joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a2e4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
mov edi, ecx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], esi
call fcn.0044f427
test eax, eax
pop ecx
mov ebx, 0x53e998
jne 0x40a326
mov dword [edi], 1
jmp 0x40a336
push ebx
push esi
call fcn.0044fb8e
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [edi], eax
xor esi, esi
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov word [ebp - 0x20c], si
call fcn.0044fd00
add esp, 0xc
cmp dword [ebp + 0x10], esi
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x20c]
je 0x40a36a
push str._sTempSkinSkin.xml
jmp 0x40a36f
push str._sSkinSkin.xml
push eax
call fcn.0045025e
add esp, 0xc
cmp dword [edi], esi
jne 0x40a393
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a393
mov dword [edi], 1
xor eax, eax
cmp dword [edi + 8], eax
mov esi, 0xa0
jne 0x40a439
cmp dword [ebp + 0x10], eax
jne 0x40a440
cmp dword [edi], eax
je 0x40a3eb
call fcn.00404914
mov edx, dword [eax]
push 0
push 0x58
mov ecx, eax
call dword [edx + 0x2c]
call fcn.00404914
mov edx, dword [eax]
push ebx
push esi
mov ecx, eax
call dword [edx + 8]
call fcn.00404914
mov edx, dword [eax]
push 0x58
mov ecx, eax
call dword [edx + 0x14]
call fcn.00404914
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0x14]
jmp 0x40a45f
call fcn.00404914
mov edx, dword [eax]
push 1
push 0x58
mov ecx, eax
call dword [edx + 0xc]
call fcn.00404914
mov edx, dword [eax]
push 1
push 0x58
mov ecx, eax
call dword [edx + 0x2c]
call fcn.00404914
push dword [ebp - 0x210]
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 8]
call fcn.00404914
mov edx, dword [eax]
push 0x58
mov ecx, eax
call dword [edx + 0x14]
call fcn.00404914
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0x14]
xor eax, eax
cmp dword [ebp + 0x10], eax
je 0x40a45f
cmp dword [edi], eax
je 0x40a44c
call fcn.00404914
push ebx
jmp 0x40a457
call fcn.00404914
push dword [ebp - 0x210]
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 0x28]
and dword [edi + 8], 0
mov ecx, edi
call fcn.00409f6e
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp - 0x214]
call fcn.0040912c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa75
leave
ret 0xc
Function at 0x40ac02
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0xde8]
sub esp, 0xe68
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp + 0xde4], eax
mov eax, dword [ebp + 0xdf0]
push ebx
mov dword [ebp - 0x1c], eax
push esi
push edi
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x2c], bx
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, 0x206
push esi
lea eax, [ebp + 0x9c2]
push ebx
push eax
mov word [ebp + 0x9c0], bx
call fcn.0044fd00
push str.UseVestige.ini
push str.Config
push 0x5a7c70
lea eax, [ebp + 0x9c0]
push 0x53efc4
push eax
call fcn.0045025e
add esp, 0x20
lea eax, [ebp + 0x9c0]
push eax
push 0xffffffffffffffff
push str.UpDmpLastDay
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, word [ebp - 0x26]
cmp eax, ecx
je 0x40ae1a
push esi
lea eax, [ebp + 0xbca]
push ebx
push eax
mov word [ebp + 0xbc8], bx
call fcn.0044fd00
push esi
lea eax, [ebp + 0x7ba]
push ebx
push eax
mov word [ebp + 0x7b8], bx
call fcn.0044fd00
lea eax, [ebp + 0x7b8]
push 0x5a7a68
push eax
call fcn.00450242
lea eax, [ebp + 0x7b8]
push 0x53ef78
push eax
call fcn.00450218
lea eax, [ebp + 0xbc8]
push 0x53ef74
push eax
call fcn.00450242
lea eax, [ebp + 0x7b8]
push eax
lea eax, [ebp + 0xbc8]
push eax
call fcn.00450218
lea eax, [ebp + 0xbc8]
push 0x53ef58
push eax
call fcn.00450218
add esp, 0x40
push dword [ebp - 0x1c]
lea eax, [ebp + 0xbc8]
push eax
call fcn.00450218
mov esi, 0x5a7e78
push esi
call fcn.0044f427
add esp, 0xc
test eax, eax
jbe 0x40ad6b
lea eax, [ebp + 0xbc8]
push 0x53ef54
push eax
call fcn.00450218
lea eax, [ebp + 0xbc8]
push esi
push eax
call fcn.00450218
add esp, 0x10
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0044fd00
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x80], esi
call fcn.0044fd00
lea eax, [ebp + 0xbc8]
push eax
lea eax, [ebp - 0x18]
push 0x53dedc
push eax
call fcn.0045025e
add esp, 0x24
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40adce
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
xor eax, eax
mov word [ebp + 0xdd0], bx
lea edi, [ebp + 0xdd2]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0x26]
push eax
lea eax, [ebp + 0xdd0]
push 0x53ef4c
push eax
call fcn.0045025e
add esp, 0xc
lea eax, [ebp + 0x9c0]
push eax
lea eax, [ebp + 0xdd0]
push eax
push str.UpDmpLastDay
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp + 0xde4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa75
add ebp, 0xde8
leave
ret
Function at 0x40b299
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004144f2
mov dword [esi], eax
call fcn.0041462b
mov dword [esi + 8], eax
call fcn.00414468
mov dword [esi + 0xc], eax
call fcn.004145e1
mov dword [esi + 0x10], eax
call fcn.0041454d
mov dword [esi + 0x18], eax
call fcn.00414597
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
mov dword [esi + 4], eax
lea eax, [esi + 0x1c0]
push eax
call edi
lea eax, [esi + 0x1d8]
push eax
call edi
lea eax, [esi + 0x1c8]
push eax
call edi
lea eax, [esi + 0x208]
push eax
call edi
lea eax, [esi + 0x1e8]
push eax
call edi
lea eax, [esi + 0x1f8]
push eax
call edi
mov eax, dword [0x5a81e8]
pop edi
mov dword [esi + 0x1ac], eax
pop esi
ret

