joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443d60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51ed96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004fefd0
xor edi, edi
lea ecx, [esi + 0xef0]
mov dword [esp + 0x18], edi
call fcn.00445c50
push edi
lea ecx, [esi + 0x2480]
mov byte [esp + 0x1c], 1
call fcn.004e7c10
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x24cc], al
mov dword [esi + 0x24d0], edi
mov dword [esi + 0x24d4], edi
mov dword [esi + 0x24d8], edi
mov dword [esi + 0x247c], edi
mov dword [esi + 0x24c0], edi
mov dword [esi + 0x24bc], edi
mov dword [esi + 0x24c8], edi
mov dword [esi], 0x52573c
mov dword [esi + 4], 0x525728
mov dword [esi + 0x28], 0x525724
mov dword [esi + 0x30], 0x525714
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x443d78
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51ed96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004fefd0
xor edi, edi
lea ecx, [esi + 0xef0]
mov dword [esp + 0x18], edi
call fcn.00445c50
push edi
lea ecx, [esi + 0x2480]
mov byte [esp + 0x1c], 1
call fcn.004e7c10
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x24cc], al
mov dword [esi + 0x24d0], edi
mov dword [esi + 0x24d4], edi
mov dword [esi + 0x24d8], edi
mov dword [esi + 0x247c], edi
mov dword [esi + 0x24c0], edi
mov dword [esi + 0x24bc], edi
mov dword [esi + 0x24c8], edi
mov dword [esi], 0x52573c
mov dword [esi + 4], 0x525728
mov dword [esi + 0x28], 0x525724
mov dword [esi + 0x30], 0x525714
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x443e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51edb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x52573c
mov dword [edi + 4], 0x525728
mov dword [edi + 0x28], 0x525724
mov dword [edi + 0x30], 0x525714
mov ebx, dword [edi + 0x24d4]
mov esi, dword [edi + 0x24d0]
cmp esi, ebx
mov dword [esp + 0x18], 1
je 0x443eb8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esi]
mov edx, dword [0x539120]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x443eb0
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x443eb0
mov eax, dword [esi]
sub eax, 0xc
push eax
call fcn.0051d79a
add esp, 4
add esi, 4
cmp esi, ebx
jne 0x443e89
pop ebp
mov eax, dword [edi + 0x24d0]
push eax
call fcn.0051d79a
xor ebx, ebx
add esp, 4
lea ecx, [edi + 0x2480]
mov dword [edi + 0x24d0], ebx
mov dword [edi + 0x24d4], ebx
mov dword [edi + 0x24d8], ebx
call fcn.004e7c60
lea ecx, [edi + 0xef0]
mov byte [esp + 0x18], bl
call fcn.00445da0
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.004ff300
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x445c50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51ee68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0050b490
lea edi, [esi + 0x24]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.004f8b10
push ebx
push ebx
push ebx
lea eax, [esi + 0x30]
push ebx
push eax
mov dword [esi], 0x5257c8
mov dword [edi], 0x5257c4
call dword [sym.imp.USER32.dll_SetRect]
push 0xffffff
mov dword [esi + 0x44], 0xffffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x40], eax
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x48]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x250]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll_wcscpy]
lea ecx, [esi + 0x14ac]
push str.BG_EDIT
push ecx
mov dword [esi + 0x458], 0x717171
mov dword [esi + 0x2c], ebx
call edi
lea edx, [esi + 0x14ec]
push str.LeftPad
push edx
call edi
lea eax, [esi + 0x152c]
push str.RightPad
push eax
call edi
add esp, 0x18
mov ecx, 0x412
xor eax, eax
lea edi, [esi + 0x45c]
mov dword [esi + 0x1578], ebx
mov dword [esi + 0x156c], ebx
mov dword [esi + 0x1570], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x1584], ebx
mov dword [esi + 0x157c], 8
mov dword [esi + 0x1580], 5
mov dword [esi + 0x14a8], ebx
mov dword [esi + 0x1588], 0x12
mov dword [esi + 0x1574], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x44693e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51eeab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 0x20]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov cl, byte [esp + 0x30]
xor ebx, ebx
push 0x1c
mov dword [esp + 0x18], esi
mov byte [esi + 0x14], al
mov byte [esi + 0x15], cl
