joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444650
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 1
push edi
cmp dword [esi + 0xc], ebp
jne 0x44466c
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x444716
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4446c5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x4446a8
cmp eax, 3
jne 0x4446c5
cmp edi, 0x4e20
jbe 0x4446c5
push 0x4e20
push ebx
mov ecx, esi
call fcn.00444650
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4446e1
call ebp
cmp eax, 0x6d
jne 0x4446e1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], 0
jne 0x44470b
cmp edi, 0x8000
jbe 0x44470b
call ebp
cmp eax, 0x21
jne 0x44470b
push 0x8000
push ebx
mov ecx, esi
call fcn.00444650
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x444c70
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push 0x800
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00453e00
movzx edx, word [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x444cd6
cmp eax, 5
je 0x444cd6
xor eax, eax
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
xor ecx, esp
mov eax, 1
call fcn.004e6b3a
add esp, 0x1004
ret 4

Function at 0x444d00
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
push esi
push 0x800
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.00453720
lea edx, [esp + 0xc]
push edx
movzx edx, word [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x18]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x24]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x444d97
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x10]
ja 0x444d97
push 1
push esi
push esi
push eax
call fcn.004e68d0
mov ecx, dword [esp + 4]
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x101c]
pop esi
xor ecx, esp
xor eax, eax
xor edx, edx
call fcn.004e6b3a
add esp, 0x101c
ret 4
Function at 0x444dc0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
push 0x800
lea ecx, [esp + 0x210]
push ecx
push eax
call fcn.00453e00
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x444ec4
mov ecx, 0x503064
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x444e4a
test dx, dx
je 0x444e46
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x444e4a
add eax, 4
add ecx, 4
test dx, dx
jne 0x444e24
xor eax, eax
jmp 0x444e4f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x444ea8
mov ecx, 0x503058
lea eax, [esp]
jmp 0x444e60
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x444e86
test dx, dx
je 0x444e82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x444e86
add eax, 4
add ecx, 4
test dx, dx
jne 0x444e60
xor eax, eax
jmp 0x444e8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x444ea8
xor eax, eax
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1210
ret 4
mov eax, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor ecx, esp
xor al, al
call fcn.004e6b3a
add esp, 0x1210
ret 4

Function at 0x444f30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push edi
mov edi, dword [esp + 0x1014]
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x444f81
push 0x800
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004531f0
test al, al
je 0x444f7f
lea ecx, [esp + 0xc]
push ecx
call ebx
jmp 0x444f81
mov eax, esi
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1004
ret 4

Function at 0x444fa0
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
mov esi, dword [esp + 0x1014]
push edi
mov edi, dword [esp + 0x101c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x445000
push 0x800
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004531f0
test al, al
je 0x445000
push edi
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
setne al
jmp 0x445002
mov al, bl
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1004
ret 8
Function at 0x445020
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x201c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x44509e
push 0x800
lea eax, [esp + 0x1014]
push eax
push esi
call fcn.004531f0
test al, al
je 0x44509e
push 0x800
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.004531f0
test al, al
je 0x44509e
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1014]
push eax
call ebp
test eax, eax
setne al
jmp 0x4450a0
mov al, bl
mov ecx, dword [esp + 0x2010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x2004
ret 8

Function at 0x4450c0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x445116
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004531f0
test al, al
je 0x445116
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x445118
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1004
ret 4

Function at 0x445140
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x445196
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004531f0
test al, al
je 0x445196
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x445198
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1004
ret 4

