joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449050
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570358
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5c3678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], edi
cmp eax, edi
jne 0x449099
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], edi
mov byte [esi + 4], 0
jmp 0x44915d
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x28], 0
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44912f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 1
jbe 0x449126
push 0x5cc9fe
push edi
call fcn.0053d8d6
add esp, 8
mov dword [ebp - 0x30], eax
test eax, eax
je 0x449126
push 0
lea ecx, [ebp - 0x34]
push ecx
push edi
push eax
push ebx
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44911a
mov eax, dword [ebp - 0x34]
cmp edi, eax
jne 0x44911a
mov edx, dword [ebp - 0x30]
push eax
push edx
lea ecx, [ebp - 0x2c]
call fcn.00422b90
mov eax, dword [ebp - 0x30]
push eax
call fcn.0053d6b6
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x2c]
push ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], edi
mov ecx, esi
mov byte [esi + 4], 0
call fcn.00423020
cmp dword [ebp - 0x14], 0x10
jb 0x44915d
mov edx, dword [ebp - 0x28]
push edx
call fcn.0053c152
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret
Function at 0x44aa60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564e08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44aadd
mov ecx, dword [ebp + 8]
xor ebx, ebx
cmp dword [ecx + 0x14], ebx
je 0x44aadd
cmp byte [edi + 0xb0], bl
jne 0x44aadd
push 0x5cc9fe
push 0x24
call fcn.0053dd33
add esp, 8
cmp eax, ebx
je 0x44aac9
mov dword [eax + 0x18], 0xf
mov dword [eax + 0x14], ebx
mov byte [eax + 4], bl
mov esi, eax
jmp 0x44aacb
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x44aaf2
lea eax, [ebp - 0x10]
call fcn.0044b290
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [edi + 4]
push 0x64
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00423020
mov ecx, dword [ebp + 0xc]
push ebx
push ebx
push esi
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 4]
push 0x44ad00
push ebx
mov dword [esi + 0x20], edx
push ebx
mov byte [edi + 0xb0], 1
call fcn.0053d041
add esp, 0x18
cmp eax, ebx
je 0x44ab70
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 4]
push ebx
push 0x4e20
push 0x64
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [ebp - 0x10]
mov bl, 1
call fcn.0044b290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x10]
mov byte [edi + 0xb0], bl
call fcn.0044b290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44aba0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567a10
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5c3678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0x3c
lea eax, [ebp - 0x70]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x2d], 0
call fcn.00544310
add esp, 0xc
lea esi, [ebp - 0x2c]
mov eax, edi
mov dword [ebp - 0x70], 0x3c
call fcn.00448fb0
mov dword [ebp - 4], 0
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov edi, dword [ebp - 0x18]
mov ecx, 0x5cc90c
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x34], esi
mov ecx, 1
mov byte [ebp - 4], cl
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x44ac36
mov ecx, edi
lea eax, [ebp - 0x34]
call fcn.00414940
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5c], edi
mov edi, 0x10
mov dword [ebp - 0x60], esi
cmp dword [ebp - 0x14], edi
jae 0x44ac4c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x44aca0
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0054158b
mov dword [esi - 0xc], eax
add esp, 8
mov byte [eax + esi], 0
cmp dword [ebx + 0x48], edi
jb 0x44ac8c
mov ebx, dword [ebx + 0x34]
push ebx
push esi
call fcn.005424bf
add esp, 8
test eax, eax
sete bl
jmp 0x44aca3
add ebx, 0x34
push ebx
push esi
call fcn.005424bf
add esp, 8
test eax, eax
sete bl
jmp 0x44aca3
mov bl, byte [ebp - 0x2d]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x44acc3
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
cmp dword [ebp - 0x14], edi
jb 0x44acd4
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0053c152
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret 4
Function at 0x453960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564be8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00420320
mov dword [ebp - 4], 0
test edi, edi
je 0x4539a3
add edi, 0x28
jmp 0x4539a5
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4539bd
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x453a40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567798
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.004231f0
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
mov dword [ebp - 4], 0
test edi, edi
je 0x453a89
add edi, 0x28
jmp 0x453a8b
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x453aa3
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x453c20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567798
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.004231f0
mov dword [esi], vtable.boost::gregorian::bad_year.0
mov dword [ebp - 4], 0
test edi, edi
je 0x453c69
add edi, 0x28
jmp 0x453c6b
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x453c83
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x453d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567798
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.004231f0
mov dword [esi], vtable.boost::gregorian::bad_month.0
mov dword [ebp - 4], 0
test edi, edi
je 0x453d69
add edi, 0x28
jmp 0x453d6b
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x453d83
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x458cb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567609
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CCmdDispatcher.0
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [esi + 0x28], eax
mov byte [ebp - 4], 1
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [esi + 0x2c], eax
mov byte [ebp - 4], 2
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [esi + 0x30], eax
mov byte [ebp - 4], 3
lea ecx, [esi + 0x78]
push ecx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], 0x14
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
call fcn.004e2e10
lea edx, [esi + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45b070
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, eax
test edi, edi
je 0x45b209
mov edx, dword [ebp + 8]
test edx, edx
je 0x45b209
test ebx, ebx
je 0x45b209
cmp dword [ebp + 0x10], 0
je 0x45b209
push esi
xor esi, esi
cmp edx, 2
jbe 0x45b14d
mov dword [ebp - 4], 4
mov al, byte [edi]
mov cl, byte [edi + 1]
sub dword [ebp + 8], 3
mov bl, al
inc edi
mov dl, byte [edi + 1]
shr bl, 2
and al, 3
mov byte [ebp - 8], bl
mov bl, cl
shl al, 4
inc edi
shr bl, 4
add al, bl
and cl, 0xf
mov byte [ebp - 7], al
add cl, cl
mov al, dl
shr al, 6
add cl, cl
add cl, al
mov eax, dword [ebp - 4]
and dl, 0x3f
inc edi
mov byte [ebp - 5], dl
cmp eax, dword [ebp + 0x10]
ja 0x45b1f2
movzx edx, byte [ebp - 8]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp + 0xc]
mov byte [esi + ebx], dl
movzx edx, byte [ebp - 7]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + ebx], dl
movzx ecx, cl
movzx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ecx, byte [ebp - 5]
inc esi
inc eax
mov byte [esi + ebx], dl
movzx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
inc esi
inc eax
mov byte [esi + ebx], dl
inc eax
inc esi
cmp dword [ebp + 8], 2
mov dword [ebp - 4], eax
ja 0x45b0b5
mov edx, dword [ebp + 8]
test edx, edx
je 0x45b1ed
xor al, al
xor cl, cl
mov byte [ebp - 2], 0
mov byte [ebp - 3], al
mov byte [ebp - 4], cl
test edx, edx
jbe 0x45b17b
push edx
lea eax, [ebp - 4]
push edi
push eax
call fcn.00545f90
mov al, byte [ebp - 3]
mov cl, byte [ebp - 4]
add esp, 0xc
mov dl, cl
shr dl, 2
mov byte [ebp - 8], dl
mov dl, al
and cl, 3
shr dl, 4
and al, 0xf
shl cl, 4
add cl, dl
mov dl, byte [ebp - 2]
add al, al
shr dl, 6
add al, al
add al, dl
lea edx, [esi + 4]
cmp edx, dword [ebp + 0x10]
jbe 0x45b1b2
pop esi
pop edi
mov eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
movzx edx, byte [ebp - 8]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx], dl
movzx ecx, cl
movzx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + ebx], dl
inc esi
cmp dword [ebp + 8], 1
jne 0x45b1db
mov byte [esi + ebx], 0x3d
jmp 0x45b1e7
movzx eax, al
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx], cl
inc esi
mov byte [esi + ebx], 0x3d
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x45b1fc
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + ebx], 0
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bf00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56748b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5c3678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x238], ebx
test byte [0x5d17ec], 1
lea edi, [ebx + 7]
jne 0x45bf69
or dword [0x5d17ec], 1
xor eax, eax
push 0x57b2d0
mov dword [0x5d17e8], edi
mov dword [0x5d17e4], ebx
mov word [0x5d17d4], ax
call fcn.0053c293
add esp, 4
cmp byte [0x5d11e8], 1
jne 0x45bf83
xor ecx, ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov word [esi + 4], cx
jmp 0x45c07f
push 0x206
lea eax, [ebp - 0x216]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x218], dx
call fcn.00544310
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45c06c
xor edx, edx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], dx
lea eax, [ebp - 0x238]
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x218]
push eax
push ecx
call fcn.00405340
add esp, 8
test al, al
je 0x45c038
mov edi, dword [ebp - 0x238]
push edi
lea ecx, [ebp - 0x234]
call fcn.00405480
add esp, 4
test al, al
jne 0x45c01f
push edi
lea ecx, [ebp - 0x234]
call fcn.00405730
