joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44aec9
Capabilities:
Resume thread

Disassembly:
mov eax, 0x56ea6d
call fcn.004f85f0
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 0x18], edi
je 0x44aee5
push 1
pop eax
jmp 0x44af48
push 0x80
call fcn.0054fc33
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x44af07
push edi
push ebx
call fcn.0045d16c
mov esi, eax
jmp 0x44af09
xor esi, esi
or eax, 0xffffffff
cmp esi, edi
mov dword [ebp - 4], eax
je 0x44af48
push edi
push edi
push 4
mov ecx, esi
call fcn.00553a69
test eax, eax
jne 0x44af30
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x44af48
push edi
mov dword [ebx + 0x18], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44ba44
Capabilities:
Resume thread

Disassembly:
mov eax, 0x56eb1d
call fcn.004f85f0
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x1c], ebx
jne 0x44ba95
mov eax, dword [edi + 0xc]
xor esi, esi
mov dword [ebp - 0x10], ebx
mov edx, dword [eax + 0x5dc]
cmp edx, ebx
jle 0x44ba95
mov eax, dword [eax + 0x5d8]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x44ba88
cmp dword [ecx + 0x14], 0x64
jne 0x44ba85
cmp dword [ecx + 0x1c], 0x64
je 0x44ba88
inc dword [ebp - 0x10]
inc esi
add eax, 4
cmp esi, edx
jl 0x44ba73
cmp dword [ebp - 0x10], ebx
jne 0x44ba9a
push 1
pop eax
jmp 0x44bafe
push 0x80
call fcn.0054fc33
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x44babd
push 1
push edi
call fcn.0045d16c
mov esi, eax
jmp 0x44babf
xor esi, esi
or eax, 0xffffffff
cmp esi, ebx
mov dword [ebp - 4], eax
je 0x44bafe
push ebx
push ebx
push 4
mov ecx, esi
call fcn.00553a69
test eax, eax
jne 0x44bae6
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x44bafe
push ebx
mov dword [edi + 0x1c], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44c543
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x56ec86
call fcn.004f85f0
push ecx
mov eax, dword [0x64a758]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ecx], eax
mov eax, dword [0x64a758]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x10], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x14], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x18], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x30], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x48], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x4c], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x50], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x54], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x58], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x5c], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x60], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x64], eax
mov edi, 0x6524d4
mov byte [ebp - 4], 0xd
push edi
mov dword [esi], ebx
call fcn.0054f7db
or dword [esi + 8], 0xffffffff
push edi
lea ecx, [esi + 0xc]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x10]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x14]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x18]
call fcn.0054f7db
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
push edi
lea ecx, [esi + 0x30]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
call fcn.0054f7db
mov dword [esi + 0x40], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x44], ebx
push edi
lea ecx, [esi + 0x48]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x4c]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x50]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x54]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x58]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x5c]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x60]
call fcn.0054f7db
push edi
lea ecx, [esi + 0x64]
call fcn.0054f7db
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44c77e
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x56ed6b
call fcn.004f85f0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x64]
mov dword [ebp - 4], 0xc
call fcn.0054f644
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 0xb
call fcn.0054f644
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 0xa
call fcn.0054f644
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 9
call fcn.0054f644
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 8
call fcn.0054f644
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 7
call fcn.0054f644
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 6
call fcn.0054f644
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call fcn.0054f644
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 4
call fcn.0054f644
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.0054f644
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.0054f644
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.0054f644
and byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.0054f644
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 4]
call fcn.0054f644
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44d203
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x56ee4c
call fcn.004f85f0
sub esp, 0xc
push esi
mov esi, ecx
call fcn.0041256c
test eax, eax
jne 0x44d217
or eax, 0xffffffff
jmp 0x44d2d5
mov eax, dword [0x64a758]
push ebx
push edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0044d507
test eax, eax
je 0x44d23d
or ebx, 0xffffffff
jmp 0x44d2c5
push dword [ebp - 0x14]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
test eax, eax
je 0x44d235
push 0x6524d4
lea ecx, [ebp - 0x10]
call fcn.0054f6b8
mov esi, 0x5bccb4
lea ecx, [ebp - 0x10]
push esi
mov byte [ebp - 4], 1
call fcn.0054fa35
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.0054fa71
push esi
lea ecx, [ebp - 0x10]
call fcn.0054fa35
lea eax, [ebp - 0x18]
push eax
call fcn.00403854
pop ecx
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x44d29f
push 5
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push ebx
jmp 0x44d2ab
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.0054f644
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0054f644
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0054f644
mov eax, ebx
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x44d2e2
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x56ee60
call fcn.004f85f0
push ecx
push ecx
push ebx
lea ebx, [ecx + 0x69c]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [ebx]
call esi
test eax, eax
jne 0x44d309
or eax, 0xffffffff
jmp 0x44d388
push edi
push 0x6524d4
lea ecx, [ebp - 0x10]
call fcn.0054f6b8
and dword [ebp - 4], 0
mov edi, 0x5bccb4
push edi
lea ecx, [ebp - 0x10]
call fcn.0054fa35
push ebx
lea ecx, [ebp - 0x10]
call fcn.0054fa71
push edi
lea ecx, [ebp - 0x10]
call fcn.0054fa35
lea eax, [ebp - 0x14]
push eax
call fcn.00403854
pop ecx
push dword [ebp - 0x14]
call esi
test eax, eax
pop edi
je 0x44d35d
xor eax, eax
push 5
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push eax
jmp 0x44d36b
xor eax, eax
push 1
push eax
push eax
push dword [ebp - 0x10]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.0054f644
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0054f644
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x44d396
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x56ee8c
call fcn.004f85f0
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [esi + 0x69c]
call edi
test eax, eax
je 0x44d3ca
push dword [esi + 0x69c]
call fcn.0041f5a5
pop ecx
jmp 0x44d4ae
mov eax, dword [0x64a758]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x69c]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax - 8], ebx
jne 0x44d44f
test byte [esi + 0x2d], 0x10
je 0x44d40b
push dword [esi + 0x34]
lea eax, [ebp - 0x14]
push eax
call fcn.0041ecb5
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0054f78b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
jmp 0x44d46e
lea eax, [esi + 0xac]
lea ecx, [ebp - 0x10]
push eax
call fcn.0054f78b
mov ecx, dword [esi + 0xb0]
lea eax, [esi + 0xb0]
cmp dword [ecx - 8], ebx
je 0x44d473
push eax
lea eax, [ebp - 0x14]
push 0x5bbf9c
push eax
call fcn.0054f95d
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0054fa71
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
jmp 0x44d46e
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041ecb5
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0054f78b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.0054f644
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x44d499
push ebx
push ebx
push str.Folder_does_not_exist_
call fcn.0055d15a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0054f644
or eax, 0xffffffff
jmp 0x44d4b0
push dword [ebp - 0x10]
call fcn.0041f63a
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x10]
call fcn.0054f644
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44de57
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x56ef4f
call fcn.004f85f0
sub esp, 0xfc
push esi
mov esi, ecx
test byte [esi + 0xe0], 6
jne 0x44df7e
push ebx
xor ebx, ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x108]
push ebx
push ebx
call fcn.004632d9
mov eax, dword [0x65254c]
push 0x652550
lea ecx, [ebp - 0xec]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], 2
mov dword [ebp - 0xf0], eax
call fcn.0054f78b
mov eax, dword [0x652554]
mov ecx, dword [esi + 0x1a8]
mov dword [ebp - 0xe8], eax
lea eax, [esi + 0x1a8]
cmp dword [ecx - 8], ebx
jne 0x44deca
lea eax, [ebp - 0xbc]
push eax
call fcn.00466a7f
pop ecx
jmp 0x44ded6
push eax
lea ecx, [ebp - 0xbc]
call fcn.0054f78b
lea eax, [esi + 0x1b8]
push 0x5bcd0c
push eax
lea ecx, [ebp - 0xe4]
call fcn.00461b90
lea eax, [ebp + 8]
push eax
call fcn.00427871
pop ecx
mov eax, dword [eax]
push 1
push 1
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0041dbc0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.0054f644
push dword [ebp - 0x1c]
mov eax, dword [esi + 0x15c]
lea ecx, [ebp - 0x108]
push eax
call fcn.00463414
test eax, eax
je 0x44df34
or esi, 0xffffffff
jmp 0x44df5f
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44df2f
lea eax, [esi + 0x2a0]
mov ecx, esi
push eax
push dword [ebp - 0x1c]
call fcn.0044e28d
test eax, eax
jne 0x44df2f
or dword [esi + 0xe0], 4
xor esi, esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.0041dc2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.00463315
mov eax, esi
pop ebx
jmp 0x44df81
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x44e28d
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x56efa3
call fcn.004f85f0
sub esp, 0x1e0
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44e35d
xor ebx, ebx
lea ecx, [ebp - 0x1ec]
push ebx
call fcn.004d4a20
push ebx
lea ecx, [ebp - 0x1ec]
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.004d5b90
test al, al
jne 0x44e367
lea eax, [ebp - 0x10]
push eax
call fcn.00427871
pop ecx
mov eax, dword [eax]
push 1
push 1
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.0041dbc0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0054f644
push ebx
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.00432315
add esp, 0xc
test eax, eax
je 0x44e31b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24]
jmp 0x44e334
push ebx
lea ecx, [ebp - 0x1ec]
push dword [ebp - 0x20]
call fcn.004d5b90
test al, al
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24]
jne 0x44e362
call fcn.0041dc2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0x1ec], 0x584478
call fcn.004d4af0
lea ecx, [ebp - 0x1ec]
call fcn.004d4a40
or eax, 0xffffffff
jmp 0x44e3cf
call fcn.0041dc2d
mov ecx, 0xb4
mov eax, 0x140
push ecx
push eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.0041fc3b
mov ecx, dword [ebp + 0xc]
add esp, 0xc
call fcn.004d4af0
mov ecx, dword [ebp + 0xc]
call fcn.004d4a40
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x1ec]
push ebx
push eax
call fcn.004d5040
test al, al
jne 0x44e3a9
or ebx, 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0x1ec], 0x584478
call fcn.004d4af0
lea ecx, [ebp - 0x1ec]
call fcn.004d4a40
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x44e519
Capabilities:
Check if file exists

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44e58d
cmp dword [esp + 0x14], 0
jne 0x44e543
test byte [esi + 0xe1], 1
je 0x44e543
push 1
pop eax
jmp 0x44e634
push dword [esp + 0x10]
mov eax, dword [esi + 0x6d0]
lea edi, [esi + 0x6d0]
push dword [esp + 0x10]
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x44e595
mov ecx, esi
call fcn.0044e639
test eax, eax
je 0x44e58d
mov eax, dword [esi + 0x69c]
lea edi, [esi + 0x6b0]
push eax
call fcn.0041ee73
pop ecx
mov dword [edi], eax
mov eax, dword [esi]
push edx
mov dword [edi + 4], edx
push dword [edi]
mov ecx, esi
call dword [eax + 0x38]
or eax, 0xffffffff
jmp 0x44e634
push ebx
lea ebx, [esi + 0x6ac]
push 0x6524d4
mov ecx, ebx
call fcn.0054f7db
cmp dword [esi + 0x754], 0
jle 0x44e5b8
push 0x5bca3c
jmp 0x44e5c8
mov ecx, edi
call fcn.0044e4ee
test eax, eax
je 0x44e5cf
push 0x5bca30
mov ecx, ebx
call fcn.0054f7db
push dword [esi + 0x6fc]
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0x6f8]
call dword [eax + 0x38]
fild qword [esi + 0x6f0]
mov ebx, dword [esi]
fmul qword [0x584e18]
call fcn.004f888c
push edx
push eax
mov ecx, esi
call dword [ebx + 0x40]
mov ecx, edi
call fcn.0045fce2
mov edi, eax
pop ebx
test edi, edi
je 0x44e62b
push dword [edi + 0x58]
push dword [edi + 0x54]
call fcn.0043140d
pop ecx
mov edx, dword [esi]
pop ecx
mov dword [esi + 0x6c0], eax
push dword [edi + 0x58]
mov ecx, esi
push dword [edi + 0x54]
push eax
call dword [edx + 0x3c]
or byte [esi + 0xe1], 1
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x45048d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56f39f
call fcn.004f85f0
push ecx
mov eax, dword [0x64a758]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], eax
mov eax, dword [0x64a758]
and dword [ebp - 4], 0
mov dword [esi + 0x10], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x18], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x1c], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x20], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x24], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x28], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x2c], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x30], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x48], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x58], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x70], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x74], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x78], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x7c], eax
mov eax, dword [0x64a758]
mov dword [esi + 0x80], eax
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0xf
call fcn.004423ce
push 0
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 0x10
call fcn.004d4a20
mov ecx, esi
mov byte [ebp - 4], 0x11
mov dword [esi], 0x587698
call fcn.0044fe8a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x450565
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x56f46d
call fcn.004f85f0
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x587698
lea edi, [esi + 0x168]
mov dword [ebp - 4], 0x10
mov ecx, edi
mov dword [edi], 0x584478
call fcn.004d4af0
mov ecx, edi
call fcn.004d4a40
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0xf
call fcn.004426ce
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0xe
call fcn.0054f644
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 0xd
call fcn.0054f644
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xc
call fcn.0054f644