Function at 0x4454a0
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0x10], eax
jbe 0x4454f8
mov dword [ecx + 0x10], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x4458a0
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x1004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push edi
push esi
call fcn.00452b60
movzx eax, word [eax]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp ax, 0x2e
je 0x4458e5
cmp ax, 0x20
je 0x4458e5
push 0
push esi
call edi
test eax, eax
jne 0x445911
push esi
call fcn.00444f30
cmp eax, 0xffffffff
jne 0x44592d
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004531f0
test al, al
je 0x44592d
push 0
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
je 0x44592d
cmp byte [esp + 0x1014], 0
je 0x445929
mov edx, dword [esp + 0x1018]
push edx
push esi
call fcn.00444fa0
xor eax, eax
jmp 0x445947
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x445942
cmp eax, 3
mov eax, 1
jne 0x445947
mov eax, 2
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1004
ret 0xc
Function at 0x446d40
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
push ebp
push esi
mov esi, dword [esp + 0x126c]
push edi
mov edi, dword [esp + 0x1268]
cmp edi, 0xffffffff
jne 0x446def
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x446e23
push 0x800
lea ecx, [esp + 0x264]
push ecx
push ebx
call fcn.004531f0
test al, al
je 0x446dbc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x446e23
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x446dd8
cmp eax, 3
je 0x446dd8
cmp eax, 0x12
je 0x446dd8
mov eax, 1
jmp 0x446dda
xor eax, eax
mov byte [esi + 0x1044], al
mov dword [esi + 0x1040], 0
jmp 0x446f02
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x446e23
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne dl
mov byte [esi + 0x1044], dl
mov dword [esi + 0x1040], 0
jmp 0x446f02
push 0x800
push ebx
push esi
call fcn.004694b0
push 0x800
lea eax, [esp + 0x40]
push eax
push esi
call fcn.00453690
mov ecx, dword [esp + 0x2c]
push 1
push 0
push 0
push ecx
call fcn.004e68d0
mov ecx, dword [esp + 0x30]
xor ebx, ebx
add eax, ecx
mov ecx, dword [esp + 0x18]
adc edx, ebx
mov dword [esi + 0x1000], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1004], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1028], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1008], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x102c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1034], eax
mov dword [esi + 0x1030], edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x24]
mov dword [esi + 0x1038], ecx
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x103c], edx
call fcn.0046aaa0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x1018]
call fcn.0046aaa0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0x1020]
call fcn.0046aaa0
test dword [esp + 0x10], 0x400
je 0x446ef4
cmp dword [esp + 0x34], 0xa0000003
jne 0x446ef4
lea eax, [ebx + 1]
jmp 0x446ef6
xor eax, eax
mov byte [esi + 0x100e], al
mov dword [esi + 0x1040], ebx
mov ecx, dword [esp + 0x1260]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1254
ret 0xc
Function at 0x449ea0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
add eax, ebx
push edi
mov edi, dword [ecx + 0x6148]
mov dword [esp + 8], eax
cmp ebx, eax
je 0x449f66
push ebp
push esi
mov edx, dword [ecx + 0xd0]
movzx eax, byte [edx + ebx]
lea esi, [edx + ebx]
imul eax, eax, 0x2773
movzx edx, byte [esi + 1]
xor eax, edx
movzx edx, byte [esi + 2]
movzx esi, byte [esi + 3]
mov ebp, eax
imul ebp, ebp, 0x2773
xor edx, ebp
mov ebp, edx
imul ebp, ebp, 0x2773
and eax, 0x3fff
xor esi, ebp
mov ebp, dword [ecx + 0xd4]
add ebp, eax
mov al, byte [ebp]
mov byte [esp + 0x18], al
mov eax, dword [ecx + 0xd8]
and edx, 0x3ffff
movzx eax, word [eax + edx*2]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 0xdc]
and esi, 0x3ffff
mov eax, dword [eax + esi*4]
mov byte [ebp], bl
mov ebp, dword [ecx + 0xd8]
mov word [ebp + edx*2], bx
mov edx, dword [ecx + 0xdc]
mov dword [edx + esi*4], ebx
mov dl, byte [esp + 0x18]
mov dword [edi + 3], eax
mov ax, word [esp + 0x1c]
mov word [edi + 1], ax
mov byte [edi], dl
inc ebx
add edi, 7
cmp ebx, dword [esp + 0x10]
jne 0x449ec1
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret 8

