joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e09c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
call fcn.0045e04c
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbx + 0x128], eax
cmp eax, 0x390
jae 0x45e0dd
and dword [rbx + 0x128], 0
xor al, al
jmp 0x45e123
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbx + 0x118], rax
test rax, rax
je 0x45e0d2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbx + 0x120], rax
test rax, rax
jne 0x45e121
mov rcx, qword [rbx + 0x118]
call qword [sym.imp.KERNEL32.dll_FreeResource]
and qword [rbx + 0x118], 0
jmp 0x45e0d2
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x45f388
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
or edi, 0xffffffff
test rdx, rdx
je 0x45f40c
lea r8, [0x0045efc0]
lea rcx, [0x004eebc0]
call fcn.0041b240
mov r9, rax
test rax, rax
je 0x45f40c
mov rdx, qword [0x004eebd0]
mov r8, qword [rax]
test rdx, rdx
je 0x45f401
mov r10d, dword [0x004eebe0]
test r10d, r10d
je 0x45f401
cmp rax, rdx
jb 0x45f401
mov ecx, r10d
imul ecx, dword [0x004eebd8]
add rcx, rdx
cmp rax, rcx
jae 0x45f401
sub r9d, edx
mov eax, r9d
cdq
idiv r10d
mov ebx, eax
mov eax, r9d
cdq
idiv r10d
test edx, edx
cmovne ebx, edi
jmp 0x45f403
mov ebx, edi
test r8, r8
jne 0x45f4ce
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, dword [0x004eebd8]
xor ebx, ebx
movzx edx, ax
test ecx, ecx
je 0x45f451
mov r9, qword [0x004eebd0]
mov eax, dword [0x004eebe0]
imul eax, ebx
mov r8, qword [rax + r9]
test r8, r8
je 0x45f44b
test edx, edx
je 0x45f44b
cmp dword [r8 + 0x104], edx
je 0x45f4ce
inc ebx
cmp ebx, ecx
jb 0x45f428
lea r8, [0x0045efc0]
lea rdx, str.English
lea rcx, [0x004eebc0]
call fcn.0041b240
mov r9, rax
test rax, rax
je 0x45f555
mov rdx, qword [0x004eebd0]
mov r8, qword [rax]
test rdx, rdx
je 0x45f4c3
mov r10d, dword [0x004eebe0]
test r10d, r10d
je 0x45f4c3
cmp rax, rdx
jb 0x45f4c3
mov ecx, r10d
imul ecx, dword [0x004eebd8]
add rcx, rdx
cmp rax, rcx
jae 0x45f4c3
sub r9d, edx
mov eax, r9d
cdq
idiv r10d
mov ebx, eax
mov eax, r9d
cdq
idiv r10d
test edx, edx
cmovne ebx, edi
jmp 0x45f4c5
mov ebx, edi
test r8, r8
je 0x45f555
mov rcx, r8
call fcn.0045e628
test al, al
jne 0x45f54b
lea r8, [0x0045efc0]
lea rdx, str.English
lea rcx, [0x004eebc0]
call fcn.0041b240
mov r8, rax
test rax, rax
je 0x45f549
mov rdx, qword [0x004eebd0]
test rdx, rdx
je 0x45f545
mov r9d, dword [0x004eebe0]
test r9d, r9d
je 0x45f545
cmp rax, rdx
jb 0x45f545
mov ecx, r9d
imul ecx, dword [0x004eebd8]
add rcx, rdx
cmp rax, rcx
jae 0x45f545
sub r8d, edx
mov eax, r8d
cdq
idiv r9d
mov ebx, eax
mov eax, r8d
cdq
idiv r9d
test edx, edx
cmovne ebx, edi
jmp 0x45f54b
mov ebx, edi
jmp 0x45f54b
xor ebx, ebx
mov dword [0x004eebe8], ebx
mov al, 1
jmp 0x45f557
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x45fbf0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, r9
mov esi, r8d
mov r15, rdx
mov r14, rcx
test rdx, rdx
je 0x45fc85
test r8d, r8d
je 0x45fc85
test r9, r9
je 0x45fc85
cmp dword [rbp + 0x40], 0
je 0x45fc85
mov rax, qword [rcx]
test rax, rax
je 0x45fc85
cmp qword [rax + 0x18], 0
je 0x45fc85
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rbp + 0x28]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x45fc85
mov rax, qword [r14]
lea r9, [rbp - 0x10]
mov rcx, qword [rbp + 0x28]
mov edx, 0x10001
mov r8, qword [rax + 0x18]
add r8, 0x60
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov rcx, qword [rbp + 0x28]
test eax, eax
jne 0x45fc9b
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
lea rax, [rbp - 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x45fcc9
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x28]
jmp 0x45fc7d
mov rcx, qword [rbp - 8]
xor r9d, r9d
mov r8d, esi
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x45fcf6
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x45fcc3
and dword [rsp + 0x28], 0
mov rdx, rdi
mov r9, qword [rbp - 0x10]
mov r8d, dword [rbp + 0x40]