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 0xb
call fcn.0054f644
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0xa
call fcn.0054f644
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 9
call fcn.0054f644
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 8
call fcn.0054f644
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 7
call fcn.0054f644
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 6
call fcn.0054f644
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 5
call fcn.0054f644
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.0054f644
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 3
call fcn.0054f644
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.0054f644
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0054f644
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.0054f644
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.0054f644
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x450570
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x56f46d
call fcn.004f85f0
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x587698
lea edi, [esi + 0x168]
mov dword [ebp - 4], 0x10
mov ecx, edi
mov dword [edi], 0x584478
call fcn.004d4af0
mov ecx, edi
call fcn.004d4a40
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0xf
call fcn.004426ce
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0xe
call fcn.0054f644
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 0xd
call fcn.0054f644
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xc
call fcn.0054f644
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 0xb
call fcn.0054f644
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0xa
call fcn.0054f644
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 9
call fcn.0054f644
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 8
call fcn.0054f644
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 7
call fcn.0054f644
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 6
call fcn.0054f644
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 5
call fcn.0054f644
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.0054f644
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 3
call fcn.0054f644
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.0054f644
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0054f644
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.0054f644
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.0054f644
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x45127b
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x56f778
call fcn.004f85f0
push ecx
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x451343
xor edi, edi
mov esi, 0x3e8
push dword [ebp + 0xc]
call fcn.0041e100
cmp eax, 0xffffffff
pop ecx
jne 0x451343
push dword [ebp + 0x10]
push esi
call fcn.004214d5
pop ecx
test eax, eax
pop ecx
jne 0x4512cb
add edi, esi
cmp edi, 0x1388
jl 0x4512a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x451318
push str.If_you_are_previewing_the_downloading_video_audio__please_stop_previewing__then_click_OK_button.
lea ecx, [ebp - 0x10]
call fcn.0054f6b8
push 0x31
push 0x5bc5f8
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x45130c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0054f644
push 1
pop eax
jmp 0x45134a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0054f644
xor edi, edi
push dword [ebp + 0xc]
call fcn.0041e100
cmp eax, 0xffffffff
pop ecx
jne 0x451343
push dword [ebp + 0x10]
push esi
call fcn.004214d5
pop ecx
test eax, eax
pop ecx
jne 0x451347
add edi, esi
cmp edi, 0x2710
jge 0x451347
jmp 0x45131a
xor eax, eax
jmp 0x45134a
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x451358
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x56f78c
call fcn.004f85f0
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x45137a
push 0xfffffffffffffffe
jmp 0x45141d
push dword [ebp + 0x10]
call esi
test eax, eax
je 0x4513a6
cmp dword [ebp + 0x14], 0
je 0x451462
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0045127b
add esp, 0xc
test eax, eax
jl 0x451462
xor ebx, ebx
mov esi, 0x3e8
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041e124
add esp, 0xc
cmp eax, 0xffffffff
jne 0x45145e
push dword [ebp + 0x18]
push esi
call fcn.004214d5
pop ecx
test eax, eax
pop ecx
jne 0x4513df
add ebx, esi
cmp ebx, 0x1388
jl 0x4513ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x45142c
push str.If_you_are_previewing_the_downloading_video_audio__please_stop_previewing__then_click_OK_button.
lea ecx, [ebp + 0x14]
call fcn.0054f6b8
push 0x31
push 0x5bc5f8
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x451420
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0054f644
push 1
pop eax
jmp 0x451465
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0054f644
xor ebx, ebx
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041e124
add esp, 0xc
cmp eax, 0xffffffff
jne 0x45145e
push dword [ebp + 0x18]
push esi
call fcn.004214d5
pop ecx
test eax, eax
pop ecx
jne 0x451462
add ebx, esi
cmp ebx, 0x2710
jge 0x451462
jmp 0x45142e
xor eax, eax
jmp 0x451465
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret