joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48f4e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0041b660
mov dword [esp + 0x18], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year__.2.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_year__.0
test edi, edi
je 0x41ca2a
lea ebx, [edi + 0x28]
jmp 0x41ca2c
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x41ca3d
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x41ca4d
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x41ca80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4904c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0041b6d0
mov dword [esp + 0x18], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month__.2.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_month__.0
test edi, edi
je 0x41cada
lea ebx, [edi + 0x28]
jmp 0x41cadc
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x41caed
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x41cafd
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x423eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x490d89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov ecx, dword [esp + 0x40]
push esi
push 0x13
mov dword [esp + 8], 0
mov edx, dword [ecx]
mov esi, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
push edx
push esi
call fcn.004211c0
add esp, 0x10
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x30]
mov dword [esp + 4], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x427040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4911a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov ecx, dword [esp + 0x30]
push esi
push 0x14
mov dword [esp + 8], 0
mov edx, dword [ecx]
mov esi, dword [esp + 0x34]
lea eax, [esp + 0xc]
push eax
push edx
push esi
call fcn.00425700
add esp, 0x10
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x427ee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48eea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
lea ecx, [esp + 0x14]
call fcn.0045ec49
mov dword [esp + 0x28], 0
mov edi, dword [0x4bcdd0]
mov ecx, 0x4bcea8
mov dword [esp + 0xc], edi
call fcn.004020d0
mov ebx, dword [esp + 0x30]
mov esi, eax
mov eax, dword [ebx]
cmp esi, dword [eax + 0xc]
jae 0x427f51
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x427f55
cmp byte [eax + 0x14], 0
je 0x427f55
call fcn.0045ed25
cmp esi, dword [eax + 0xc]
jae 0x427f5b
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x427f57
xor ecx, ecx
jmp 0x427f39
mov esi, ecx
test esi, esi
jne 0x427fad
test edi, edi
je 0x427f63
mov esi, edi
jmp 0x427fad
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00427db0
add esp, 8
cmp eax, 0xffffffff
jne 0x427f93
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.00472615
push 0x4a7ba4
lea ecx, [esp + 0x18]
push ecx
call fcn.00473358
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x4bcdd0], esi
call fcn.00402140
push esi
call fcn.0045edea
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0045ec71
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x428fd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x18], 8
mov dword [esp], 4
jb 0x428fe9
mov eax, dword [eax + 4]
jmp 0x428fec
add eax, 4
lea edx, [esp]
push edx
lea edx, [esp + 8]
push edx
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429016
cmp dword [esp + 0xc], 4
je 0x429016
mov eax, 0x3bc6
push str.RegQueryValueEx
push eax
call fcn.00428e90
mov eax, dword [esp + 0xc]
add esp, 0x10
ret 4
Function at 0x42a110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491661
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 2
mov edi, dword [esi + 0x30]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x42a156
mov eax, dword [edi]
test eax, eax
je 0x42a14d
push eax
call ebp
push edi
call fcn.00471e4a
add esp, 4
mov byte [esp + 0x18], 1
cmp dword [esi + 0x20], 8
jb 0x42a16d
mov eax, dword [esi + 0xc]
push eax
call fcn.00471e4a
add esp, 4
xor eax, eax
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], 0
mov word [esi + 0xc], ax
mov byte [esp + 0x18], al
mov eax, dword [esi + 4]
or edi, 0xffffffff
cmp eax, edi
je 0x42a195
push eax
call ebp
mov dword [esi + 4], edi
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x10]
pop edi
mov dword [esi], vtable.Nvidia::Logging::ILogManager.0
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x42a330
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4916b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x74]
mov ebx, dword [edi + 0x14]
xor ebp, ebp
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x74], eax
jb 0x42a370
mov eax, dword [eax]
push ebp
push ebp
push ebp
push ebp
push ebx
push eax
push ebp
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x6c], 0
test esi, esi
jle 0x42a3d0
push esi
call fcn.0045e9da
add esp, 4
push eax
lea ecx, [esp + 0x14]
call fcn.0042a0c0
cmp dword [edi + 0x18], 8
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], ebp
jb 0x42a3bb
mov eax, dword [eax]
push 0
push 0
push esi
push ebp
push ebx
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [eax]
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42a41a
cmp dword [esp + 0x18], esi
jne 0x42a41a
mov dword [esp + 0x6c], 0xffffffff
push ebp
call fcn.0047247a
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret 4
push 0x14
push str.Error_writing_to_log
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
call fcn.0040fc60
mov byte [esp + 0x6c], 1
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x40]
call fcn.00413060
push 0x4a925c
lea eax, [esp + 0x40]
push eax
call fcn.00473358
int3
Function at 0x42a470