Function at 0x40b31b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0x11c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0044fd00
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jne 0x40b376
xor eax, eax
inc eax
cmp dword [ebp - 0x78], 0
je 0x40b36e
cmp dword [ebp - 0x78], eax
jne 0x40b376
cmp byte [ebp + 0x9a], al
je 0x40b378
xor eax, eax
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.0044fa75
add ebp, 0xa0
leave
ret

Function at 0x40b483
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov esi, ecx
call fcn.0044fd00
add esp, 0xc
cmp dword [esi + 0x58], 8
jb 0x40b4c2
mov esi, dword [esi + 0x44]
jmp 0x40b4c5
add esi, 0x44
push str.AllSkin
push esi
lea eax, [ebp - 0x20c]
push 0x53de44
push eax
call fcn.0045025e
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop esi
jne 0x40b4fe
lea eax, [ebp - 0x20c]
push eax
call fcn.0040cf55
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044fa75
leave
ret
Function at 0x40b50a
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp + 0x188], eax
and word [ebp - 0x80], 0
push ebx
push esi
push edi
push 0x206
lea eax, [ebp - 0x7e]
push 0
push eax
mov esi, ecx
call fcn.0044fd00
add esp, 0xc
cmp dword [esi + 0x3c], 8
jb 0x40b54d
mov eax, dword [esi + 0x28]
jmp 0x40b550
lea eax, [esi + 0x28]
push 0x53f210
push eax
mov ebx, 0x53de44
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0045025e
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call edi
test eax, eax
jne 0x40b583
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x3c], 8
jb 0x40b58e
mov esi, dword [esi + 0x28]
jmp 0x40b591
add esi, 0x28
push str.Dict
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0045025e
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call edi
test eax, eax
pop edi
pop esi
pop ebx
jne 0x40b5bc
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
call fcn.0044fa75
add ebp, 0x18c
leave
ret

Function at 0x40b63a
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5a0]
sub esp, 0x620
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp + 0x59c], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [ebp + 0x396]
push ebx
push eax
mov esi, ecx
mov word [ebp + 0x394], bx
call fcn.0044fd00
lea eax, [ebp + 0x394]
push str.SOFTWARE_
push eax
call fcn.00450242
lea eax, [ebp + 0x394]
push str.SmartCloudWBInput
push eax
call fcn.00450218
add esp, 0x1c
cmp dword [esi + 0x58], 8
jb 0x40b6a4
mov eax, dword [esi + 0x44]
jmp 0x40b6a7
lea eax, [esi + 0x44]
push eax
lea eax, [ebp + 0x18c]
push eax
call fcn.00450242
cmp dword [esi + 0x3c], 8
pop ecx
pop ecx
jb 0x40b6c1
mov esi, dword [esi + 0x28]
jmp 0x40b6c4
add esi, 0x28
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00450242
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
push 2
push ebx
lea eax, [ebp + 0x394]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b721
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov edi, 0x104
push edi
lea eax, [ebp + 0x18c]
push eax
push 1
push ebx
push str.CfgRootPath
push dword [ebp - 0x80]
call esi
push edi
lea eax, [ebp - 0x7c]
push eax
push 1
push ebx
push str.CfgUserPath
push dword [ebp - 0x80]
call esi
pop edi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x59c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa75
add ebp, 0x5a0
leave
ret
Function at 0x40bfa2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
jb 0x40bfc3
mov eax, dword [esi + 0x44]
jmp 0x40bfc6
lea eax, [esi + 0x44]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x53de44
push eax
call fcn.0045025e
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40bffe
lea eax, [ebp - 0x20c]
push eax
call fcn.0040cf55
pop ecx
lea eax, [ebp - 0x20c]
push str.Config.ini
push eax
call fcn.00450218
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x5c]
call fcn.00401a28
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044fa75
leave
ret

Function at 0x40c02d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
jb 0x40c04e
mov eax, dword [esi + 0x44]
jmp 0x40c051
lea eax, [esi + 0x44]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x53de44
push eax
call fcn.0045025e
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c089
lea eax, [ebp - 0x20c]
push eax
call fcn.0040cf55
pop ecx
lea eax, [ebp - 0x20c]
push str.Related.ini
push eax
call fcn.00450218
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xe8]
call fcn.00401a28
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044fa75
leave
ret

Function at 0x40c17f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
jb 0x40c1a0
mov eax, dword [esi + 0x44]
jmp 0x40c1a3
lea eax, [esi + 0x44]
push str.UseData
push eax
lea eax, [ebp - 0x20c]
push 0x53de44
push eax
call fcn.0045025e
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c1db
lea eax, [ebp - 0x20c]
push eax
call fcn.0040cf55
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x174]
call fcn.00401a28
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044fa75
leave
ret
Function at 0x40c6da
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x3b8]
sub esp, 0x438
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp + 0x3b4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp + 0x1ae]
push esi
push eax
mov edi, ecx
mov word [ebp + 0x1ac], si
call fcn.0044fd00
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov ebx, eax
lea eax, [ebp - 0x7c]
push esi
push eax
mov dword [ebp - 0x80], esi
call fcn.0044fd00
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40c79e
lea eax, [ebp - 0x80]
push eax
push esi
mov dword [ebp - 0x80], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40c766
cmp dword [ebp - 0x78], ebx
je 0x40c76c
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40c757
jmp 0x40c77e
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.00450242
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x1ac]
push eax
call fcn.00450655
pop ecx
push eax
lea ecx, [edi + 0x190]
call fcn.00401a28
mov ecx, dword [ebp + 0x3b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa75
add ebp, 0x3b8
leave
ret

Function at 0x40c7b6
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x7e]
push esi
push eax
mov edi, ecx
mov word [ebp - 0x80], si
call fcn.0044fd00
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.0040b453
test al, al
jne 0x40c81d
push esi
push 0x1a
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x80]
push eax
call fcn.0044f427
test eax, eax
pop ecx
je 0x40c86b
mov esi, 0x53e180
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00450218
lea eax, [ebp - 0x80]
push str.SmartCloudWBIME
push eax
call fcn.00450218
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00450218
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c85f
lea eax, [ebp - 0x80]
push eax
call fcn.0040cf55
pop ecx
lea eax, [ebp - 0x80]
push eax
lea ecx, [edi + 0x40]
call fcn.00401a28
mov ecx, dword [ebp + 0x188]
pop edi
xor ecx, ebp
pop esi
call fcn.0044fa75
add ebp, 0x18c
leave
ret
Function at 0x40c882
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x7e]
push esi
push eax
mov edi, ecx
mov word [ebp - 0x80], si
call fcn.0044fd00
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.0040b453
test al, al
jne 0x40c8e9
push esi
push 0x1a
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x80]
push eax
call fcn.0044f427
test eax, eax
pop ecx
je 0x40c937
mov esi, 0x53e180
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00450218
lea eax, [ebp - 0x80]
push str.SmartCloudWBIME.users
push eax
call fcn.00450218
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00450218
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c92b
lea eax, [ebp - 0x80]
push eax
call fcn.0040cf55
pop ecx
lea eax, [ebp - 0x80]
push eax
lea ecx, [edi + 0x24]
call fcn.00401a28
mov ecx, dword [ebp + 0x188]
pop edi
xor ecx, ebp
pop esi
call fcn.0044fa75
add ebp, 0x18c
leave
ret
Function at 0x40c94e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xbc0]
sub esp, 0xc40
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp + 0xbbc], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov dword [ebp - 0x78], ecx
xor ebx, ebx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov word [ebp - 0x74], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x39e]
push edi
push eax
mov word [ebp + 0x39c], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x7ae]
push edi
push eax
mov word [ebp + 0x7ac], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov word [ebp + 0x194], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x9b6]
push edi
push eax
mov word [ebp + 0x9b4], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x5a6]
push edi
push eax
mov word [ebp + 0x5a4], di
call fcn.0044fd00
add esp, 0x48
push edi
push 0x1a
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x9b4]
push eax
call fcn.00450242
lea eax, [ebp + 0x9b4]
push eax
call fcn.0044f427
lea eax, [ebp + 0x9b4]
push 0x5c
push eax
call fcn.00452736
add esp, 0x14
cmp eax, edi
je 0x40cb57
mov word [eax], di
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.00450242
lea eax, [ebp + 0x39c]
push str.Local
push eax
call fcn.00450218
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp + 0x39c]
push eax
call esi
test eax, eax
je 0x40ca7a
inc ebx
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x7ac]
push eax
call fcn.00450242
lea eax, [ebp + 0x7ac]
push str.LocalLow
push eax
call fcn.00450218
add esp, 0x10
lea eax, [ebp + 0x7ac]
push eax
call esi
test eax, eax
je 0x40cab5
mov dword [ebp - 0x80], 1
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.00450242
lea eax, [ebp + 0x194]
push str.Roaming
push eax
call fcn.00450218
add esp, 0x10
lea eax, [ebp + 0x194]
push eax
call esi
test eax, eax
je 0x40caf0
mov dword [ebp - 0x7c], 1
cmp ebx, edi
je 0x40cb57
cmp dword [ebp - 0x80], edi
je 0x40cb57
cmp dword [ebp - 0x7c], edi
je 0x40cb57
mov edi, dword [ebp - 0x78]
mov ecx, edi
call fcn.0040b31b
test eax, eax
je 0x40cb57
push str.SmartCloudWBIME
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp + 0x5a4]
push str._s_s_
push eax
call fcn.0045025e
add esp, 0x10
lea eax, [ebp + 0x5a4]
push eax
call esi
test eax, eax
jne 0x40cb46
lea eax, [ebp + 0x5a4]
push eax
call fcn.0040cf55
pop ecx
lea eax, [ebp + 0x5a4]
push eax
lea ecx, [edi + 0x40]
call fcn.00401a28
jmp 0x40cb5f
mov ecx, dword [ebp - 0x78]
call fcn.0040c7b6
mov ecx, dword [ebp + 0xbbc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa75
add ebp, 0xbc0
leave
ret
Function at 0x40cb77
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xbc0]
sub esp, 0xc40
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp + 0xbbc], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov dword [ebp - 0x78], ecx
xor ebx, ebx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov word [ebp - 0x74], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x39e]
push edi
push eax
mov word [ebp + 0x39c], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x7ae]
push edi
push eax
mov word [ebp + 0x7ac], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov word [ebp + 0x194], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x9b6]
push edi
push eax
mov word [ebp + 0x9b4], di
call fcn.0044fd00
push esi
lea eax, [ebp + 0x5a6]
push edi
push eax
mov word [ebp + 0x5a4], di
call fcn.0044fd00
add esp, 0x48
push edi
push 0x1a
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x9b4]
push eax
call fcn.00450242
lea eax, [ebp + 0x9b4]
push eax
call fcn.0044f427
lea eax, [ebp + 0x9b4]
push 0x5c
push eax
call fcn.00452736
add esp, 0x14
cmp eax, edi
je 0x40cd80
mov word [eax], di
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.00450242
lea eax, [ebp + 0x39c]
push str.Local
push eax
call fcn.00450218
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp + 0x39c]
push eax
call esi
test eax, eax
je 0x40cca3
inc ebx
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x7ac]
push eax
call fcn.00450242
lea eax, [ebp + 0x7ac]
push str.LocalLow
push eax
call fcn.00450218
add esp, 0x10
lea eax, [ebp + 0x7ac]
push eax
call esi
test eax, eax
je 0x40ccde
mov dword [ebp - 0x80], 1
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.00450242
lea eax, [ebp + 0x194]
push str.Roaming
push eax
call fcn.00450218
add esp, 0x10
lea eax, [ebp + 0x194]
push eax
call esi
test eax, eax
je 0x40cd19
mov dword [ebp - 0x7c], 1
cmp ebx, edi
je 0x40cd80
cmp dword [ebp - 0x80], edi
je 0x40cd80
cmp dword [ebp - 0x7c], edi
je 0x40cd80
mov edi, dword [ebp - 0x78]
mov ecx, edi
call fcn.0040b31b
test eax, eax
je 0x40cd80
push str.SmartCloudWBIME.users
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp + 0x5a4]
push str._s_s_
push eax
call fcn.0045025e
add esp, 0x10
lea eax, [ebp + 0x5a4]
push eax
call esi
test eax, eax
jne 0x40cd6f
lea eax, [ebp + 0x5a4]
push eax
call fcn.0040cf55
pop ecx
lea eax, [ebp + 0x5a4]
push eax
lea ecx, [edi + 0x24]
call fcn.00401a28
jmp 0x40cd88
mov ecx, dword [ebp - 0x78]
call fcn.0040c882
mov ecx, dword [ebp + 0xbbc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa75
add ebp, 0xbc0
leave
ret
Function at 0x40cda0
Capabilities:
Check if file exists