add esp, 4
cmp al, bl
je 0x45c033
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x234]
push edx
mov eax, 0x5d17d0
call fcn.00411b80
mov edi, 7
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x45c057
mov eax, dword [ebp - 0x230]
push eax
call fcn.0053c152
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], cx
xor edx, edx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov byte [0x5d11e8], 1
mov word [esi + 4], dx
push 0xffffffffffffffff
push ebx
push 0x5d17d0
mov eax, esi
call fcn.00411b80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret
Function at 0x45c0b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56748b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5c3678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x238], edi
test byte [0x5d17ac], 1
lea ebx, [edi + 7]
jne 0x45c119
or dword [0x5d17ac], 1
xor eax, eax
push 0x57b310
mov dword [0x5d17a8], ebx
mov dword [0x5d17a4], edi
mov word [0x5d1794], ax
call fcn.0053c293
add esp, 4
cmp byte [0x5d11e9], 1
jne 0x45c133
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
jmp 0x45c217
push 0x206
lea eax, [ebp - 0x216]
xor edx, edx
push edi
push eax
mov word [ebp - 0x218], dx
call fcn.00544310
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45c204
xor edx, edx
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
lea eax, [ebp - 0x238]
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x218]
push eax
push ecx
call fcn.00405340
add esp, 8
test al, al
je 0x45c1d0
mov edx, dword [ebp - 0x238]
push edx
lea ecx, [ebp - 0x234]
call fcn.00405730
add esp, 4
test al, al
je 0x45c1d0
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x234]
push eax
mov eax, 0x5d1790
call fcn.00411b80
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x45c1ef
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.0053c152
add esp, 4
xor edx, edx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov byte [0x5d11e9], 1
mov word [esi + 4], ax
push 0xffffffffffffffff
push edi
push 0x5d1790
mov eax, esi
call fcn.00411b80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret
Function at 0x45c500
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c4c9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x34]
call fcn.00409b50
mov dword [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x45c552
mov eax, dword [eax + 4]
jmp 0x45c555
add eax, 4
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.00423950
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1c], 8
jb 0x45c576
mov edx, dword [ebp - 0x30]
push edx
call fcn.0053c152
add esp, 4
mov edx, dword [0x5cc90c]
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], esi
call eax
add eax, 0x10
mov dword [edi], eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
mov esi, str.profile_premium.jpg
mov dword [ebp - 0x14], 1
call fcn.00421fe0
add esp, 8
mov byte [ebp - 4], 4
call fcn.00423c70
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c5e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45c5f8
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
jmp 0x45c64d
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp + 0xc]
push eax
mov esi, str.profile.jpg
call fcn.00421fe0
add esp, 8
mov byte [ebp - 4], 5
call fcn.00423c70
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c639
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45c64d
mov esi, edi
call fcn.00423a80
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c670
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45c690
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c468
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x34]
call fcn.00409b50
xor esi, esi
mov edi, 8
mov dword [ebp - 4], esi
cmp dword [eax + 0x18], edi
jb 0x45c6d4
mov eax, dword [eax + 4]
jmp 0x45c6d7
add eax, 4
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00423950
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], edi
jb 0x45c6f7
mov edx, dword [ebp - 0x30]
push edx
call fcn.0053c152
add esp, 4
mov edx, dword [0x5cc90c]
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], esi
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
mov esi, str.profile_premium.jpg
mov byte [ebp - 4], 3
call fcn.00421fe0
add esp, 8
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00423c70
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c765
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call ebx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
mov esi, str.profile.jpg
call fcn.00421fe0
add esp, 8
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.00423c70
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c7b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x10]
push esi
call ebx
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c7db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c801
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret