joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
cmp dword [eax + 0x18], 0x10
jb 0x435fcc
mov eax, dword [eax + 4]
jmp 0x435fcf
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x436051
push edi
mov edi, dword [0x475594]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], edi
mov dword [esi], eax
pop edi
cmp eax, 2
je 0x436037
cmp eax, 3
je 0x436037
cmp eax, 0x7b
je 0x436037
cmp eax, 0x57
je 0x436037
cmp eax, 0xa1
je 0x436037
cmp eax, 0x35
je 0x436037
cmp eax, 0x20
jne 0x43602d
mov eax, dword [0x47557c]
mov dword [esi], eax
mov ecx, dword [0x475580]
mov dword [esi + 4], ecx
mov dword [ebx], 9
mov eax, ebx
pop ecx
ret
mov dword [ebx], 0
mov eax, ebx
pop ecx
ret
mov edx, dword [0x47557c]
mov dword [esi], edx
mov eax, dword [0x475580]
mov dword [esi + 4], eax
mov dword [ebx], 1
mov eax, ebx
pop ecx
ret
mov ecx, dword [0x47557c]
mov dword [esi], ecx
mov edx, dword [0x475580]
test al, 0x10
mov dword [esi + 4], edx
lea eax, [esp]
mov dword [esp], 3
jne 0x436077
mov dword [esp], 2
mov eax, dword [eax]
mov dword [ebx], eax
mov eax, ebx
pop ecx
ret

Function at 0x436080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
cmp dword [eax + 0x18], 8
jb 0x43608c
mov eax, dword [eax + 4]
jmp 0x43608f
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x436111
push edi
mov edi, dword [0x475594]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], edi
mov dword [esi], eax
pop edi
cmp eax, 2
je 0x4360f7
cmp eax, 3
je 0x4360f7
cmp eax, 0x7b
je 0x4360f7
cmp eax, 0x57
je 0x4360f7
cmp eax, 0xa1
je 0x4360f7
cmp eax, 0x35
je 0x4360f7
cmp eax, 0x20
jne 0x4360ed
mov eax, dword [0x47557c]
mov dword [esi], eax
mov ecx, dword [0x475580]
mov dword [esi + 4], ecx
mov dword [ebx], 9
mov eax, ebx
pop ecx
ret
mov dword [ebx], 0
mov eax, ebx
pop ecx
ret
mov edx, dword [0x47557c]
mov dword [esi], edx
mov eax, dword [0x475580]
mov dword [esi + 4], eax
mov dword [ebx], 1
mov eax, ebx
pop ecx
ret
mov ecx, dword [0x47557c]
mov dword [esi], ecx
mov edx, dword [0x475580]
test al, 0x10
mov dword [esi + 4], edx
lea eax, [esp]
mov dword [esp], 3
jne 0x436137
mov dword [esp], 2
mov eax, dword [eax]
mov dword [ebx], eax
mov eax, ebx
pop ecx
ret
Function at 0x436370
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, 1
push esi
mov dword [esp + 0x10], 0
test byte [0x475920], al
jne 0x4363ac
or dword [0x475920], eax
push 0x455120
mov dword [0x475908], 0x45bb08
call fcn.004490d5
add esp, 4
lea esi, [esp + 0x10]
mov eax, ebp
lea ebx, [esp + 0xc]
mov dword [esp + 0x14], 0x475908
call fcn.00436080
mov eax, dword [esp + 0x10]
mov ecx, eax
neg ecx
sbb ecx, ecx
test ecx, fcn.00419db0
je 0x4363e7
mov edx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x436409
mov eax, dword [0x47557c]
mov ecx, dword [0x475580]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov eax, edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp eax, 3
jne 0x436441
cmp dword [ebp + 0x18], 8
jb 0x436419
mov ebp, dword [ebp + 4]
jmp 0x43641c
add ebp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x436474
mov esi, dword [0x475594]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
mov eax, edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp dword [ebp + 0x18], 8
jb 0x43644c
mov ebp, dword [ebp + 4]
jmp 0x43644f
add ebp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x436474
mov esi, dword [0x475594]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
mov eax, edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x475580]
mov edx, dword [0x47557c]
pop esi
pop ebp
mov dword [edi + 4], eax
mov dword [edi], edx
mov eax, edi
pop ebx
add esp, 0xc
ret
Function at 0x4367d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x44c9d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0x4367c0
mov ecx, 0x475384
call fcn.004339c0
mov eax, dword [0x475388]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], 0
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x43683c
jmp 0x436830
cmp dword [esi + 0x14], 0
jne 0x43689e
cmp dword [esi + 0x10], 0
jne 0x4368a4
push 0x4367c0
mov ecx, 0x475384
call fcn.004339c0
mov eax, dword [0x475388]
add esp, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x43688a
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x43688a
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x4368e4
mov ebx, dword [esi + 0x10]
mov ecx, dword [ebx + 4]
mov dword [esi + 0x10], ecx
mov ecx, dword [ebx]
test ecx, ecx
je 0x4368d2
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x4368a4
cmp dword [esi + 0x14], 0
je 0x436836
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x436909
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x43693a
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x43693a
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x43693a
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x4368ee
jmp 0x436830
Function at 0x436a00
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword [edi + 8]
sub esp, 0x14
push ebx
push esi
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x436960
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x436a4c
lea ecx, [esp + 8]
