joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413fa0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x30
push ebx
push ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esp + 8], eax
jne 0x413fd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00413a60
add esp, 4
or eax, 0xffffffff
pop ebp
pop ebx
add esp, 0x30
ret
mov ebx, dword [esp + 0x3c]
mov ebp, dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 0x10
push eax
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x41400b
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00413a60
add esp, 4
or eax, 0xffffffff
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push esi
push edi
push 0
push 0
push 0
push 0
push ecx
push edx
push ebx
call dword [sym.imp.WS2_32.dll_WSAConnect]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call edi
cmp esi, 0xffffffff
jne 0x4140a3
cmp eax, 0x2733
jne 0x4140a3
mov eax, dword [esp + 0x50]
push 1
push eax
lea ecx, [esp + 0x18]
push 1
push ecx
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
test eax, eax
je 0x414065
call edi
push eax
call fcn.00413a60
add esp, 4
or esi, esi
jmp 0x4140a3
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
cmp eax, 0xffffffff
jne 0x41408b
call edi
push eax
call fcn.00413a60
add esp, 4
or esi, 0xffffffff
jmp 0x4140a3
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4140a1
push eax
call fcn.00413a60
add esp, 4
or esi, 0xffffffff
jmp 0x4140a3
xor esi, esi
mov ecx, dword [esp + 0x10]
push 0
push ecx
push ebx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x414100
Capabilities:
Create thread
Resolve dns

Disassembly:
sub esp, 0x9c
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
push esi
push edi
mov edi, dword [esp + 0xac]
push edi
call ebx
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4141c4
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x41419b
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41419b
cmp dword [esp + 0x24], 2
jne 0x41419b
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 0
push edi
push 0x4140d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x41419b
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x41419b
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x9c
ret
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4141b3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x9c
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x9c
ret
Function at 0x4158a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a9598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x68]
test eax, eax
jne 0x41594a
push esi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.0045eab4
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x415931
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x415931
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x68], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4176d0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a9a48
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [eax + 0x94]
push eax
push 1
push str.HotkeyMode
push str.Setup
call edi
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
push eax
push ecx
mov ecx, ebx
call fcn.00432630
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
push str.plugin
push 0x52c648
push edx
call sub.MFC42.DLL_operator_4
mov dword [esp + 0x1c], 0xffffffff
call fcn.004177e0
mov ecx, eax
call fcn.004177f0
push ebx
mov ecx, esi
call fcn.00417e40
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x20]
and ecx, 0xffff
mov eax, dword [eax + 0x94]
push eax
push ecx
push str.EndHotkey
push 0x520988
call edi
mov ebp, eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov esi, dword [esi + 0x20]
shr esi, 0x10
mov ecx, dword [eax + 0x94]
push ecx
push esi
push str.EndHotkeyMod
push 0x520988
call edi
mov edx, eax
mov ecx, ebp
and edx, 0xffff
and ecx, 0xffff
shl edx, 0x10
or edx, ecx
mov ecx, dword [esp + 0x28]
push eax
push ebp
mov dword [ecx], edx
call fcn.004327e0
push ebx
call fcn.00432820
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x417e40
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4a9bc2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x14], esi
push eax
push ebp
push str.ShowFirstMacro
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [esi + 0xc]
xor edi, edi
cmp eax, ebp
jle 0x4180e9
mov ebx, 1
jmp 0x417e96
mov esi, dword [esp + 0x14]
xor ebp, ebp
lea ecx, [esp + 0x18]
call fcn.0042e600
lea ecx, [esp + 0xdc]
mov dword [esp + 0x180], ebp
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xe0]
mov byte [esp + 0x180], bl
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xe4]
mov byte [esp + 0x180], 2
call fcn.00418c10
mov dword [esp + 0xe4], 0x4b865c
mov dword [esp + 0xf8], ebp
lea ecx, [esp + 0xfc]
mov byte [esp + 0x180], 3
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x110]
mov byte [esp + 0x180], 4
call fcn.00418610
mov dword [esp + 0x110], 0x4b8648
lea ecx, [esp + 0x134]
mov byte [esp + 0x180], 5
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x148]
mov byte [esp + 0x180], 6
call sub.MFC42.DLL_CStringArray::CStringArray
push 0xa
lea ecx, [esp + 0x160]
mov byte [esp + 0x184], 7
call fcn.004188d0
xor eax, eax
mov dword [esp + 0x15c], 0x4b8634
mov dword [esp + 0x124], eax
mov dword [esp + 0x18], 0x4b85fc
mov dword [esp + 0x128], eax
mov dword [esp + 0xd8], ebp
mov dword [esp + 0x12c], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x130], eax
push ecx
mov dword [esp + 0x184], 8
mov ecx, esp
mov dword [esp + 0x14], esp
push edi
push ecx
lea ecx, [esi + 4]
call fcn.0040bab0
lea ecx, [esp + 0x1c]
call fcn.00430010
push ecx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x14], esp
mov ebp, esp
push 0x10
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
je 0x41800b
mov dword [esi + 4], 0
mov dword [esi + 8], ebx
mov dword [esi], 0x4b7690
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x184], 0xa
call dword [edx + 0x1c]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 2
jmp 0x41800d
xor esi, esi
mov ecx, dword [esp + 0x18c]
mov byte [esp + 0x184], 8
mov dword [ebp], esi
call fcn.00432520
lea ecx, [esp + 0x15c]
mov dword [esp + 0x180], 0x12
call fcn.00418900
lea ecx, [esp + 0x148]
mov byte [esp + 0x180], 0x11
call fcn.0045ec16
lea ecx, [esp + 0x134]
mov byte [esp + 0x180], 0x10
call fcn.0045ec16
lea ecx, [esp + 0x110]
mov byte [esp + 0x180], 0xf
call fcn.00418630
lea ecx, [esp + 0xfc]
mov byte [esp + 0x180], 0xe
call fcn.0045ec16
lea ecx, [esp + 0xe4]
mov byte [esp + 0x180], 0xd
call fcn.0041a050
lea ecx, [esp + 0xe0]
mov byte [esp + 0x180], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xdc]
mov byte [esp + 0x180], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x180], 0xffffffff
call fcn.004190b0
mov eax, dword [esp + 0x14]
inc edi
cmp edi, dword [eax + 0xc]
jl 0x417e90
mov ecx, dword [esp + 0x178]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x174
ret 4
Function at 0x417e5d
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4a9bc2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x14], esi
push eax
push ebp
push str.ShowFirstMacro
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [esi + 0xc]
xor edi, edi
cmp eax, ebp
jle 0x4180e9
mov ebx, 1
jmp 0x417e96
mov esi, dword [esp + 0x14]
xor ebp, ebp
lea ecx, [esp + 0x18]
call fcn.0042e600
lea ecx, [esp + 0xdc]
mov dword [esp + 0x180], ebp
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xe0]
mov byte [esp + 0x180], bl
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xe4]
mov byte [esp + 0x180], 2
call fcn.00418c10
mov dword [esp + 0xe4], 0x4b865c
mov dword [esp + 0xf8], ebp
lea ecx, [esp + 0xfc]
mov byte [esp + 0x180], 3
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x110]
mov byte [esp + 0x180], 4
call fcn.00418610
mov dword [esp + 0x110], 0x4b8648
lea ecx, [esp + 0x134]
mov byte [esp + 0x180], 5
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x148]
mov byte [esp + 0x180], 6
call sub.MFC42.DLL_CStringArray::CStringArray
push 0xa
lea ecx, [esp + 0x160]
mov byte [esp + 0x184], 7
call fcn.004188d0
xor eax, eax
mov dword [esp + 0x15c], 0x4b8634
mov dword [esp + 0x124], eax
mov dword [esp + 0x18], 0x4b85fc
mov dword [esp + 0x128], eax
mov dword [esp + 0xd8], ebp
mov dword [esp + 0x12c], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x130], eax
push ecx
mov dword [esp + 0x184], 8
mov ecx, esp
mov dword [esp + 0x14], esp
push edi
push ecx
lea ecx, [esi + 4]
call fcn.0040bab0
lea ecx, [esp + 0x1c]
call fcn.00430010
push ecx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x14], esp
mov ebp, esp
push 0x10
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
je 0x41800b
mov dword [esi + 4], 0
mov dword [esi + 8], ebx
mov dword [esi], 0x4b7690
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x184], 0xa
call dword [edx + 0x1c]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 2
jmp 0x41800d
xor esi, esi
mov ecx, dword [esp + 0x18c]
mov byte [esp + 0x184], 8