mov rcx, qword [rbp - 8]
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
mov rcx, qword [rbp - 0x10]
test eax, eax
je 0x45fce4
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x28]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
jmp 0x45fc87

Function at 0x460ba8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
test rcx, rcx
je 0x460bd9
test rdx, rdx
je 0x460bd9
mov r9b, r8b
mov rax, r8
lea r10, [0x00489ec0]
and eax, 0xf
add r9b, byte [r10 + rax*4]
xor byte [r8 + rcx], r9b
mov r9b, byte [r8 + rcx]
inc r8
cmp r8, rdx
jb 0x460bb8
ret

Function at 0x460c54
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
xor r9d, r9d
mov r11, r8
mov r10, rcx
test r8, r8
je 0x460c98
test rcx, rcx
je 0x460ca4
test edx, edx
je 0x460ca4
mov r8b, r9b
mov cl, byte [r10]
mov eax, r9d
and eax, 0xf
inc r9d
add r8b, byte [rax + r11]
xor r8b, cl
mov byte [r10], r8b
inc r10
mov r8b, cl
cmp r9d, edx
jb 0x460c72
add rsp, 0x28
ret
lea r8, [0x00489ec0]
call fcn.00460de4
add rsp, 0x28
ret
Function at 0x460cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor r10d, r10d
mov rdi, r8
mov ebx, edx
mov r11, rcx
test r8, r8
je 0x460cfa
test r9d, r9d
je 0x460cfa
test rcx, rcx
je 0x460d06
test edx, edx
je 0x460d06
mov r8b, r10b
xor edx, edx
mov eax, r10d
div r9d
inc r10d
add r8b, byte [rdx + rdi]
xor byte [r11], r8b
mov r8b, byte [r11]
inc r11
cmp r10d, ebx
jb 0x460cdb
jmp 0x460d06
lea r8, [0x00489ec0]
call fcn.00460dac
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x460dac
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
test rcx, rcx
je 0x460dda
test edx, edx
je 0x460dda
mov r10d, r9d
mov r11d, edx
mov rax, r10
inc r10
and eax, 0xf
add r9b, byte [r8 + rax*4]
xor byte [rcx], r9b
mov r9b, byte [rcx]
inc rcx
sub r11, 1
jne 0x460dbe
ret

Function at 0x460de4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
test rcx, rcx
je 0x460e1a
test edx, edx
je 0x460e1a
mov r11d, r9d
mov edx, edx
mov cl, byte [r10]
mov rax, r11
and eax, 0xf
inc r11
add r9b, byte [r8 + rax*4]
xor r9b, cl
mov byte [r10], r9b
inc r10
mov r9b, cl
sub rdx, 1
jne 0x460df8
ret

Function at 0x460e24
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
add rcx, 0x18
lea r8d, [rdx + 0x50]
call fcn.00424830
xor eax, eax
mov dword [rbx], 0x67452301
mov byte [rbx + 0x68], al
mov qword [rbx + 0x10], rax
mov rax, rbx
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret
Function at 0x4611ac
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor r12d, r12d
xor edx, edx
mov r8d, 0x208
mov esi, r12d
call fcn.00424830
test rdi, rdi
je 0x4613e6
lea rbx, [0x00491dd8]
mov r9, rdi
lea r8, [0x00491de8]
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.0040457c
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
or r14, 0xffffffffffffffff
mov r15, rax
cmp rax, r14
je 0x461383
test byte [rbp + 0x140], 0x10
je 0x4612ca
lea rdx, [0x00490974]
lea rcx, [rbp + 0x16c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x461362
lea rdx, [0x00491de0]
lea rcx, [rbp + 0x16c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x461362
lea rax, [rbp + 0x16c]
mov r9, rdi
lea r8, [0x00491de8]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.0040457c
mov r9b, 1
mov byte [rsp + 0x20], 1
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [0x004e1a9c]
call fcn.004611ac
add esi, eax
jmp 0x461362
lea rax, [rbp + 0x16c]
mov r9, rdi
lea r8, [0x00491de8]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.0040457c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x461360
lea rcx, [rsp + 0x30]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r12w
jne 0x461306
cmp eax, dword [0x004b9090]
jae 0x461360
mov rbx, qword [0x004b9088]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
lea rdx, [rsp + 0x30]
add r8, r8
mov rcx, rbx
call fcn.00445ad0
test eax, eax
je 0x461359
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x004e1a9c], 1
lea rbx, [0x00491dd8]
inc esi
lea rdx, [rbp + 0x140]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46123d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x461394
inc esi
jmp 0x4613e2
inc r14
cmp word [rdi + r14*2], r12w
jne 0x461394
cmp r14d, dword [0x004b9090]
jae 0x4613e2
mov rbx, qword [0x004b9088]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
mov rdx, rdi
add r8, r8
mov rcx, rbx
call fcn.00445ad0
test eax, eax
je 0x4613e2
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x004e1a9c], 1
mov eax, esi
jmp 0x4613e8
xor eax, eax
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x461410
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
lea rbp, [rax - 0x608]
sub rsp, 0x6f0
mov rdi, r8
lea rcx, [rbp + 0x130]
mov rbx, rdx
mov r14d, 0x2b8
mov r8d, r14d
xor edx, edx
mov rsi, r9
call fcn.00424830
xor r15d, r15d
test rbx, rbx
je 0x461636
test rdi, rdi
je 0x461636
test rsi, rsi
je 0x461636
mov word [rdi], r15w
lea r8, [rbp + 0x130]
or dword [rsi], 0xffffffff
mov r9d, r14d
xor edx, edx
mov dword [rsp + 0x20], 0x1000
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x461517
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
movsxd rcx, eax
shr rcx, 1
je 0x46150c
cmp rcx, 0x7fffffff
jbe 0x4614cb
mov word [rdi], r15w
jmp 0x46150c
mov edx, 0x7ffffffe
lea r8, [rbp + 0x140]
sub rdx, rcx
sub r8, rdi
lea rax, [rdx + rcx]
test rax, rax
je 0x4614fd
movzx eax, word [r8 + rdi]
test ax, ax
je 0x4614fd
mov word [rdi], ax
add rdi, 2
sub rcx, 1
jne 0x4614dd
test rcx, rcx
lea rax, [rdi - 2]
cmovne rax, rdi
mov word [rax], r15w
mov eax, dword [rbp + 0x138]
jmp 0x461634
mov r14d, 0x200
mov rcx, rbx
mov dword [rbp + 0x610], r14d
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov rbx, 0xffffffff80000000
lea r9, [rbp + 0x610]
mov rdx, rax
lea r8, [rbp + 0x3f0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea r8, str.DefaultIcon
mov edx, r14d
lea rcx, [rbp + 0x3f0]
call fcn.0041b804
lea r9, [rbp + 0x610]
mov dword [rbp + 0x610], 0x104
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rbp + 0x3f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea rdx, [0x004903e0]
lea rcx, [rsp + 0x30]
call fcn.00423b70
mov r14, rax
test rax, rax
je 0x461636
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 1
lea rcx, [rsp + 0x30]
sub ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, ebx
mov rcx, rdi
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov edx, 0x7ffffffe
shr rcx, 1
lea rax, [rcx - 1]
cmp rax, rdx
ja 0x46162b
shr rbx, 1
cmp rbx, rdx
jbe 0x4615f2
mov word [rdi], r15w
jmp 0x46162b
sub rbx, rcx
lea rdx, [rsp + 0x30]
sub rdx, rdi
lea rax, [rbx + rcx]
test rax, rax
je 0x46161c
movzx eax, word [rdx + rdi]
test ax, ax
je 0x46161c
mov word [rdi], ax
add rdi, 2
sub rcx, 1
jne 0x4615fd
test rcx, rcx
lea rax, [rdi - 2]
cmovne rax, rdi
mov word [rax], r15w
lea rcx, [r14 + 2]
call fcn.00436ec0
mov dword [rsi], eax
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x46184c
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x570]
sub rsp, 0x670
and qword [rbp + 0x5a0], 0
mov r14, r9
mov rbx, r8
test r8, r8
je 0x461a03
test r9, r9
je 0x461a03
lea r8, [rbp + 0x5a0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x461a03
cmp qword [rbp + 0x5a0], 0
je 0x461a03
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.00424830
mov rcx, qword [rbp + 0x5a0]
lea rdx, [rsp + 0x40]
xor dil, dil
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4619f0
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
lea r8, str._s_s.lnk
mov edx, 0x103
lea rcx, [rbp + 0x150]
call fcn.0040457c
and qword [rbp + 0x590], 0
lea rax, [rbp + 0x590]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9, [0x0047af20]
lea rcx, [0x0047af50]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4619f0
mov rcx, qword [rbp + 0x590]
test rcx, rcx
je 0x4619f0
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [0x0047af60]
call qword [rax]
test eax, eax
js 0x4619ca