call dword [sym.imp.MSVCR90.dll_public:_void___thiscall_std::exception::constructor_void_]
push 0x460514
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
call sub.MSVCR90.dll__CxxThrowException
mov eax, dword [edi + 8]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi + 8]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x436a74
cmp eax, 0xffffffff
je 0x436a74
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x441060
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push esi
push edi
mov ecx, dword [edx]
mov esi, ecx
ror esi, 8
and esi, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or esi, ecx
mov ecx, dword [edx + 4]
mov dword [eax], esi
mov esi, ecx
ror esi, 8
and esi, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or esi, ecx
mov ecx, dword [edx + 8]
mov dword [eax + 4], esi
mov esi, ecx
ror esi, 8
and esi, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or esi, ecx
mov ecx, dword [edx + 0xc]
mov edx, ecx
mov dword [eax + 8], esi
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edx, ecx
mov dword [eax + 0xc], edx
mov ecx, edx
shr ecx, 0x10
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
xor ecx, 0x1000000
mov esi, edx
shr esi, 8
and esi, 0xff
mov esi, dword [esi*4 + str.ccccwwww]
and esi, 0xff0000
and ecx, 0xff000000
xor ecx, esi
mov esi, edx
shr esi, 0x18
movzx esi, byte [esi*4 + str.ccccwwww]
xor ecx, esi
mov esi, edx
and esi, 0xff
mov esi, dword [esi*4 + str.ccccwwww]
and esi, 0xff00
xor ecx, esi
xor ecx, dword [eax]
mov edi, dword [eax + 4]
xor edi, ecx
lea esi, [eax + 0x10]
mov dword [esi], ecx
mov ecx, dword [eax + 8]
xor ecx, edi
xor edx, ecx
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], edx
mov edi, 0x45a4dc
nop
mov ecx, esi
mov edx, dword [ecx + 0xc]
mov eax, edx
shr eax, 8
mov esi, edx
and eax, 0xff
mov eax, dword [eax*4 + str.ccccwwww]
shr esi, 0x10
and esi, 0xff
mov esi, dword [esi*4 + str.ccccwwww]
and eax, 0xff0000
and esi, 0xff000000
xor eax, esi
mov esi, edx
and edx, 0xff
mov edx, dword [edx*4 + str.ccccwwww]
shr esi, 0x18
movzx esi, byte [esi*4 + str.ccccwwww]
xor eax, esi
and edx, 0xff00
xor eax, edx
xor eax, dword [edi]
lea esi, [ecx + 0x10]
xor eax, dword [ecx]
add edi, 4
mov dword [esi], eax
mov edx, dword [ecx + 4]
xor edx, eax
mov dword [ecx + 0x14], edx
mov eax, dword [ecx + 8]
xor eax, edx
mov dword [ecx + 0x18], eax
mov edx, dword [ecx + 0xc]
xor edx, eax
mov dword [ecx + 0x1c], edx
cmp edi, 0x45a500
jne 0x441150
pop edi
mov eax, 0xa
pop esi
ret
Function at 0x4411f0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, eax
call fcn.00441060
lea edi, [eax*4]
xor ebx, ebx
mov dword [esp + 0xc], eax
test edi, edi
jle 0x441255
lea edx, [esi + edi*4 + 8]
lea ecx, [esi + 8]
push ebp
mov eax, dword [edx - 8]
mov ebp, dword [ecx - 8]
mov dword [ecx - 8], eax
mov dword [edx - 8], ebp
mov ebp, dword [edx - 4]
mov eax, dword [ecx - 4]
mov dword [ecx - 4], ebp
mov ebp, dword [edx]
mov dword [edx - 4], eax
mov eax, dword [ecx]
mov dword [ecx], ebp
mov ebp, dword [edx + 4]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [ecx + 4], ebp
mov dword [edx + 4], eax
add ebx, 4
sub edi, 4
add ecx, 0x10
sub edx, 0x10
cmp ebx, edi
jl 0x441214
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, 1
jle 0x441410
lea edx, [eax - 1]
mov ecx, dword [esi + 0x10]
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + str.ccccwwww]
add esi, 0x10
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x4590d8]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4598d8]
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4594d8]
movzx ebx, byte [esi + 5]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x459cd8]
mov ecx, dword [esi + 4]
mov dword [esi], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x4590d8]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4598d8]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4594d8]
movzx ebx, byte [esi + 9]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x459cd8]
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x4590d8]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4598d8]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4594d8]
movzx ebx, byte [esi + 0xd]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x459cd8]
mov ecx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x4590d8]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4598d8]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x4594d8]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x459cd8]
sub edx, 1
mov dword [esi + 0xc], edi
jne 0x441261
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x447650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44a109
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
mov edx, dword [eax + 0x3c]
mov esi, dword [eax + 0x10]
mov ecx, dword [eax + 0x40]
mov dword [esi], edx
mov esi, dword [eax + 0x20]
sub ecx, edx
mov dword [esi], edx
mov edx, dword [eax + 0x30]
push 1
xor ebx, ebx
push ebx
mov dword [edx], ecx
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 4]
and dword [esp + eax + 0x1c], 0xfffffffe
mov ecx, dword [esp + 0xc]
lea eax, [esp + eax + 0xc]
mov eax, dword [ecx + 4]
lea eax, [esp + eax + 0xc]
push edx
lea ecx, [esp + 0x10]
mov dword [eax + 0x14], 6
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_int__]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
movsx eax, dl
neg eax
sbb eax, eax
not eax
test ecx, eax
je 0x447701
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_int___thiscall_std::basic_istream_char__struct_std::char_traits_char__::get_void_]
cmp eax, 0xffffffff
jne 0x447701
mov bl, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::vbase_dtor_void_]
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret 8
Function at 0x447730
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x44a5a3
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov ebp, 1
mov dword [esp + 0x58], ebp
cmp esi, ebx
jne 0x447793
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
jmp 0x44780c
lea ecx, [esp + 0x3c]
push ecx
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4477ac
lea edx, [esp + 0x20]
push edx
jmp 0x447804
xor esi, esi
mov edi, edi
movzx eax, byte [esp + esi + 0x3c]
mov ecx, eax
shr ecx, 4
and eax, reloc.WS2_32.dll_ntohs
mov dl, byte [ecx + str.0123456789ABCDEFincomplete_message_information__rejected_]
mov byte [esp + 0x18], dl
jns 0x4477d0
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, dword [esp + 0x18]
mov al, byte [eax + str.0123456789ABCDEFincomplete_message_information__rejected_]
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], al
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::push_back_char_]
mov edx, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::push_back_char_]
add esi, ebp
cmp esi, 0x10
jb 0x4477b0
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ebp
mov byte [esp + 0x58], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00449014
add esp, 0x4c
ret
Function at 0x447a20
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ecx
cmp dword [esi], 0
push ebx
mov ebx, eax
mov dword [esp + 4], 0
jne 0x447a70
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x447a6f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x80090016
jne 0x447a6e
push 8
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x447a6e
call ebp
mov dword [esi], 0
pop ebp
pop edi
mov eax, dword [esi]
push eax
mov ecx, str.UserID
call fcn.00447840
add esp, 4
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x447a90
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ecx
cmp dword [esi], 0
push ebx
mov ebx, eax
mov dword [esp + 4], 0
jne 0x447ae0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x447adf
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x80090016
jne 0x447ade
push 8
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x447ade
call ebp
mov dword [esi], 0
pop ebp
pop edi
mov eax, dword [esi]
push eax
mov ecx, str.MD5ID
call fcn.00447840
add esp, 4
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x447b00
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ecx
cmp dword [esi], 0
push edi
mov edi, eax
mov dword [esp + 4], 0
jne 0x447b50
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push 0
push 0
push esi
call ebx
test eax, eax
jne 0x447b4f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x80090016
jne 0x447b4e
push 8
push 1
push 0
push 0
push esi
call ebx
test eax, eax
jne 0x447b4e
call ebp
mov dword [esi], 0
pop ebp
pop ebx
mov ecx, dword [esi]
call fcn.00447730
mov eax, edi
pop edi
pop ecx
ret
Function at 0x447d20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x220
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
lea eax, [esp + 0xc]
push eax
push 0x1a
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x447dda
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, 1
jne 0x447dae
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.004087f0
mov eax, str.Adobe
mov ecx, esi
call fcn.004087f0
mov ecx, esi
call fcn.00408ba0
test al, al
jne 0x447d92
call fcn.00448cf0
mov eax, 0x45b580
mov ecx, esi
call fcn.004087f0
mov ecx, esi
call fcn.00408ba0
test al, al
jne 0x447dae
call fcn.00448cf0
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x447dda
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x21c]
pop esi
xor ecx, esp
call fcn.00449014
add esp, 0x220
ret
Function at 0x447df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44f719
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x30], eax
push edi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x4c], 0
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_const_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::end_void_]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov edi, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_const_iterator_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::begin_void_]
mov edx, dword [edi + 4]
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00408f20
add esp, 0x18
push str..ini
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
mov ecx, ebx
call fcn.00447d20
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x447e98
lea eax, [esp + 0x20]
mov ecx, ebx
call fcn.004087f0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00449014
mov esp, ebp
pop ebp
ret