mov dword [ebp], esi
call fcn.00432520
lea ecx, [esp + 0x15c]
mov dword [esp + 0x180], 0x12
call fcn.00418900
lea ecx, [esp + 0x148]
mov byte [esp + 0x180], 0x11
call fcn.0045ec16
lea ecx, [esp + 0x134]
mov byte [esp + 0x180], 0x10
call fcn.0045ec16
lea ecx, [esp + 0x110]
mov byte [esp + 0x180], 0xf
call fcn.00418630
lea ecx, [esp + 0xfc]
mov byte [esp + 0x180], 0xe
call fcn.0045ec16
lea ecx, [esp + 0xe4]
mov byte [esp + 0x180], 0xd
call fcn.0041a050
lea ecx, [esp + 0xe0]
mov byte [esp + 0x180], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xdc]
mov byte [esp + 0x180], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x180], 0xffffffff
call fcn.004190b0
mov eax, dword [esp + 0x14]
inc edi
cmp edi, dword [eax + 0xc]
jl 0x417e90
mov ecx, dword [esp + 0x178]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x174
ret 4
Function at 0x418110
Capabilities:
Delete file
Encode data using xor
Read file on windows
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4a9bd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov eax, dword [esp + 0x1c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x20]
lea eax, [esp + 8]
push edx
push 4
xor esi, esi
push 1
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x18]
add esp, 0x10
cmp eax, esi
jle 0x4181c0
mov ecx, dword [esp + 0x1c]
push 0x520ac4
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
cmp edi, esi
je 0x4181c0
cmp dword [esp + 8], esi
jle 0x4181b6
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fputc]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fgetc]
mov edx, dword [esp + 0x28]
push edi
push edx
call ebp
add esp, 4
xor eax, 0xcc
push eax
call ebx
mov eax, dword [esp + 0x18]
add esp, 8
inc esi
cmp esi, eax
jl 0x418195
pop ebp
pop ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4181f0
Capabilities:
Delete file

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0xc]
test eax, eax
jle 0x41822e
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ebx, [edi + 4]
lea eax, [esp + 0x10]
push esi
push eax
mov ecx, ebx
call fcn.0040bab0
mov ecx, dword [eax]
push ecx
call ebp
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [edi + 0xc]
inc esi
cmp esi, eax
jl 0x418209
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x418240
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4a9c40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
lea eax, [esp + 0x34]
push ebx
mov esi, ecx
push eax
call fcn.0041acf0
mov ecx, esp
mov dword [esp + 0x18], esp
push str.plugin.zip
push eax
push ecx
mov dword [esp + 0x40], 0
call sub.MFC42.DLL_operator_4
mov ecx, esi
call fcn.00418110
or edi, 0xffffffff
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x52b540
call sub.MFC42.DLL_CString::CString_1
push ecx
mov dword [esp + 0x38], 1
mov edx, esp
mov dword [esp + 0x28], esp
push str.plugin
push 0x52c648
push edx
call sub.MFC42.DLL_operator_4
lea eax, [esp + 0x40]
mov byte [esp + 0x38], 2
push eax
call fcn.0041acf0
mov ecx, esp
mov dword [esp + 0x30], esp
push str.plugin.zip
push eax
push ecx
mov byte [esp + 0x48], 3
call sub.MFC42.DLL_operator_4
mov byte [esp + 0x3c], 4
call fcn.00439b90
add esp, 0x10
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
push edx
call fcn.0041acf0
add esp, 4
push str.plugin.zip
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x34], 5
push eax
call sub.MFC42.DLL_operator_4
mov eax, dword [eax]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebp
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
push ebx
lea ecx, [esp + 0x38]
push ecx
call fcn.0041acf0
mov edx, esp
mov dword [esp + 0x28], esp
push str.mymacro.zip
push eax
push edx
mov dword [esp + 0x40], 6
call sub.MFC42.DLL_operator_4
mov ecx, esi
call fcn.00418110
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x52b540
call sub.MFC42.DLL_CString::CString_1
push ecx
mov dword [esp + 0x38], 7
mov eax, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0041acf0
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 8
push ecx
call fcn.0041acf0
add esp, 4
mov byte [esp + 0x3c], 9
mov edx, esp
mov dword [esp + 0x20], esp
push str.mymacro.zip
push eax
push edx
call sub.MFC42.DLL_operator_4
mov byte [esp + 0x3c], 0xa
call fcn.00439b90
add esp, 0x10
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x18]
push eax
call fcn.0041acf0
add esp, 4
push str.mymacro.zip
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x38], 0xb
call sub.MFC42.DLL_operator_4
mov eax, dword [eax]
push eax
call ebp
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 4
Function at 0x4190b0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4a9eb2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], 0x4b8758
mov dword [esp + 0x20], 9
call fcn.0042ec30
lea esi, [edi + 0xa4]
mov dword [esp + 0x14], esi
mov dword [esi], 0x4b8744
mov ebp, dword [esi + 4]
xor ebx, ebx
cmp ebp, ebx
mov byte [esp + 0x20], 0xa
je 0x419115
lea eax, [ebp + 8]
push 1
push eax
call fcn.004195b0
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x419103
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
call sub.MFC42.DLL_CPlex::FreeDataChain
lea ecx, [edi + 0xa0]
mov dword [esi + 0x14], ebx
mov dword [esi], 0x4b66a0
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CString::CString
mov esi, dword [edi + 0x98]
cmp esi, ebx
je 0x41919f
lea ecx, [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x419199
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x419199
mov ecx, esi
mov byte [esp + 0x20], 0xc
call fcn.00419760
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 4]
mov byte [esp + 0x20], 0xb
call sub.MFC42.DLL_CFile::CFile
mov ecx, esi
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CString::CString
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [edi + 0x98], ebx
lea esi, [edi + 0x8c]
mov dword [esp + 0x14], esi
lea ecx, [esi + 8]
mov byte [esp + 0x20], 0xd
call sub.MFC42.DLL_CString::CString
cmp esi, ebx
je 0x4191bf
lea ebp, [esi + 4]
jmp 0x4191c1
xor ebp, ebp
mov esi, dword [ebp]
cmp esi, ebx
je 0x419218
lea edx, [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x419215
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x419215
mov ecx, esi
mov byte [esp + 0x20], 0xf
call fcn.00419760
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 4]
mov byte [esp + 0x20], 0xe
call sub.MFC42.DLL_CFile::CFile
mov ecx, esi
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CString::CString
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp], ebx
lea esi, [edi + 0x48]
mov dword [esp + 0x14], esi
mov dword [esi], 0x4b86d4
mov ecx, esi
mov byte [esp + 0x20], 0x11
call fcn.00435d70
lea ecx, [esi + 0x28]
mov byte [esp + 0x20], 0x10
call fcn.0045ed48
mov ecx, esi
mov byte [esp + 0x20], 4
call fcn.0045edea
lea ecx, [edi + 0x44]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 8]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 4]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4196b0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4a9f83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov eax, dword [edi + 4]
lea esi, [edi + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 1
push ecx
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [eax]
push 0x52b540
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x419713
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x54]
push 0
mov ecx, edi
call sub.MFC42.DLL_CString::GetBuffer
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CFile::CFile
mov ecx, edi
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41acf0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.0045f410
mov cl, byte [0x52c6b0]
mov al, 1
test al, cl
mov dword [esp], 0
jne 0x41ad2f
mov dl, cl
mov ecx, 0x52c6ac
or dl, al
mov byte [0x52c6b0], dl
call sub.MFC42.DLL_CString::CString_3
push 0x41ad90
call fcn.0045f3fc
add esp, 4
mov eax, dword [0x52c6ac]
push 0x52b540
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x41ad66
lea ecx, [esp + 4]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 4]
mov ecx, 0x52c6ac
push edx
call fcn.0045e74e
push esi
mov esi, dword [esp + 0x100c]
push 0x52c6ac
mov ecx, esi
call sub.MFC42.DLL_CString::CString_4
mov eax, esi
pop esi
add esp, 0x1004
ret

Function at 0x41ada0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.0045f410
mov cl, byte [0x52c6a8]
mov al, 1
test al, cl
mov dword [esp], 0
jne 0x41addf
mov dl, cl
mov ecx, 0x52c6a4
or dl, al
mov byte [0x52c6a8], dl
call sub.MFC42.DLL_CString::CString_3
push 0x41ae70
call fcn.0045f3fc
add esp, 4
mov eax, dword [0x52c6a4]
push esi
push 0x52b540
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x41ae49
push ebx
push edi
lea ecx, [esp + 0x10]
push 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x520210
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x52c6a4
call fcn.0045e74e
pop edi
pop ebx
mov esi, dword [esp + 0x100c]
push 0x52c6a4
mov ecx, esi
call sub.MFC42.DLL_CString::CString_4
mov eax, esi
pop esi
add esp, 0x1004
ret