mov byte [esi + 0x1c], bl
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x18], 1
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
cmp dword [0x57a804], ebx
jne 0x446992
mov dword [0x57a804], edi
mov dword [edi], ebx
mov edx, dword [0x57a804]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x57a800]
inc ecx
mov dword [0x57a800], ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp ebp, ebx
je 0x4469b6
push ebp
call fcn.0051d79a
add esp, 4
mov edi, dword [0x57a804]
push 0x1c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], edi
mov dword [eax + 0x18], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x18]
add esp, 4
mov dword [eax + 8], eax
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], ebx
push edi
mov dword [esi], 0x5257dc
call fcn.004a8aa0
mov ecx, eax
call fcn.004a8e80
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc

Function at 0x447ab0
Capabilities:
Move file

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
push 0
push str.user.dat
mov ecx, 0x56e210
stosw word es:[edi], ax
call fcn.0040c500
mov esi, eax
push str.user.dat
lea eax, [esp + 0xc]
push 0x103
push eax
call fcn.0043f720
push 0
push esi
call fcn.0043f630
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
add esp, 0x14
test eax, eax
jne 0x447b12
lea ecx, [esp + 8]
push esi
push ecx
call edi
push str.history.dat
lea edx, [esp + 0xc]
push 0x103
push edx
call fcn.0043f720
add esp, 0xc
mov ecx, 0x56e210
push 0
push str.history.dat
call fcn.0040c500
mov esi, eax
push 0
push esi
call fcn.0043f630
add esp, 8
test eax, eax
jne 0x447b53
lea eax, [esp + 8]
push esi
push eax
call edi
pop edi
pop esi
add esp, 0x208
ret

Function at 0x44de70
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, ecx
push 0
push str.secache.ini
mov ecx, 0x56e210
lea esi, [edi + 0x2c]
call fcn.0040c500
push eax
push 0x53a4a4
push 0x103
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 1
add edi, 0x28
push esi
push edi
call fcn.00496280
add esp, 0x1c
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
ret
Function at 0x44e640
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x2c]
push edi
call ebx
lea eax, [esi + 0x28]
push 0
push eax
call fcn.00496470
add esp, 8
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call ebx
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x44e68c
push 1
push str.HasLastPage
push str.Main
call fcn.0040ec00
add esp, 0xc
ret

Function at 0x450160
Capabilities:
Parse url

Disassembly:
mov eax, 0x1494
call fcn.0051d7f0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14a4]
test esi, esi
push edi
je 0x4502c9
cmp word [esi], 0
je 0x4502c9
mov eax, dword [esp + 0x14ac]
test eax, eax
je 0x4502c9
mov dx, word [0x56e1d0]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x256]
mov word [esp + 0x254], dx
mov word [esp + 0x4c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x254]
push edx
mov dword [esp + 0x18], eax
mov eax, 0x104
lea ecx, [esp + 0x50]
push 0
push esi
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
call ebx
mov ebp, dword [sym.imp.WININET.dll_InternetCrackUrlW]
add esp, 4
push eax
push esi
call ebp
test eax, eax
jne 0x450278
mov ecx, 0x411
lea edi, [esp + 0x45e]
mov word [esp + 0x45c], ax
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.http:___s_
lea eax, [esp + 0x464]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x45c]
push ecx
push 0
push edx
call ebx
add esp, 4
push eax
lea eax, [esp + 0x468]
push eax
call ebp
test eax, eax
je 0x4502c9
mov edx, dword [esp + 0x14b0]
mov esi, dword [esp + 0x14ac]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx]
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
dec edx
rep stosb byte es:[edi], al
lea ecx, [esp + 0x4c]
lea eax, [esp + 0x254]
push ecx
push eax
push str._s:___s_favicon.ico
push edx
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1494
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1494
ret
Function at 0x4509b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
mov eax, 4
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
push esi
push SysReAllocStringLen
mov dword [esp + 0x30], 0
call edi
mov ebp, eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x450a2c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0x5586c0
push esi
push SysReAllocStringLen
mov dword [esp + 0x3c], 0
call edi
test eax, eax
jne 0x450a2c
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
test ebp, ebp
jne 0x450a3c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp eax, ecx
je 0x450a5a
lea edx, [esp + 0x28]
push 4
push edx
push 4
push ebx
push esi
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x450ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
lea eax, [esp + 0xc]
push esi
lea ecx, [esp + 0x14]
push eax
xor esi, esi
push ecx
push 1
lea edx, [esp + 0x30]
push esi
push edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], 0xbcde0395
mov word [esp + 0x3c], 0xe52f
mov word [esp + 0x3e], 0x467c
mov byte [esp + 0x40], 0x8e
mov byte [esp + 0x41], 0x3d
mov byte [esp + 0x42], 0xc4
mov byte [esp + 0x43], 0x57
mov byte [esp + 0x44], 0x92
mov byte [esp + 0x45], 0x91
mov byte [esp + 0x46], 0x69
mov byte [esp + 0x47], 0x2e
mov dword [esp + 0x28], 0xa95664d2
mov word [esp + 0x2c], 0x9614
mov word [esp + 0x2e], 0x4f35
mov byte [esp + 0x30], 0xa7
mov byte [esp + 0x31], 0x46
mov byte [esp + 0x32], 0xde
mov byte [esp + 0x33], 0x8d
mov byte [esp + 0x34], 0xb6
mov byte [esp + 0x35], 0x36
mov byte [esp + 0x36], 0x17
mov byte [esp + 0x37], 0xe6
mov dword [esp + 0x48], 0xbfa971f1
mov word [esp + 0x4c], 0x4d5e
mov word [esp + 0x4e], 0x40bb
mov byte [esp + 0x50], 0x93
mov byte [esp + 0x51], 0x5e
mov byte [esp + 0x52], 0x96
mov byte [esp + 0x53], 0x70
mov byte [esp + 0x54], 0x39
mov byte [esp + 0x55], 0xbf
mov byte [esp + 0x56], 0xbe
mov byte [esp + 0x57], 0xe4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x450c6d
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x450c6d
lea edx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov ecx, dword [eax]
push edx
push 1
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x450c63
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x450c63
lea edx, [esp + 8]
mov dword [esp + 8], esi
mov ecx, dword [eax]
push edx
push esi
lea edx, [esp + 0x3c]
push 1
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x450c59
mov eax, dword [esp + 8]
cmp eax, esi
je 0x450c59
lea edx, [esp + 4]
mov dword [esp + 4], esi
mov ecx, dword [eax]
push edx
push esi
push 0x57b8a0
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x450c4f
mov eax, dword [esp + 4]
cmp eax, esi
je 0x450c4f
mov edx, dword [esp + 0x48]
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
mov ecx, dword [eax]
push eax
sbb esi, esi
inc esi
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 0x40
ret
Function at 0x450c80
Capabilities:
Create process on windows
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
sub esp, 0x440
push ebx
push esi
mov esi, dword [esp + 0x44c]
xor ebx, ebx
cmp esi, ebx
je 0x450e52
cmp word [esi], bx
je 0x450e52
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e]
mov word [esp + 0x3c], bx
mov word [esp + 0x244], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x246]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x248]
push 0x26
push eax
push ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x208
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x244]
lea edx, [esp + 0x3c]
push ecx
push str._sInternet_Exploreriexplore.exe
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.0043f630
add esp, 0x18
test eax, eax
pop edi
jne 0x450e1e
lea ecx, [esp + 0x14]
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push 0x56e1d0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 0x38]
push ebx
push ecx
call fcn.0043f630
add esp, 8
test eax, eax
jne 0x450e1e
mov word [esp + 0x38], bx
lea eax, [esp + 8]
mov dword [esp + 8], ebx
push eax
push 0x52c100
push 0x15
push ebx
push 0x52c0d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x450e52
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x450e10
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x94]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x450dc0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0xc]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x18]
mov esi, eax
push edx
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
mov word [esp + 0x1c], bx
push edx
