joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4336aa
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x457620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042d62c
mov dword [ebp - 0x14], eax
cmp dword [0x469594], esi
jne 0x43379d
push 0x800
push esi
push 0x44d258
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x43372a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43387d
push esi
push esi
push 0x44d258
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43387d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43387d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x469594], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x469598], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x46959c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4695a4], eax
test eax, eax
je 0x43379a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4695a0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4337c2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4337b5
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4337d7
push 4
pop eax
jmp 0x43387f
cmp dword [ebp - 0x14], esi
je 0x4337d7
push dword [0x469594]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4337bc
mov eax, dword [0x4695a0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x433835
cmp dword [0x4695a4], edi
je 0x433835
push eax
call ebx
push dword [0x4695a4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x433835
test eax, eax
je 0x433835
call ecx
test eax, eax
je 0x43382a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43382a
test byte [ebp - 8], 1
jne 0x433835
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x433865
mov eax, dword [0x469598]
cmp eax, edi
je 0x433862
push eax
call ebx
test eax, eax
je 0x433862
call eax
mov esi, eax
test esi, esi
je 0x433862
mov eax, dword [0x46959c]
cmp eax, edi
je 0x433862
push eax
call ebx
test eax, eax
je 0x433862
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x469594]
call ebx
test eax, eax
je 0x43387d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43387f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043346f
mov esp, ebp
pop ebp
ret
Function at 0x53af85
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xdcfdaa5e], al
daa
add dword [ebp + 0x4f], ebp
invalid
enter 0x4ab8, 0x66
int1
add al, 0x47
inc edi
xchg ecx, eax
mov eax, dword [0xd16da534]
jge 0x53aefb
xor al, 0xa5
insd dword es:[edi], dx
sar dword [ebp - 0xf], 1
mov esi, 0x7c4e20e5
add eax, 0x96a13fd4
aas
lcall 0x935a, 0x189a0fb0
mov byte [0xc825d419], al
inc ecx
pop ds
adc ch, 0xc6
mov al, 0xa3
arpl ax, si
jnp 0x53aec7
inc eax
div ebp
jns 0x53af04
sar bh, 1
jnp 0x53af21
das
and byte [esi - 0x39], 0x22
cmc
jb 0x53af01
mov eax, dword [0xae555114]
dec esi
invalid
loop 0x53af2f
dec ecx
aad 0xe3
clc
das
hlt
adc al, 0xa3
or ebx, esp
cmc
jge 0x53afb5
je 0x53af69
imul esp, dword [ebx + ebp*4 + 0x3a], 0xfbbe2f2c
ror byte [edi], 0xd5
je 0x53b00f
invalid
out dx, al
mov ah, 0x3a
aam 0x4d
movsd dword es:[edi], dword [esi]
inc dword [0x9f586e19]
fsub qword [ecx]
invalid
clc
mov ah, 0x9f
test byte [ebx + edx*8], ah
test bh, 0x45
jb 0x53b078
lds ecx, [edi - 0x6f]
popal
push esi
lgs edi, [ebp + 0x7035a001]
mov edx, 0x34ed567c
out dx, eax
xor eax, 0x412b959e
ret
mov ss, word [edx - 0x602b8b14]
and al, 0x2b
dec edi
inc eax
or byte [esi], bh
mov edx, dword [ebx - 0x5f]
lahf
xchg esp, eax
dec edx
inc esp
invalid