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x4619ca
mov rax, qword [rcx]
lea rdx, [rbp + 0x150]
xor r8d, r8d
call qword [rax + 0x28]
test eax, eax
js 0x4619bf
mov rcx, qword [rbp + 0x590]
lea rdx, [rbp + 0x360]
mov r8d, 0x103
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x4619bf
lea rdx, [rbp + 0x360]
sub rdx, rbx
movzx eax, word [rbx]
movzx ecx, word [rbx + rdx]
sub eax, ecx
jne 0x4619b9
add rbx, 2
test ecx, ecx
jne 0x4619a6
test eax, eax
sete dil
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rbp + 0x590]
mov rax, qword [rcx]
call qword [rax + select]
test dil, dil
je 0x4619f0
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb cl, cl
and dil, cl
mov rcx, qword [rbp + 0x5a0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, dil
jmp 0x461a05
xor eax, eax
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop r14
pop rdi
pop rbp
ret
Function at 0x461a20
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x250
mov r14, r8
lea rcx, [rsp + 0x40]
mov r15d, edx
xor r12d, r12d
xor edx, edx
mov qword [rax + 8], r12
mov r8d, 0x208
mov rbp, r9
call fcn.00424830
test r14, r14
je 0x461b3d
test rbp, rbp
je 0x461b3d
cmp qword [rsp + 0x298], r12
je 0x461b3d
mov esi, dword [rsp + 0x2a0]
test esi, esi
je 0x461b3d
mov rbx, qword [rsp + 0x2a8]
test rbx, rbx
je 0x461b3d
lea r8, [rsp + 0x270]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x461b3d
mov rcx, qword [rsp + 0x270]
test rcx, rcx
je 0x461b3d
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x270]
test eax, eax
je 0x461b37
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsp + 0x290]
lea edx, [rsi - 1]
mov rcx, qword [rsp + 0x298]
lea r9, [rsp + 0x40]
lea r8, str._s_s.lnk
mov qword [rsp + 0x20], rax
call fcn.0040457c
cmp word [rbx], r12w
mov r8, rbp
mov r9, qword [rsp + 0x298]
mov rdx, r14
cmove rbx, rbp
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], rbx
call fcn.0046165c
jmp 0x461b3f
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x461c7c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x378]
sub rsp, 0x450
mov r15, r8
lea rcx, [rbp + 0x140]
mov r14d, edx
mov r12d, 0x208
mov r8d, r12d
xor edx, edx
mov rdi, r9
call fcn.00424830
xor ebx, ebx
mov qword [rbp + 0x380], rbx
mov sil, bl
test r15, r15
je 0x461e1d
test rdi, rdi
je 0x461e1d
lea r8, [rbp + 0x380]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x461e1d
mov rcx, qword [rbp + 0x380]
test rcx, rcx
je 0x461e1d
lea rdx, [rbp + 0x140]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x461e06
lea r8, [0x0048d7c4]
mov edx, r12d
lea rcx, [rbp + 0x140]
call fcn.0041b804
mov r8, r15
lea rcx, [rbp + 0x140]
mov edx, r12d
call fcn.0041b804
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x461dab
lea rax, [0x004837b8]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x140]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], 0x104
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov word [rsp + 0x38], bx
call fcn.00403ec4
lea rax, [0x0048d7e0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.00415a54
mov sil, al
jmp 0x461dae
mov sil, 1
mov eax, dword [rbp + 0x3a0]
mov edx, eax
test eax, eax
je 0x461e06
cmp eax, 0x7fffffff
jbe 0x461dc6
mov word [rdi], bx
jmp 0x461e06
mov ecx, 0x7ffffffe
lea r8, [rbp + 0x140]
sub rcx, rax
sub r8, rdi
lea rax, [rcx + rdx]
test rax, rax
je 0x461df8
movzx eax, word [r8 + rdi]
test ax, ax
je 0x461df8
mov word [rdi], ax
add rdi, 2
sub rdx, 1
jne 0x461dd8
test rdx, rdx
lea rcx, [rdi - 2]
cmovne rcx, rdi
mov word [rcx], bx
mov rcx, qword [rbp + 0x380]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test sil, sil
setne bl
mov eax, ebx
jmp 0x461e1f
xor eax, eax
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x461f14
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rbx, r8
lea rcx, [rsp + 0x30]
mov edi, edx
mov ebp, 0x208
mov r8d, ebp
xor edx, edx
call fcn.00424830
xor esi, esi
test rbx, rbx
je 0x461fa2
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], si
jne 0x461f4f
cmp eax, 1
jb 0x461fa2
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x461fa2
lea r8, [0x0048d7c4]
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.0041b804
mov r8, rbx
lea rcx, [rsp + 0x30]
mov rdx, rbp
call fcn.0041b804
lea rdx, [rsp + 0x30]
call fcn.004611ac
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x46206c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
xor edi, edi
mov rbx, rdx
test rdx, rdx
jne 0x46208a
xor eax, eax
jmp 0x462150
lea rax, [rsp + 0x20]
mov r8, rbx
sub r8, rax
lea rcx, [rsp + 0x20]
mov edx, 0x208
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x4620c2
movzx eax, word [r8 + rcx]
test ax, ax
je 0x4620c2
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x46209f
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
lea rcx, [rsp + 0x20]
mov word [rax], di
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rsp + rcx*2 + 0x1e]
jmp 0x4620ef
cmp word [rax], 0x5c
je 0x4620fb
sub rax, 2
lea rcx, [rsp + 0x20]
cmp rax, rcx
ja 0x4620e5
jmp 0x462130
lea rcx, [rsp + 0x20]
mov word [rax], di
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x462130
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x462130
lea rdx, [rsp + 0x20]
lea rcx, [0x004e1a9c]
call fcn.0046206c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46214b
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x462150
mov eax, 1
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret
Function at 0x466538
Capabilities:
Compute adler32 checksum

Disassembly:
mov r10d, ecx
movzx r9d, cx
shr r10d, 0x10
mov r11, rdx
cmp r8, 1
jne 0x46657c
movzx ecx, byte [rdx]
mov r8d, 0xfff1
add ecx, r9d
cmp ecx, r8d
lea edx, [rcx - 0xfff1]
cmovb edx, ecx
lea eax, [rdx + r10]
cmp eax, r8d
lea ecx, [rax - 0xfff1]
cmovb ecx, eax
shl ecx, 0x10
or ecx, edx
mov eax, ecx
ret
test rdx, rdx
jne 0x466585
lea eax, [rdx + 1]
ret
cmp r8, 0x10
jae 0x4665ce
test r8, r8
je 0x4665a3
movzx eax, byte [r11]
inc r11
add r9d, eax
add r10d, r9d
sub r8, 1
jne 0x466590
mov r8d, 0xfff1
lea ecx, [r9 - 0xfff1]
cmp r9d, r8d
mov eax, 0x80078071
cmovb ecx, r9d
mul r10d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r10d
shl eax, 0x10
or eax, ecx
ret
cmp r8, 0x15b0
jb 0x4666a8
mov rcx, r8
movabs rax, 0x79baa6bb6398b6f7
mul r8
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xc
imul rax, rcx, 0xffffffffffffea50
add r8, rax
mov edx, 0x2b6
movzx eax, byte [r11]
add r9d, eax
movzx eax, byte [r11 + 1]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 2]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 3]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 4]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 5]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 6]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 7]
add r10d, r9d
add r11, 8
add r9d, eax
add r10d, r9d
add edx, 0xffffffff
jne 0x466607
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul r10d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r10d, eax
sub rcx, 1
jne 0x466602
test r8, r8
je 0x466757
cmp r8, 8
jb 0x46671c
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
movzx eax, byte [r11]
add r9d, eax
movzx eax, byte [r11 + 1]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 2]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 3]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 4]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 5]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 6]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 7]
add r10d, r9d
add r11, 8
add r9d, eax
add r10d, r9d
sub rcx, 1
jne 0x4666b6
test r8, r8
je 0x46672f
movzx eax, byte [r11]
inc r11
add r9d, eax
add r10d, r9d
sub r8, 1
jne 0x46671c
mov eax, 0x80078071
mul r9d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xffff000f
mul r10d
add r9d, ecx
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r10d, ecx
shl r10d, 0x10
or r10d, r9d
mov eax, r10d
ret