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x38]
mov word [esp + 0x38], 8
mov dword [esp + 0x40], esi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
cmp word [esp + 0x38], bx
je 0x450d66
push 0xa
push ebx
lea edx, [esp + 0x40]
push esi
push edx
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x440
ret
Function at 0x451330
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x52af30
push 1
push 0
push 0x52af60
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4513ca
mov ecx, dword [esp]
test ecx, ecx
je 0x4513ca
mov eax, dword [esp + 0x10]
push esi
mov dword [esp + 8], 0
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x50]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x52c1a0
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x4513bd
mov eax, dword [esp + 8]
test eax, eax
je 0x4513bd
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x451820
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x410
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x41c]
lea ecx, [esp + 8]
push eax
push 0x53a4a4
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
cmp word [esp + eax*2 + 6], 0x5c
je 0x451884
lea eax, [esp + 8]
push 0x53abc8
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x4518a1
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
rep stosd dword es:[edi], eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
lea edx, [esp + 0x218]
push 0x24
push edx
push 0
stosw word es:[edi], ax
call ebx
test eax, eax
je 0x4518f7
lea eax, [esp + 0x214]
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
je 0x4518f7
mov esi, 1
xor eax, eax
lea edx, [esp + 0x214]
push eax
mov ecx, 0x82
lea edi, [esp + 0x218]
push 0x26
push edx
push eax
rep stosd dword es:[edi], eax
call ebx
test eax, eax
pop ebx
je 0x451939
lea eax, [esp + 0x210]
lea ecx, [esp + 8]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x451939
mov esi, 1
mov eax, esi
pop edi
pop esi
add esp, 0x410
ret

Function at 0x451950
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x451997
push 0x55a14c
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 8], 0xfeff
je 0x451997
push esi
push 1
lea eax, [esp + 0x10]
push 2
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop esi
ret
Function at 0x4519a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
cmp esi, ebx
jne 0x4519b7
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebx
push esi
call dword [sym.imp.MSVCRT.dll__waccess]
add esp, 8
test eax, eax
je 0x4519ce
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
xor eax, eax
push edi
mov dword [esp + 0xd], eax
push 0x55a158
mov dword [esp + 0x15], eax
push esi
mov dword [esp + 0x1d], eax
mov byte [esp + 0x14], bl
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x451a19
push edi
push 2
lea ecx, [esp + 0x14]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea edx, [esp + 0xc]
push 0x55a154
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
pop edi
jne 0x451a39
push esi
call fcn.004ae180
add esp, 4
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x451bc0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x451cc8
cmp word [edi], 0
je 0x451cc8
push 0x2210
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x451cc8
mov esi, 0x104
mov ecx, eax
sub edi, eax
lea edx, [esi + 0x7ffffefa]
test edx, edx
je 0x451c1b
mov dx, word [edi + ecx]
test dx, dx
je 0x451c1b
mov word [ecx], dx
add ecx, 2
dec esi
jne 0x451bfd
jmp 0x451c1f
test esi, esi
jne 0x451c22
sub ecx, 2
mov esi, dword [esp + 0x14]
mov word [ecx], 0
test esi, esi
je 0x451c6c
cmp word [esi], 0
je 0x451c6c
lea ecx, [eax + 0x208]
mov edi, 0x1000
sub esi, ecx
lea edx, [edi + 0x7fffeffe]
test edx, edx
je 0x451c60
mov dx, word [esi + ecx]
test dx, dx
je 0x451c60
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x451c42
jmp 0x451c64
test edi, edi
jne 0x451c67
sub ecx, 2
mov word [ecx], 0
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
push 0
push 4
push eax
push 0x451a80
push 0
push 0
mov dword [eax + 0x2208], ecx
mov dword [eax + 0x220c], edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x451cc8
test edi, edi
je 0x451caa
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x451cc1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret