joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442340
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x4424e5
cmp dword [esi + 0xc], 1
jne 0x442364
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x442380
mov ebx, dword [esp + 0x34]
jmp 0x442380
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x4423d4
xor edi, edi
test ebx, ebx
jbe 0x4423f9
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x4423a4
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x4423f9
add edi, 0x4000
cmp edi, ebx
jb 0x442394
jmp 0x4423f1
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x4424df
cmp byte [esi + 0x14], 0
je 0x4424df
cmp dword [esi + 0xc], 0
jne 0x4424df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ebx, eax
lea eax, [esi + 0x1e]
push eax
mov dword [esp + 0x24], edx
call fcn.00442d90
push edi
mov dword [esp + 0x18], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x442484
ja 0x44244c
cmp dword [esp + 0x14], ebp
jbe 0x442484
mov edi, dword [esp + 0x20]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x442484
jl 0x442463
cmp edx, 0xffffffff
ja 0x442484
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x28], eax
js 0x442484
jg 0x442476
cmp ecx, 0xffffffff
jbe 0x442484
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x5275b8
call fcn.0043d8a0
push 0
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x5275b8
call fcn.0043d900
test al, al
je 0x4424cf
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x442370
test eax, eax
jbe 0x442370
mov edi, dword [esi]
mov edx, dword [edi + 0x10]
push 0
mov ecx, esi
call edx
mov ecx, dword [esp + 0x14]
xor ebx, ebx
sub eax, ecx
sbb edx, ebx
push edx
mov edx, dword [edi + 0xc]
push eax
mov ecx, esi
call edx
jmp 0x442370
lea eax, [esi + 0x1e]
push eax
push 0
mov ecx, 0x5275b8
call fcn.0043db40
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x4426e0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 1
push edi
mov edi, dword [esp + 0x18]
cmp dword [esi + 0xc], ebp
jne 0x44270c
cmp edi, 0x4e20
jbe 0x442701
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4427ae
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x442760
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x442744
cmp eax, 3
jne 0x442760
cmp edi, 0x4e20
jbe 0x442760
push 0x4e20
push ebx
mov ecx, esi
call fcn.004426e0
pop edi
pop esi
pop ebp
pop ebx
ret 8
cmp dword [esi + 0xc], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x44277b
call ebp
cmp eax, 0x6d
jne 0x44277b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
cmp dword [esi + 0xc], 0
jne 0x4427a4
cmp edi, 0x8000
jbe 0x4427a4
call ebp
cmp eax, 0x21
jne 0x4427a4
push 0x8000
push ebx
mov ecx, esi
call fcn.004426e0
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x442d00
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push 0x800
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00451ab0
movzx edx, word [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x442d66
cmp eax, 5
je 0x442d66
xor eax, eax
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004df824
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
xor ecx, esp
mov eax, 1
call fcn.004df824
add esp, 0x1004
ret 4

Function at 0x442d90
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
push esi
push 0x800
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.004513e0
lea edx, [esp + 0xc]
push edx
movzx edx, word [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x18]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x24]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x442e27
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x10]
ja 0x442e27
push 1
push esi
push esi
push eax
call fcn.004e07b0
mov ecx, dword [esp + 4]
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.004df824
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x101c]
pop esi
xor ecx, esp
xor eax, eax
xor edx, edx
call fcn.004df824
add esp, 0x101c
ret 4
Function at 0x442e50
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
push 0x800
lea ecx, [esp + 0x210]
push ecx
push eax
call fcn.00451ab0
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x442f54
mov ecx, 0x4faeb4
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442eda
test dx, dx
je 0x442ed6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442eda
add eax, 4
add ecx, 4
test dx, dx
jne 0x442eb4
xor eax, eax
jmp 0x442edf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x442f38
mov ecx, 0x4faea8
lea eax, [esp]
jmp 0x442ef0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442f16
test dx, dx
je 0x442f12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442f16
add eax, 4
add ecx, 4
test dx, dx
jne 0x442ef0
xor eax, eax
jmp 0x442f1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x442f38
xor eax, eax
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004df824
add esp, 0x1210
ret 4
mov eax, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004df824
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor ecx, esp
xor al, al
call fcn.004df824
add esp, 0x1210
ret 4

Function at 0x442fd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push edi
mov edi, dword [esp + 0x1014]
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x443021
push 0x800
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00451b70
test al, al
je 0x44301f
lea ecx, [esp + 0xc]
push ecx
call ebx
jmp 0x443021
mov eax, esi
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x1004
ret 4

Function at 0x443040
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
mov esi, dword [esp + 0x1014]
push edi
mov edi, dword [esp + 0x101c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x4430a0
push 0x800
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00451b70
test al, al
je 0x4430a0
push edi
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
setne al
jmp 0x4430a2
mov al, bl
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x1004
ret 8
Function at 0x4430c0
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x201c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x44313e
push 0x800
lea eax, [esp + 0x1014]
push eax
push esi
call fcn.00451b70
test al, al
je 0x44313e
push 0x800
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.00451b70
test al, al
je 0x44313e
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1014]
push eax
call ebp
test eax, eax
setne al
jmp 0x443140
mov al, bl
mov ecx, dword [esp + 0x2010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x2004
ret 8

Function at 0x443160
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x4431b6
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00451b70
test al, al
je 0x4431b6
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x4431b8
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x1004
ret 4

Function at 0x4431e0
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x443236
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00451b70
test al, al
je 0x443236
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x443238
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x1004
ret 4

Function at 0x443540
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0x10], eax
jbe 0x443598
mov dword [ecx + 0x10], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x443840
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x1004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x44389c
push esi
call fcn.00442fd0
cmp eax, 0xffffffff
jne 0x4438b8
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00451b70
test al, al
je 0x4438b8
push 0
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
je 0x4438b8
cmp byte [esp + 0x1014], 0
je 0x4438b4
mov edx, dword [esp + 0x1018]
push edx
push esi
call fcn.00443040
xor eax, eax
jmp 0x4438d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4438cd
cmp eax, 3
mov eax, 1
jne 0x4438d2
mov eax, 2
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004df824
add esp, 0x1004
ret 0xc
Function at 0x444de0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
push ebp
push esi
mov esi, dword [esp + 0x126c]
push edi
mov edi, dword [esp + 0x1268]
cmp edi, 0xffffffff
jne 0x444e8f
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x444ec3
push 0x800
lea ecx, [esp + 0x264]
push ecx
push ebx
call fcn.00451b70
test al, al
je 0x444e5c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x444ec3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x444e78
cmp eax, 3
je 0x444e78
cmp eax, 0x12
je 0x444e78
mov eax, 1
jmp 0x444e7a
xor eax, eax
mov byte [esi + 0x1044], al
mov dword [esi + 0x1040], 0
jmp 0x444fa2
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x444ec3
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne dl
mov byte [esi + 0x1044], dl
mov dword [esi + 0x1040], 0
jmp 0x444fa2
push 0x800
push ebx
push esi
call fcn.00466b20
push 0x800
lea eax, [esp + 0x40]
push eax
push esi
call fcn.00451310
mov ecx, dword [esp + 0x2c]
push 1
push 0
push 0
push ecx
call fcn.004e07b0
mov ecx, dword [esp + 0x30]
xor ebx, ebx
add eax, ecx
mov ecx, dword [esp + 0x18]
adc edx, ebx
mov dword [esi + 0x1000], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1004], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1028], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1008], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x102c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1034], eax
mov dword [esi + 0x1030], edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x24]
mov dword [esi + 0x1038], ecx
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x103c], edx
call fcn.00467f40
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x1018]
call fcn.00467f40
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0x1020]
call fcn.00467f40
test dword [esp + 0x10], 0x400
je 0x444f94
cmp dword [esp + 0x34], 0xa0000003