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x48fd38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov ecx, dword [ecx]
push ebx
lea eax, [esp + 4]
push eax
xor ebx, ebx
push ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x42a4e6
push 0x17
push str.Cant_get_log_file_size
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.0040fc60
mov dword [esp + 0x58], ebx
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x2c]
call fcn.00413060
push 0x4a925c
lea eax, [esp + 0x2c]
push eax
call fcn.00473358
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret
Function at 0x42e880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x30], 0
mov ebx, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov edi, dword [esp + 0x38]
mov ecx, ebx
sub ecx, ebp
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x42e8fe
cmp ebp, ebx
jbe 0x42e8d2
call fcn.00473348
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov ebp, dword [esi]
lea eax, [esp + 0x3c]
push eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push edi
push ebx
push ebp
mov ecx, esi
call fcn.0042db90
jmp 0x42e94e
jae 0x42e94e
cmp ebp, ebx
jbe 0x42e909
call fcn.00473348
mov ebp, dword [esi + 0xc]
mov edx, dword [esi]
mov dword [esp + 0x18], edx
cmp ebp, dword [esi + 0x10]
jbe 0x42e91c
call fcn.00473348
mov eax, dword [esi]
push edi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebp
call fcn.0040bb40
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 4]
push ebx
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.00428370
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.00418c10
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x68

Function at 0x42f120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491e98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov edx, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push eax
push edi
push 0
push ecx
push edx
mov dword [esp + 0x28], 0
call fcn.004089f0
mov esi, eax
add esp, 0x20
test esi, esi
jne 0x42f1b4
mov dword [esp + 0xc], VariantCopy
mov dword [esp + 0x10], 0xf003f
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], edi
call fcn.0042ed50
mov dword [esp + 0x1c], 0xffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x430770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48eea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
lea ecx, [esp + 0x14]
call fcn.0045ec49
mov dword [esp + 0x28], 0
mov edi, dword [0x4bcdf4]
mov ecx, 0x4bceb0
mov dword [esp + 0xc], edi
call fcn.004020d0
mov ebx, dword [esp + 0x30]
mov esi, eax
mov eax, dword [ebx]
cmp esi, dword [eax + 0xc]
jae 0x4307e1
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x4307e5
cmp byte [eax + 0x14], 0
je 0x4307e5
call fcn.0045ed25
cmp esi, dword [eax + 0xc]
jae 0x4307eb
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x4307e7
xor ecx, ecx
jmp 0x4307c9
mov esi, ecx
test esi, esi
jne 0x43083d
test edi, edi
je 0x4307f3
mov esi, edi
jmp 0x43083d
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004305d0
add esp, 8
cmp eax, 0xffffffff
jne 0x430823
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.00472615
push 0x4a7ba4
lea ecx, [esp + 0x18]
push ecx
call fcn.00473358
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x4bcdf4], esi
call fcn.00402140
push esi
call fcn.0045edea
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0045ec71
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x431b70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x492186
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 1
call fcn.00431ab0
mov ecx, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 4], edx
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
xor ebx, ebx
push ebx
lea eax, [esp + 0x30]
mov edi, 7
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.0040f880
mov byte [esp + 0x18], 2
push 0xffffffffffffffff
lea ecx, [esi + 0x2c]
push ebx
lea eax, [esp + 0x4c]
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.0040f880
mov byte [esp + 0x18], 3
mov ecx, dword [esp + 0x60]
mov dword [esi + 0x48], ecx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x40], 8
jb 0x431c17
mov edx, dword [esp + 0x2c]
push edx
call fcn.00471e4a
add esp, 4
xor eax, eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], ax
mov dword [esp + 0x18], 0xffffffff
cmp dword [esp + 0x5c], 8
jb 0x431c42
mov ecx, dword [esp + 0x48]
push ecx
call fcn.00471e4a
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x5c], edi
pop edi
xor edx, edx
mov eax, esi
mov dword [esp + 0x54], ebx
pop esi
mov word [esp + 0x40], dx
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x44
Function at 0x43dbd8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48ed70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [esp + 0x20], 0
sub esp, 0xc
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call fcn.00456c70
mov byte [esp + 0x2c], 1
mov byte [esp + 0x2c], 0
lea ecx, [esp + 0x14]
call fcn.0043db20
mov byte [esp + 0x20], 2
mov ecx, dword [esp + 0x28]
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea eax, [esp + 8]
push eax
push ecx
mov ecx, esi
call edx
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0xc]
push eax
call fcn.0047247a
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0047247a
mov ecx, dword [esp + 0x20]
add esp, 8
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0x14

Function at 0x43dc60
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x493367
push eax
mov dword fs:[0], esp
sub esp, 0x2a4
push ebx
push ebp
push esi
push edi
call fcn.00402a50
push 3
call fcn.00402ab0
push 0x28
mov dword [0x4bced8], eax
call fcn.00402ab0
push 2
mov dword [0x4bced4], eax
call fcn.00402ab0
push 5
mov dword [0x4bced0], eax
call fcn.00402ab0
push 0x15
mov dword [0x4bcecc], eax
call fcn.00402ab0
push 0x16
mov dword [0x4bcec8], eax
call fcn.00402ab0
push 0x17
mov dword [0x4bcec4], eax
call fcn.00402ab0
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
xor ebp, ebp
add esp, 0x1c
mov dword [0x4bcec0], eax
mov dword [0x4bceb8], ebp
mov dword [0x4bcebc], ebp
xor edi, edi
push ebp
push edi
lea eax, [esp + 0xb0]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43dddd
push edi
lea ecx, [esp + 0x2c]
push 0x49ac70
push ecx
call ebx
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00456bf0
mov dword [esp + 0x2bc], ebp
lea ecx, [esp + 0x1c]
call fcn.00456bf0
mov dword [esp + 0x2bc], 2
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x14]
call fcn.004571f0
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x20]
call fcn.004571f0
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x4bcf94
call fcn.004085a0
xor esi, esi
mov edi, edi
cmp dword [esi + 0x4b74bc], edi
jne 0x43dda8
mov edx, dword [esi + 0x4b74c0]
push edx
lea ecx, [esp + 0x14]
call fcn.004571f0
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x20]
call fcn.004571f0
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x4bcf94
call fcn.004085a0
add esi, 8
cmp esi, 0x28
jb 0x43dd70
mov dword [esp + 0x2bc], 3
mov edx, dword [esp + 0x1c]
push edx
call fcn.0047247a
mov dword [esp + 0x2c0], 0xffffffff
mov eax, dword [esp + 0x14]
push eax
call fcn.0047247a
add esp, 8
inc edi
cmp edi, 0x40
jl 0x43dcf1
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, dword [esp + 0x2b4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2b0
ret
Function at 0x4429b0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x493a1c
push eax
mov dword fs:[0], esp
sub esp, 0x234
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x3c]
push eax
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [esp + 0x38]
add edi, 0xfffffffe
jmp 0x4429f0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4429f0
mov ecx, 6
mov esi, str._version.dll
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x38]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp + 4], eax
test eax, eax
je 0x442ab1
call fcn.0043a9f0
cmp dword [eax + 0x1c], 6
jl 0x442b5d
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push str.._sourcesmain.cpp
call fcn.00413880
mov dword [esp + 0x264], 0
push 0x477
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
push str.CVersionDll::Load
call fcn.00413880
mov byte [esp + 0x284], 1
lea ecx, [esp + 0x74]
lea edx, [esp + 0x4b]
lea eax, [esp + 0x68]
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x50], eax
lea edx, [esp + 0x4c]
lea eax, [esp + 0x54]
push ecx
mov dword [esp + 0x50], str.Loaded_version.dll_from
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], vtable.Nvidia::Logging::ChainLoggable_class_Nvidia::Logging::Chain_wchar_t_const_____260___class_Nvidia::Logging::Chain_char_const_____24___class_Nvidia::Logging::Chain_struct_Nvidia::Logging::NullType__struct_Nvidia::Logging::NullType____.0
mov dword [esp + 0x64], eax
push 6
jmp 0x442b41
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0043a9f0
cmp dword [eax + 0x1c], 4
jl 0x442b5d
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push str.._sourcesmain.cpp
call fcn.00413880
mov dword [esp + 0x264], 2
push 0x47c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push str.CVersionDll::Load
call fcn.00413880
mov byte [esp + 0x284], 3
lea eax, [esp + 0x68]
lea edx, [esp + 0x4b]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x6c], edx
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x54]
push eax
mov dword [esp + 0x60], str.version.dll_module_not_loaded_due_to_Windows_error_code
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x50], vtable.Nvidia::Logging::ChainLoggable_class_Nvidia::Logging::Chain_unsigned_long_int__class_Nvidia::Logging::Chain_char_const_____56___class_Nvidia::Logging::Chain_struct_Nvidia::Logging::NullType__struct_Nvidia::Logging::NullType____.0
mov dword [esp + 0x54], edx
push 4
mov byte [esp + 0x53], 0
call fcn.0043a9f0
mov dword [esp + 0x28c], 0xffffffff
mov ecx, eax
call fcn.0043a890
mov ecx, dword [esp + 0x240]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x240
ret
Function at 0x448350
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.004723ca
mov ecx, dword [esp + 0x20]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x44837b
xor eax, eax
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44838a
mov eax, 1
pop ecx
ret

Function at 0x44a00e
Capabilities:
Resume thread
Suspend thread
Terminate thread

Disassembly:
cmp dword [0x4bcfc4], 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_EndDialog]
push esi
mov esi, ecx
je 0x44a01b
mov eax, dword [esi + 4]
push 0
push eax
call ebx
cmp dword [0x4bcfb8], 0
je 0x44a05f
mov ecx, dword [esi + 4]
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
test dword [0x4b74ac], 0x100
je 0x44a09c
mov ecx, esi
call fcn.00449f40
test eax, eax
jne 0x44a09c
push eax
mov eax, dword [0x4bcfb8]
lea edx, [eax + eax*4]
mov eax, dword [esi + 4]
add edx, edx
push edx
push 1
push eax
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x4bcf10], 1
je 0x44a0c3
push edi
mov edi, dword [0x4bcd98]
test edi, edi
je 0x44a0c2
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
test dword [0x4b74ac], 0x100
je 0x44a0a7
mov ecx, esi
call fcn.00449f40
test eax, eax
jne 0x44a0a7
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esi + 4]
push 0
push ecx
call ebx
pop esi
pop ebx
ret
push 0x16
push edi
mov dword [0x4bcfb4], 1
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 4]
push 0
push edx
call ebx
pop edi
pop esi
pop ebx
ret