Function at 0x6029c3
Capabilities:
Encode data using xor

Disassembly:
leave
inc edx
popaw
add ebx, esp
pop esp
jb 0x6029f6
sbb esp, dword [eax + 0x30]
jbe 0x602a39
add ebp, edx
xchg ecx, eax
iretd
fptan
mov esi, ss
sar byte [ecx + 0x32c1617b], 0x13
push esi
popal
or dword [ebx + 0x31348d8], esp
jne 0x602a7c
stosd dword es:[edi], eax
jb 0x602a84
xchg edi, eax
bound edi, qword [esi]
add dword [ecx + ebp*2 - 0x6e353a6f], esp
mov esp, 0xca50fc6
jne int.006029c3
mov dl, byte [edi - 0x1ece8630]
or byte [ecx + ecx*2 + 0x2f299181], 0x46
add bh, byte [edx]
in al, 0x91
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
daa
mov dl, 0xe1
mov al, byte [esi + 0x31]
scasd eax, dword es:[edi]
adc ch, byte [edi + 0x51]
xor dword [edi - 0x6eae90ee], ebp
push ecx
xchg ecx, eax
rcl dword [ecx - 0x5f]
push ecx
push es
jle 0x602a3d
sbb al, 0xf2
test eax, 0x1a674f3b
pop eax
add ah, 0x86
xchg esp, eax
and dword [ecx + 1], 0x414bc28c
enter 0xfffffffffffffe3b, 0x70
jae 0x602aaf
and eax, 0xe969af63
push ecx
dec esp
stosb byte es:[edi], al
and cl, byte [ebx]
sti
les ebx, [ebx + 1]
adc ch, byte [esi + 0x66]
wait
adc byte [ecx + ebx*4], dl
fbstp tbyte [ecx - 0x2e42c5b7]
jbe 0x602ad6
sbb ch, byte [edi - 0x7eb75397]
int 0xe7
inc ecx
add al, 0x43
sahf
stc
cmp ebp, dword [ebx]
add eax, dword [edx - 0x5e]
push es
sub dword [bx + si + 0x5e], 0xffffffb8
sal dword [edx - 0xc], 0xc4
retf 0x9932
movsd dword es:[edi], dword [esi]
rcl cl, 1
inc ecx
invalid
push es
xchg ecx, eax
fistp dword [edi - 0x35]
xchg ecx, eax
out dx, al
adc dword [eax + 0x42], ebp
jmp 0x6ec796c4
Function at 0x65041e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6582f0
cmp edx, dword [eax]
je 0x650440
add eax, 8
inc ecx
cmp eax, 0x658380
jl 0x650431
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6582f0]
jne 0x65056e
mov eax, dword [0xa5b934]
cmp eax, 1
je 0x650548
test eax, eax
jne 0x650471
cmp dword [0x658234], 1
je 0x650548
cmp edx, 0xfc
je 0x65056e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6504a8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00650b30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00650d60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6504eb
lea eax, [ebp - 0x1a4]
push eax
call fcn.00650d60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x654b68
push edi
call fcn.00652530
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00650b30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00650b40
lea eax, [ebp - 0xa0]
push 0x654b48
push eax
call fcn.00650b40
push dword [esi + 0x6582f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00650b40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.006524a4
add esp, 0x2c
pop edi
jmp 0x65056e
lea eax, [ebp + 8]
lea esi, [esi + 0x6582f4]
push 0
push eax
push dword [esi]
call fcn.00650d60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x7551b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00755140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00755140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00755140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00755140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x755bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x755c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x76787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x755c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x755c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..data
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x67fc679b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x982546f
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40a966
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00432abe
mov ecx, eax
call fcn.00456f97
mov ecx, dword [esi + 0x11c28]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x108], eax
sub edx, dword [esi + ecx*8 + 0x1088c]
push edx
call fcn.004b8857
mov edi, eax
lea eax, [ebp - 0x104]
push edi
push 0x4f592c
push eax
call fcn.00405c58
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
imul eax, dword [ebp - 0x108], 9
push 0x64
pop esi
cdq
idiv esi
cmp edi, eax
cmovle edi, eax
imul eax, dword [ebp - 0x108], 0xa2
cdq
idiv esi
mov esi, eax
lea eax, [ebp - 0x104]
cmp edi, esi
cmovl esi, edi
push esi
push str.abs_len___d___n
push eax
call fcn.00405c58
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movd xmm2, dword [ebp - 0x108]
cvtdq2ps xmm2, xmm2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
movd xmm0, esi
mulss xmm2, dword [0x4f5a38]
pop esi
cvtdq2ps xmm0, xmm0
divss xmm2, dword [0x4f5a3c]
movss xmm1, dword [0x4f5a2c]
divss xmm2, xmm0
movss xmm0, dword [0x4f5a08]
minss xmm1, xmm2
maxss xmm0, xmm1
movss dword [ebp - 0x108], xmm0
fld dword [ebp - 0x108]
call fcn.00495b3a
mov esp, ebp
pop ebp
ret 4
Function at 0x40b24f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x535080]
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov ecx, dword [0x53507c]
push esi
push edi
cmp eax, edx
jl 0x40b2ea
cmp eax, ecx
jg 0x40b2ea
push eax
mov dword [ebx + 0x740], eax
mov ecx, ebx
lea eax, [ebp - 0x94]
push eax
call fcn.00409665
mov esi, eax
lea edi, [ebx + 0x11cb4]
push 0x80
lea eax, [ebp - 0x84]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00497890
push dword [ebx + 0x740]
lea eax, [ebp - 0x84]
push str.setCurEqHpLp_mHpFreq__d__n
push eax
call fcn.00405c58
add esp, 0x18
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [0x535080]
mov ecx, dword [0x53507c]
mov eax, dword [ebp + 8]
jmp 0x40b30b
or dword [ebx + 0x740], 0xffffffff
lea edi, [ebx + 0x11cb4]
xorps xmm0, xmm0
lea esi, [ebp - 0x94]
movups xmmword [ebp - 0x94], xmm0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp eax, edx
jl 0x40b373
cmp eax, ecx
jg 0x40b373
mov eax, dword [ebp + 0xc]
mov ecx, ebx
push eax
mov dword [ebx + 0x744], eax
lea eax, [ebp - 0x94]
push eax
call fcn.00409717
mov esi, eax
lea edi, [ebx + 0x11cc4]
push 0x80
lea eax, [ebp - 0x84]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00497890
push dword [ebx + 0x744]
lea eax, [ebp - 0x84]
push str.setCurEqHpLp_mHpFreq__d__n
push eax
call fcn.00405c58
add esp, 0x18
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40b394
or dword [ebx + 0x744], 0xffffffff
lea edi, [ebx + 0x11cc4]
xorps xmm0, xmm0
lea esi, [ebp - 0x94]
movups xmmword [ebp - 0x94], xmm0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495b3a
mov esp, ebp
pop ebp
ret 8
Function at 0x40e14e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xdcc10]
cmp eax, 0x10
je 0x40e2ec
cmp eax, 0x20
je 0x40e2ec
push ebx
lea ebx, [esi + 0xdc184]
mov ecx, ebx
call fcn.0048d3a1
test al, al
jne 0x40e2e4
mov ecx, ebx
call fcn.0048e639
mov ecx, ebx
call fcn.0048d3a1
test al, al
jne 0x40e210
push str.Can_not_conect_usb_devices__please_connect_devices_again__n
call fcn.0042e448
xor edi, edi
cmp byte [ebp + 8], 0
pop ecx
je 0x40e1dc
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], str._confirm
push eax
push str._device_connect_fail
push str._tips
push dword [esi]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.004053a9
add esp, 0x14
mov ecx, dword [esi + 0xdb518]
push str._btn_disconnected
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0xdb518]
push edi
mov eax, dword [ecx]
call dword [eax + 0x1b4]
mov ecx, dword [esi + 0xdb518]
push 0xffff0000
call fcn.00456e16
jmp 0x40e2eb
mov ecx, dword [0x53bc9c]
test ecx, ecx
je 0x40e221
push 1
call fcn.00439a21
mov ecx, dword [0x539050]
test ecx, ecx
je 0x40e232
push 1
call fcn.00439a21
push str.Connect_OK
call fcn.0042e448
mov ecx, dword [esi + 0xdb518]
mov dword [esp], str._btn_connecting
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0xdb518]
xor edi, edi
push edi
mov eax, dword [ecx]
call dword [eax + 0x1b4]
mov ecx, dword [esi + 0xdb518]
push 0xffff0000
call fcn.00456e16
cmp byte [esi + 0xdb97e], 1
jne 0x40e2bd
cmp dword [0x53896c], edi
je 0x40e2bd
mov ecx, dword [esi + 0xdb518]
push str._btn_connected
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0xdb518]
push 0xff00ff00
call fcn.00456e16
mov ecx, dword [esi + 0xdb518]
push 1
mov eax, dword [ecx]
call dword [eax + 0x1b4]
mov ecx, dword [0x53896c]
call fcn.004205d2
jmp 0x40e2eb
mov ecx, ebx
call fcn.0048afaa
push edi
push edi
push 0x4fa
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
push edi
push 0x412018
call fcn.004b7a2e
add esp, 0xc
jmp 0x40e2eb
mov ecx, esi
call fcn.0040e944
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00495b3a
mov esp, ebp
pop ebp
ret 4

Function at 0x40e8bf
Capabilities:
Create thread

Disassembly:
push esi
push str.DevicePlugOut_n
mov esi, ecx
call fcn.0042e448
mov eax, dword [esi + 0xdcc10]
pop ecx
cmp eax, 0x10
je 0x40e8ff
cmp eax, 0x20
je 0x40e8ff
mov ecx, esi
call fcn.0040e944
cmp byte [esi + 0xdb97e], 1
je 0x40e90a
push esi
push 0
push 0x40e9ca
call fcn.004b7a2e
add esp, 0xc
jmp 0x40e90a
push str.sys_upg_status_UPG_ENTER_or_UPG_START_n
call fcn.0042e448
pop ecx
pop esi
ret 4
Function at 0x41043b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push str.LoadSence_n
mov esi, ecx
call fcn.0042e448
pop ecx
push 0
push 0
push 0x4fa
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 8]
push esi
mov dword [esi + 8], eax
mov eax, dword [esi]
push 0
push 0x410480
mov dword [esi + 0xdc188], eax
call fcn.004b7a2e
add esp, 0xc
pop esi
pop ebp
ret 4

Function at 0x4105fa
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.EqualizerManager::LoadSenceConfigFromFile
push 0x4f24b4
mov esi, ecx
call fcn.0042e448
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
push 0
push eax
call fcn.00497890
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00497890
add esp, 0x20
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x58
lea eax, [ebp - 0x474]
push 0
push eax
call fcn.00497890
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x470], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x474]
mov dword [ebp - 0x454], ebx
xor ebx, ebx
push eax
mov dword [ebp - 0x474], 0x58
mov dword [ebp - 0x468], str.:WofM
mov dword [ebp - 0x45c], 1
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x440], 0x81800
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x410733
lea eax, [ebp - 0x20c]
push eax
push str.GetOpenFileName__s_ok_n
call fcn.0042e448
pop ecx
pop ecx
push dword [esi]
lea ecx, [ebp - 0x41c]
call fcn.0041fe2b
lea eax, [esi + 0x228]
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x41c]
call fcn.0041d8eb
test al, al
je 0x410733
push ebx
push ebx
push 0x4fa
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
push ebx
push 0x41555e
call fcn.004b7a2e
add esp, 0xc
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00495b3a
mov esp, ebp
pop ebp
ret
Function at 0x410743
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.EqualizerManager::LoadWholeConfigFromFile
push 0x4f24b4
mov esi, ecx
call fcn.0042e448
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x58
lea eax, [ebp - 0x26c]
push 0
push eax
call fcn.00497890
mov ebx, 0x208
lea edi, [esi + 0xc]
push ebx
push 0
push edi
call fcn.00497890
mov eax, dword [esi]
add esp, 0x18
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x24c], ebx
xor ebx, ebx
push eax
mov dword [ebp - 0x26c], 0x58
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x260], str.te:gM
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x238], 0x81800
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x410852
push edi
push str.GetOpenFileName__s_ok_n
call fcn.0042e448
pop ecx
pop ecx
push dword [esi]
lea ecx, [ebp - 0x214]
call fcn.0041fe2b
push esi
push edi
lea ecx, [ebp - 0x214]
call fcn.0041e170
test al, al
je 0x410852
push ebx
push ebx
push 0x4fa
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
push ebx
push 0x41a2af
call fcn.004b7a2e
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495b3a
mov esp, ebp
pop ebp
ret

Function at 0x412360
Capabilities:
Create thread

Disassembly:
push esi
push str.EqualizerManager::ResetMcuFactoryDefault
push 0x4f24b4
mov esi, ecx
call fcn.0042e448
push str._factory_default_tips
push str._tips
push dword [esi]
call fcn.00405323
add esp, 0x14
cmp eax, 1
jne 0x4123ac
push 0
push 0
push 0x4fa
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
push 0
push 0x40f518
call fcn.004b7a2e
add esp, 0xc
pop esi
ret
Function at 0x41245f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.EqualizerManager::SaveSenceConfigToFile
push 0x4f24b4
mov esi, ecx
call fcn.0042e448
push 0x58
lea eax, [ebp - 0x474]
push 0
push eax
call fcn.00497890
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00497890
add esp, 0x20
lea eax, [ebp - 0x414]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x454], edi
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x448], eax
mov eax, dword [esi]
mov dword [ebp - 0x470], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], 0x4f8580
mov dword [ebp - 0x438], 0x4f85c8
mov dword [ebp - 0x440], 0x81800
mov dword [ebp - 0x474], 0x58
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x412556
lea eax, [ebp - 0x20c]
push eax
push str.GetOpenFileName__s_ok_n
call fcn.0042e448
pop ecx
pop ecx
push dword [esi]
lea ecx, [ebp - 0x41c]
call fcn.0041fe2b
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x228]
push eax
lea ecx, [ebp - 0x41c]
call fcn.0041f391
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00495b3a
mov esp, ebp
pop ebp
ret

Function at 0x412566
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.EqualizerManager::SaveWholeConfigToFile
push 0x4f24b4
mov esi, ecx
call fcn.0042e448
push 0x58
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.00497890
mov ebx, 0x208
lea edi, [esi + 0xc]
push ebx
push 0
push edi
call fcn.00497890
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x238], eax
mov eax, dword [esi]
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x264]
push eax
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x258], 0x4f86f0
mov dword [ebp - 0x228], 0x4f8738
mov dword [ebp - 0x230], 0x81800
mov dword [ebp - 0x264], 0x58
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x412649
push edi
push str.GetOpenFileName__s_ok_n
call fcn.0042e448
pop ecx
pop ecx
xor ebx, ebx
push ebx
push ebx
push 0x4fa
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
push ebx
push 0x41265a
call fcn.004b7a2e
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495b3a
mov esp, ebp
pop ebp
ret