, [ebp - 0xa44]
push str.YCWEB
push eax
call fcn.10046b06
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x10045e95
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x101ebc70
push eax
call fcn.10023900
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.10022850
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10045ed6
lea eax, [ebp - 0x824]
push eax
call fcn.100467e4
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.100aeaa0
push str.UseCache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x101ebd00
push eax
call fcn.10023900
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x10045f20
lea eax, [ebp - 0xa2c]
push eax
call fcn.100b7bc7
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.100229b0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004338a
mov esp, ebp
pop ebp
ret
Function at 0x10046381
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x101e3715
call fcn.10043cd5
mov ebx, ecx
call fcn.10044f3b
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.10022610
mov esi, str.screencapture.ini
push esi
call fcn.100b7bc7
pop ecx
push eax
push esi
mov ecx, edi
call fcn.1002c2c0
push str.wngjgf
push 0x101ebde0
push str.WNGJAppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.10044fd7
and dword [ebp - 4], 0
lea esi, [ebx + 0xec]
lea eax, [ebp - 0x248]
cmp esi, eax
je 0x100463f7
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.10022ab0
push str.wngjgf
mov ecx, esi
call fcn.1002f130
test eax, eax
jne 0x10046473
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100aeaa0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x10046424
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.wngjgf
push eax
push edi
push 0x101ebde0
push str.WNGJAppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x10046455
xor eax, eax
jmp 0x10046462
lea eax, [ebp - 0x218]
push eax
call fcn.100b7bc7
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.100229b0
jmp 0x10046478
mov edi, str.wngjgf
push edi
mov ecx, esi
call fcn.1002f130
test eax, eax
jne 0x1004653b
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100aeaa0
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.10022780
push str.screencapture.ini
mov byte [ebp - 4], 1
call fcn.100b7bc7
pop ecx
push eax
push str.screencapture.ini
lea ecx, [ebp - 0x230]
call fcn.1002c2c0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x101ebde0
push str.WNGJAppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x1004650c
xor eax, eax
jmp 0x10046519
lea eax, [ebp - 0x218]
push eax
call fcn.100b7bc7
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.100229b0
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.10022850
push edi
mov ecx, esi
call fcn.1002f130
test eax, eax
jne 0x10046577
push edi
push 0x101ebde0
push str.WNGJAppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.1004502b
push eax
mov ecx, esi
call fcn.100226a0
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.10022850
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.10022850
call fcn.10043c90
ret
Function at 0x100467e4
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.100b7bc7
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10043934
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.100b7ba5
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x1004685e
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x10046855
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004684b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1004685c
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x10046828
jmp 0x1004685e
xor edi, edi
push esi
call fcn.1004393d
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004686e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 0x1a
push eax
push esi
call fcn.10046d7e
lea eax, [ebp - 0x20c]
push eax
call fcn.100b7bc7
add esp, 0x14
test eax, eax
je 0x10046926
lea eax, [ebp - 0x20c]
push 0x10255f54
push eax
call fcn.100ba6e4
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.100ba6e4
lea eax, [ebp - 0x20c]
push 0x10255f54
push eax
call fcn.100ba6e4
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100468ff
lea eax, [ebp - 0x20c]
push eax
call fcn.100467e4
pop ecx
cmp word [ebp - 0x20c], si
je 0x10046917
lea eax, [ebp - 0x20c]
push eax
call fcn.100b7bc7
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.100229b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004338a
mov esp, ebp
pop ebp
ret

Function at 0x10046a5f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10271304]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x1028265c]
test al, al
jne 0x10046af8
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100aeaa0
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10046aef
lea eax, [ebp - 0x20c]
push eax
call fcn.100b74ea
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.100b0e9b
pop ecx
pop ecx
test eax, eax
jne 0x10046ae7
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.100b0e9b
pop ecx
pop ecx
test eax, eax
je 0x10046aef
mov byte [0x1028265c], bl
jmp 0x10046af5
mov bl, byte [0x1028265c]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004338a
mov esp, ebp
pop ebp
ret
Function at 0x10046b06
Capabilities:
Check if file exists

Disassembly:
push 0xc54
mov eax, 0x101e3748
call fcn.10043cd5
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc40]
mov ebx, dword [ebp + 0xc]
mov esi, 0x208
and dword [ebp - 0xc60], 0
push esi
push 0
push eax
call fcn.100aeaa0
push esi
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.100aeaa0
push esi
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.100aeaa0
push esi
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.100aeaa0
push esi
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100aeaa0
push esi
xor esi, esi
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.100aeaa0
xor eax, eax
mov dword [ebp - 0xc44], 7
add esp, 0x48
mov dword [ebp - 0xc48], esi
mov word [ebp - 0xc58], ax
push esi
push 0x1a
lea eax, [ebp - 0xc40]
mov dword [ebp - 4], esi
push eax
push esi
call fcn.10046d7e
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100b7ba5
lea eax, [ebp - 0x218]
push eax
call fcn.100b7bc7
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.100ae383
add esp, 0x24
test eax, eax
jne 0x10046c0a
lea eax, [ebp - 0xc58]
push ebx
push eax
call fcn.1004686e
pop ecx
pop ecx
lea eax, [ebp - 0xc58]
mov ecx, edi
push eax
call fcn.10027be0
push esi
push 1
jmp 0x10046d6b
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.100b7ba5
lea eax, [ebp - 0x830]
push str.Local
push eax
call fcn.100ba6e4
add esp, 0x10
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
inc ecx
test eax, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
cmovne esi, ecx
push eax
call fcn.100b7ba5
lea eax, [ebp - 0x628]
push str.LocalLow
push eax
call fcn.100ba6e4
add esp, 0x10
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xc5c], ecx
push eax
call fcn.100b7ba5
lea eax, [ebp - 0xa38]
push str.Roaming
push eax
call fcn.100ba6e4
add esp, 0x10
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x10046d48
cmp dword [ebp - 0xc5c], 0
je 0x10046d48
test ecx, ecx
je 0x10046d48
push ebx
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push str._s_s_
push eax
call fcn.10023900
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10046d18
lea eax, [ebp - 0x420]
push eax
call fcn.100467e4
pop ecx
cmp word [ebp - 0x420], 0
jne 0x10046d26
xor eax, eax
jmp 0x10046d33
lea eax, [ebp - 0x420]
push eax
call fcn.100b7bc7
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xc58]
call fcn.100229b0
jmp 0x10046d57
lea eax, [ebp - 0xc58]
push ebx
push eax
call fcn.1004686e
pop ecx
pop ecx
lea eax, [ebp - 0xc58]
mov ecx, edi
push eax
call fcn.10027be0
xor eax, eax
push 0
inc eax
push eax
lea ecx, [ebp - 0xc58]
call fcn.10022850
mov eax, edi
call fcn.10043c90
ret