jne 0x444f94
lea eax, [ebx + 1]
jmp 0x444f96
xor eax, eax
mov byte [esi + 0x100e], al
mov dword [esi + 0x1040], ebx
mov ecx, dword [esp + 0x1260]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x1254
ret 0xc
Function at 0x449420
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd4]
push 0x4000
push 0
push eax
call fcn.004e0730
add esp, 0xc
cmp byte [esp + 8], 0
je 0x449511
cmp byte [esi + 0x6135], 0
jne 0x449511
mov ecx, dword [esi + 0xe8]
mov eax, dword [esi + 0x6130]
shr ecx, 2
cmp eax, ecx
ja 0x449511
xor edx, edx
test eax, eax
jbe 0x449553
push ebx
push edi
jmp 0x449480
mov eax, dword [esi + 0xd0]
movzx edi, byte [eax + edx + 1]
lea ecx, [eax + edx]
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 2]
imul eax, eax, 0x2773
xor eax, edi
mov edi, dword [esi + 0xd8]
imul eax, eax, 0x2773
xor eax, ecx
mov ecx, eax
imul eax, eax, 0x2773
and ecx, 0x3ffff
xor ebx, ebx
mov word [edi + ecx*2], bx
mov ecx, dword [esi + 0xd0]
movzx ecx, byte [ecx + edx + 3]
mov edi, dword [esi + 0xdc]
xor ecx, eax
mov eax, ecx
imul ecx, ecx, 0x2773
and eax, 0x3ffff
mov dword [edi + eax*4], ebx
mov eax, dword [esi + 0xd0]
movzx eax, byte [eax + edx + 4]
xor eax, ecx
and eax, dword [esi + 0xec]
mov ecx, dword [esi + 0xe0]
inc edx
mov dword [ecx + eax*4], ebx
cmp edx, dword [esi + 0x6130]
jb 0x449480
pop edi
pop ebx
pop esi
ret 4
mov edx, dword [esi + 0xd8]
push 0x80000
push 0
push edx
call fcn.004e0730
mov eax, dword [esi + 0xdc]
push 0x100000
push 0
push eax
call fcn.004e0730
mov ecx, dword [esi + 0xe8]
mov edx, dword [esi + 0xe0]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call fcn.004e0730
add esp, 0x24
pop esi
ret 4
Function at 0x44bb70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xc0]
push ebp
xor edx, edx
push esi
add ebx, 0xffffff88
push edi
add eax, 2
lea edi, [esp + 0x20]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov edi, edi
cmp edx, ebx
jge 0x44bcd3
lea eax, [esp + 0x48]
sub eax, 2
lea ecx, [eax + 3]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x48]
sub ecx, eax
add ecx, 0xfffffffd
mov dword [esp + 0x3c], ecx
mov ecx, eax
neg ecx
lea esi, [esp + ecx + 0x48]
mov dword [esp + 0x44], esi
lea esi, [esp + ecx + 0x49]
mov dword [esp + 0x30], esi
lea esi, [esp + 0x48]
sub esi, eax
lea eax, [esp + ecx + 0x4a]
mov ecx, dword [esp + 0x14]
sub ebx, edx
mov dword [esp + 0x40], eax
dec ebx
mov eax, 0x88888889
mul ebx
dec esi
mov ebp, edx
shr ebp, 0xa
mov dword [esp + 0x2c], esi
mov esi, dword [edi]
mov dword [esp + 0x10], ecx
inc ebp
mov eax, dword [esp + 0x10]
xor edi, edi
lea ebx, [ebx]
movzx edx, byte [eax - 2]
mov cl, byte [eax - 1]
sub dl, cl
mov byte [esp + edi + 0x48], dl
movzx edx, byte [eax]
sub dl, cl
mov byte [esp + edi + 0x49], cl
mov byte [esp + edi + 0x4a], dl
add edi, 3
add eax, 3
cmp edi, 0x78
jl 0x44bc30
mov ecx, dword [esp + 0x34]
mov edi, 0x27
mov edi, edi
mov eax, dword [esp + 0x40]
movzx edx, byte [eax + ecx]
mov eax, dword [esp + 0x2c]
sub dl, byte [eax + ecx]
add ecx, 3
movsx eax, dl
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, dword [esp + 0x44]
mov al, byte [edx + ecx - 3]
mov edx, dword [esp + 0x3c]
sub al, byte [edx + ecx - 3]
movsx eax, al
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + ecx - 3]
sub dl, byte [ecx - 3]
movsx eax, dl
cdq
xor eax, edx
sub eax, edx
add eax, esi
sub edi, 1
lea esi, [eax + ebx]
jne 0x44bc60
add dword [esp + 0x10], 0x780
sub ebp, 1
jne 0x44bc24
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [edi], esi
inc dword [esp + 0x14]
inc edx
add edi, 4
cmp edx, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
jle 0x44bbc0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, ecx
ja 0x44bd1d
cmp eax, edx
ja 0x44bd1d
xor eax, eax
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.004df824
add esp, 0xb4
ret 8
cmp edx, ecx
mov ecx, dword [esp + 0xb0]
sbb eax, eax
neg eax
xor ecx, esp
inc eax
call fcn.004df824
add esp, 0xb4
ret 8
Function at 0x451470
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea edx, [esp + 4]
push edx
xor ecx, ecx
push 0x1a
push ecx
mov word [esi], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4514e4
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4514e4
cmp word [esi], 0
je 0x4514e4
push edi
push esi
call fcn.00450c80
push edi
push 0x4fafa0
push esi
call fcn.00466ba0
push esi
call fcn.00443510
test al, al
jne 0x451511
cmp byte [esp + 0x10], al
je 0x4514e0
push 0
push 0
push esi
call fcn.00443840
test eax, eax
sete al
test al, al
jne 0x451511
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.00451140
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x45150c
cmp word [esi + 2], 0x3a
jne 0x451509
add esi, 8
cmp eax, esi
jb 0x45150c
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4

Function at 0x451530
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x10]
push ecx
push 1
xor eax, eax
push eax
push str.SoftwareWinRARPaths
push SysReAllocString
mov word [esi], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x451588
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.AppData
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x451598
push esi
call fcn.00443510
test al, al
jne 0x4515a4
mov eax, dword [esp + 0x18]
push eax
mov eax, esi
call fcn.00451470
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x451b70
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [esp + 0x1010]
movzx eax, word [edi]
test ax, ax
jne 0x451ba7
xor al, al
jmp 0x451da5
push eax
call fcn.004667c0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451bb2
push ebx
sub eax, edx
sar eax, 1
push edi
mov ebx, eax
call fcn.00451a60
test al, al
je 0x451c9c
movzx eax, word [edi]
push eax
call fcn.004667c0
movzx eax, ax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x451c2b
cmp word [edi + 2], 0x3a
jne 0x451c2b
add ebx, 4
cmp dword [esp + 0x101c], ebx
jbe 0x451da2
push 4
push 0x4fb020
push esi
call fcn.004e3388
add esp, 0xc
sub esi, edi
mov eax, edi
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x451c15
mov al, 1
jmp 0x451da4
cmp word [edi], 0x5c
jne 0x451da2
add edi, 2
cmp word [edi], 0x5c
jne 0x451da2
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x451da2
push 4
push 0x4fb020
push esi
call fcn.004e3388
mov eax, 0x4fb018
mov ecx, esi
add esp, 0xc
sub ecx, eax
lea edx, [ecx + 8]
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x451c70
sub esi, edi
mov eax, edi
lea edx, [esi + 0xe]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x451c86
mov al, 1
jmp 0x451da4
lea edx, [esp + 0xc]
push edx
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x451da2
cmp eax, 0x7ff
ja 0x451da2
movzx eax, word [edi]
push eax
call fcn.00450c50
test al, al
je 0x451d19
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x451da2
push 4
push 0x4fb020
push esi
call fcn.004e3388
push 2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esi + 8]
push edx
call fcn.004e3388
add esp, 0x18
sub esi, edi
mov eax, edi
lea edx, [esi + 0xc]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x451d03
mov al, 1
jmp 0x451da4
push 0x800
lea eax, [esp + 0x10]
push eax
call fcn.00450c80
lea eax, [esp + 0xc]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451d30
sub eax, edx
sar eax, 1
lea ecx, [eax + ebx + 4]
mov ebx, dword [esp + 0x101c]
cmp ebx, ecx
jbe 0x451da2
push 4
push 0x4fb020
push esi
call fcn.004e3388
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
sub edx, ecx
add esp, 0xc
add edx, 8
jmp 0x451d70
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x451d70
cmp word [edi], 0x2e
jne 0x451d96
movzx edx, word [edi + 2]
push edx
call fcn.00450c50
test al, al
je 0x451d96
add edi, 4
push ebx
push edi
push esi
call fcn.00466ba0
mov al, 1
jmp 0x451da4
xor al, al
pop ebx
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004df824
add esp, 0x1004
ret 0xc