Disassembly:
push esi
push 0xffffffffffffffff
lea esi, [ecx + 0x78]
add ecx, 0x40
push 0
push ecx
mov ecx, esi
call fcn.004018bf
push str.Skin_
mov ecx, esi
call fcn.004039fd
cmp dword [esi + 0x18], 8
jb 0x40cdca
mov eax, dword [esi + 4]
jmp 0x40cdcd
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40cded
cmp dword [esi + 0x18], 8
jb 0x40cde3
mov esi, dword [esi + 4]
jmp 0x40cde6
add esi, 4
push esi
call fcn.0040cf55
pop ecx
pop esi
ret

Function at 0x40cdef
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x59d680]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov esi, ecx
call fcn.0044fd00
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
add esi, 0x120
push eax
mov ecx, esi
call fcn.00401a28
push 0x53e180
mov ecx, esi
call fcn.004039fd
cmp dword [esi + 0x18], 8
jb 0x40ce61
mov eax, dword [esi + 4]
jmp 0x40ce64
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40ce7b
push str.C:Program_Files_
mov ecx, esi
call fcn.00401a28
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044fa75
leave
ret

Function at 0x40cf55
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
call fcn.0044f427
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00434345
push dword [esp + 0x1c]
mov esi, eax
push esi
call fcn.00450242
add esp, 0x10
xor ebp, ebp
test edi, edi
mov bl, 1
jl 0x40cfc4
cmp word [esi + ebp*2], 0x5c
jne 0x40cfbb
and word [esi + ebp*2], 0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40cfb5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40cfc2
mov word [esi + ebp*2], 0x5c
inc ebp
cmp ebp, edi
jle 0x40cf92
jmp 0x40cfc4
xor bl, bl
push esi
call fcn.00434340
pop ecx
pop edi
pop esi
pop ebp
movzx eax, bl
pop ebx
ret