Function at 0x449f70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax]
cmp esi, edi
je 0x449fef
push ebx
jmp 0x449f90
mov edx, dword [ecx + 0xd0]
movzx eax, byte [edx + esi]
movzx ebx, byte [edx + esi + 1]
imul eax, eax, 0x2773
add edx, esi
xor eax, ebx
movzx ebx, byte [edx + 2]
imul eax, eax, 0x2773
xor eax, ebx
movzx ebx, byte [edx + 3]
imul eax, eax, 0x2773
movzx edx, byte [edx + 4]
xor eax, ebx
imul eax, eax, 0x2773
xor eax, edx
and eax, dword [ecx + 0xec]
mov edx, dword [ecx + 0xe0]
lea eax, [edx + eax*4]
mov edx, dword [eax]
mov dword [eax], esi
mov eax, dword [ecx + 0xe4]
mov dword [eax + esi*4], edx
inc esi
cmp esi, edi
jne 0x449f90
pop ebx
pop edi
pop esi
ret 8
Function at 0x44b230
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd4]
push 0x4000
push 0
push eax
call fcn.004e7df0
add esp, 0xc
cmp byte [esp + 8], 0
je 0x44b321
cmp byte [esi + 0x6135], 0
jne 0x44b321
mov ecx, dword [esi + 0xe8]
mov eax, dword [esi + 0x6130]
shr ecx, 2
cmp eax, ecx
ja 0x44b321
xor edx, edx
test eax, eax
jbe 0x44b363
push ebx
push edi
jmp 0x44b290
mov eax, dword [esi + 0xd0]
movzx edi, byte [eax + edx + 1]
lea ecx, [eax + edx]
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 2]
imul eax, eax, 0x2773
xor eax, edi
mov edi, dword [esi + 0xd8]
imul eax, eax, 0x2773
xor eax, ecx
mov ecx, eax
imul eax, eax, 0x2773
and ecx, 0x3ffff
xor ebx, ebx
mov word [edi + ecx*2], bx
mov ecx, dword [esi + 0xd0]
movzx ecx, byte [ecx + edx + 3]
mov edi, dword [esi + 0xdc]
xor ecx, eax
mov eax, ecx
imul ecx, ecx, 0x2773
and eax, 0x3ffff
mov dword [edi + eax*4], ebx
mov eax, dword [esi + 0xd0]
movzx eax, byte [eax + edx + 4]
xor eax, ecx
and eax, dword [esi + 0xec]
mov ecx, dword [esi + 0xe0]
inc edx
mov dword [ecx + eax*4], ebx
cmp edx, dword [esi + 0x6130]
jb 0x44b290
pop edi
pop ebx
pop esi
ret 4
mov edx, dword [esi + 0xd8]
push 0x80000
push 0
push edx
call fcn.004e7df0
mov eax, dword [esi + 0xdc]
push 0x100000
push 0
push eax
call fcn.004e7df0
mov ecx, dword [esi + 0xe8]
mov edx, dword [esi + 0xe0]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call fcn.004e7df0
add esp, 0x24
pop esi
ret 4
Function at 0x44dae0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xc0]
push ebp
xor edx, edx
push esi
add ebx, 0xffffff88
push edi
add eax, 2
lea edi, [esp + 0x20]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov edi, edi
cmp edx, ebx
jge 0x44dc43
lea eax, [esp + 0x48]
sub eax, 2
lea ecx, [eax + 3]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x48]
sub ecx, eax
add ecx, 0xfffffffd
mov dword [esp + 0x3c], ecx
mov ecx, eax
neg ecx
lea esi, [esp + ecx + 0x48]
mov dword [esp + 0x44], esi
lea esi, [esp + ecx + 0x49]
mov dword [esp + 0x30], esi
lea esi, [esp + 0x48]
sub esi, eax
lea eax, [esp + ecx + 0x4a]
mov ecx, dword [esp + 0x14]
sub ebx, edx
mov dword [esp + 0x40], eax
dec ebx
mov eax, 0x88888889
mul ebx
dec esi
mov ebp, edx
shr ebp, 0xa
mov dword [esp + 0x2c], esi
mov esi, dword [edi]
mov dword [esp + 0x10], ecx
inc ebp
mov eax, dword [esp + 0x10]
xor edi, edi
lea ebx, [ebx]
movzx edx, byte [eax - 2]
mov cl, byte [eax - 1]
sub dl, cl
mov byte [esp + edi + 0x48], dl
movzx edx, byte [eax]
sub dl, cl
mov byte [esp + edi + 0x49], cl
mov byte [esp + edi + 0x4a], dl
add edi, 3
add eax, 3
cmp edi, 0x78
jl 0x44dba0
mov ecx, dword [esp + 0x34]
mov edi, 0x27
mov edi, edi
mov eax, dword [esp + 0x40]
movzx edx, byte [eax + ecx]
mov eax, dword [esp + 0x2c]
sub dl, byte [eax + ecx]
add ecx, 3
movsx eax, dl
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, dword [esp + 0x44]
mov al, byte [edx + ecx - 3]
mov edx, dword [esp + 0x3c]
sub al, byte [edx + ecx - 3]
movsx eax, al
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + ecx - 3]
sub dl, byte [ecx - 3]
movsx eax, dl
cdq
xor eax, edx
sub eax, edx
add eax, esi
sub edi, 1
lea esi, [eax + ebx]
jne 0x44dbd0
add dword [esp + 0x10], 0x780
sub ebp, 1
jne 0x44db94
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [edi], esi
inc dword [esp + 0x14]
inc edx
add edi, 4
cmp edx, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
jle 0x44db30
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, ecx
ja 0x44dc8d
cmp eax, edx
ja 0x44dc8d
xor eax, eax
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.004e6b3a
add esp, 0xb4
ret 8
cmp edx, ecx
mov ecx, dword [esp + 0xb0]
sbb eax, eax
neg eax
xor ecx, esp
inc eax
call fcn.004e6b3a
add esp, 0xb4
ret 8
Function at 0x452d80
Capabilities:
Get common file path

Disassembly:
sub esp, 8
call fcn.0049afa0
test al, al
jne 0x452d92
add esp, 8
ret 0xc
push ebx
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push 0x1a
xor ecx, ecx
push 0
mov word [esi], cx
xor bl, bl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x452e0e
mov eax, dword [esp + 8]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x452e0e
cmp word [esi], 0
je 0x452e0e
push edi
mov edi, dword [esp + 0x1c]
push edi
push esi
call fcn.00452c60
push edi
push 0x503130
push esi
call fcn.00469530
push esi
call fcn.00445470
mov bl, al
pop edi
test bl, bl
jne 0x452e0e
cmp byte [esp + 0x1c], 0
je 0x452e0e
push 0
push 0
push esi
call fcn.004458a0
test eax, eax
sete bl
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
mov al, bl
pop ebx
add esp, 8
ret 0xc
Function at 0x4531f0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [esp + 0x1010]
movzx eax, word [edi]
test ax, ax
jne 0x453227
xor al, al
jmp 0x453425
push eax
call fcn.00469130
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x453232
push ebx
sub eax, edx
sar eax, 1
push edi
mov ebx, eax
call fcn.004530a0
test al, al
je 0x45331c
movzx eax, word [edi]
push eax
call fcn.00469130
movzx eax, ax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x4532ab
cmp word [edi + 2], 0x3a
jne 0x4532ab
add ebx, 4
cmp dword [esp + 0x101c], ebx
jbe 0x453422
push 4
push 0x503160
push esi
call fcn.004e9eda
add esp, 0xc
sub esi, edi
mov eax, edi
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x453295
mov al, 1
jmp 0x453424
cmp word [edi], 0x5c
jne 0x453422
add edi, 2
cmp word [edi], 0x5c
jne 0x453422
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x453422
push 4
push 0x503160
push esi
call fcn.004e9eda
mov eax, 0x503158
mov ecx, esi
add esp, 0xc
sub ecx, eax
lea edx, [ecx + 8]
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4532f0
sub esi, edi
mov eax, edi
lea edx, [esi + 0xe]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x453306
mov al, 1
jmp 0x453424
lea edx, [esp + 0xc]
push edx
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x453422
cmp eax, 0x7ff
ja 0x453422
movzx eax, word [edi]
push eax
call fcn.00452bc0
test al, al
je 0x453399
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x453422
push 4
push 0x503160
push esi
call fcn.004e9eda
push 2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esi + 8]
push edx
call fcn.004e9eda
add esp, 0x18
sub esi, edi
mov eax, edi
lea edx, [esi + 0xc]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x453383
mov al, 1
jmp 0x453424
push 0x800
lea eax, [esp + 0x10]
push eax
call fcn.00452c60
lea eax, [esp + 0xc]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4533b0
sub eax, edx
sar eax, 1
lea ecx, [eax + ebx + 4]
mov ebx, dword [esp + 0x101c]
cmp ebx, ecx
jbe 0x453422
push 4
push 0x503160
push esi
call fcn.004e9eda
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
sub edx, ecx
add esp, 0xc
add edx, 8
jmp 0x4533f0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4533f0
cmp word [edi], 0x2e
jne 0x453416
movzx edx, word [edi + 2]
push edx
call fcn.00452bc0
test al, al
je 0x453416
add edi, 4
push ebx
push edi
push esi
call fcn.00469530
mov al, 1
jmp 0x453424
xor al, al
pop ebx
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1004
ret 0xc
Function at 0x4537b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x10]
push ecx
push 1
xor eax, eax
push eax
push str.SoftwareWinRARPaths
push SysReAllocString
mov word [esi], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x453808
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.AppData
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x453818
push esi
call fcn.00445470
test al, al
jne 0x453855
mov eax, dword [esp + 0x18]
push eax
push edi
push esi
call fcn.00452d80
test al, al
jne 0x453855
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.004534c0
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x453850
cmp word [esi + 2], 0x3a
jne 0x45384d
add esi, 8
cmp eax, esi
jb 0x453850
sub eax, 2
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ecx
ret 0xc