joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4bd206
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x154]
mov edi, ecx
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x447375
mov eax, dword [edi + 8]
lea esi, [eax + 4]
call fcn.00453f20
mov ecx, edi
mov bl, al
call fcn.00444890
test al, al
jne 0x4474c0
cmp byte [edi + 0x11c], al
lea eax, [edi + 0xc]
jne 0x44739c
mov eax, dword [edi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4473b8
shr eax, 4
not al
and al, 1
jne 0x44743e
test ebp, ebp
je 0x4473c3
mov dword [ebp], 1
cmp byte [edi + 0x11c], 0
je 0x4473d1
add edi, 0xc
jmp 0x4473d4
mov edi, dword [edi + 8]
lea ecx, [esp + 0x1c]
call fcn.00448930
lea eax, [edi + 4]
lea edx, [esp + 0x1c]
call fcn.00448b50
mov ecx, dword [esp + 0x150]
push 0x4e2adc
mov dword [esp + 0x14c], 1
call fcn.00447720
mov edi, eax
lea eax, [esp + 0x20]
call fcn.00447b90
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], vtable.t_str.0
jne 0x447437
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x447437
push eax
call fcn.00498f5b
add esp, 4
xor al, al
jmp 0x4474c2
test bl, bl
je 0x4474c0
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x447451
mov eax, dword [edi + 8]
add eax, 4
push eax
call fcn.00451370
mov ebx, eax
test ebp, ebp
je 0x447463
mov dword [ebp], ebx
test ebx, ebx
je 0x4474c0
cmp byte [edi + 0x11c], 0
je 0x447475
add edi, 0xc
jmp 0x447478
mov edi, dword [edi + 8]
mov ecx, dword [esp + 0x150]
push 0x4e32d4
call fcn.004032e0
mov esi, eax
push ebx
push 0x4e34dc
mov edx, esi
call fcn.00448ff0
push 0x4e32e4
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add edi, 4
push edi
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add esp, 0x18
xor al, al
jmp 0x4474c2
mov al, 1
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret 8

Function at 0x447e40
Capabilities:
Set file attributes

Disassembly:
push ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x447e50
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push 1
push esi
push eax
push ecx
call fcn.004435c0
test al, al
setne al
pop ecx
ret 8
Function at 0x4481b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bb5a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x24], eax
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
mov dword [esp + 0xc], edi
cmp eax, 0x4dc0a8
je 0x448276
xor ecx, ecx
cmp cx, word [0x4dc0a8]
je 0x448276
lea ecx, [esp + 0x10]
call fcn.0042c470
mov dword [esp + 0x38], edi
call fcn.00447f80
cmp eax, 2
jne 0x448225
lea edx, [esp + 0x10]
push edx
call fcn.004486d0
add esp, 4
test al, al
jne 0x448244
mov edi, 0x4dc0a8
lea ecx, [esp + 0x10]
call fcn.004482a0
test al, al
jne 0x448244
push edi
lea edi, [esp + 0x14]
call fcn.00448390
add esp, 4
sub esp, 0x1c
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0042e8d0
push esi
call fcn.00448040
add esp, 0x20
cmp dword [esp + 0x28], 8
jb 0x44827d
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00498355
add esp, 4
jmp 0x44827d
mov ecx, esi
call fcn.0042c470
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00497c58
add esp, 0x34
ret

Function at 0x4482a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4baad8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x14], ax
push 0x11
mov eax, str.SoftwareClasses_
lea esi, [esp + 0x14]
mov ebx, ecx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
call fcn.00405e30
mov eax, edi
mov dword [esp + 0x38], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x448306
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea ecx, [esp + 0x14]
call fcn.0041b8c0
push 6
mov eax, str.Shell
lea ecx, [esp + 0x14]
call fcn.0041b8c0
sub esp, 0x1c
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0042e8d0
push reloc.WS2_32.dll_accept
push ebx
call fcn.00448460
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x448368
mov eax, dword [esp + 0x14]
push eax
call fcn.00498355
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00497c58
add esp, 0x30
ret
Function at 0x4486d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4bb566
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x44c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x45c]
mov dword [esp + 0x24], eax
xor ebp, ebp
xor ecx, ecx
push 0x3e
mov eax, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
lea esi, [esp + 0x2c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebp
mov word [esp + 0x30], cx
call fcn.00405e30
mov eax, 0x4dc0a8
mov dword [esp + 0x454], ebp
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x448750
sub eax, edx
sar eax, 1
push eax
mov eax, 0x4dc0a8
lea ecx, [esp + 0x2c]
call fcn.0041b8c0
push 0xb
mov eax, 0x4e33b4
lea ecx, [esp + 0x2c]
call fcn.0041b8c0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov byte [esp + 0x454], 1
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x44879d
lea eax, [esp + 0x2c]
lea edx, [esp + 0x18]
push edx
push 1
push ebp
push eax
push reloc.WS2_32.dll_accept
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x448866
mov ebx, dword [esp + 0x18]
push 0x3fe
lea ecx, [esp + 0x4a]
xor eax, eax
push ebp
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov word [esp + 0x50], ax
call fcn.0049ca10
add esp, 0xc
push str.Progid
lea edx, [esp + 0x20]
push edx
lea edi, [esp + 0x20]
lea esi, [esp + 0x4c]
mov dword [esp + 0x20], 0x200
call fcn.00407350
test eax, eax
jne 0x44885b
cmp ax, word [esp + 0x44]
je 0x44885b
mov edi, esi
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.004482a0
test al, al
jne 0x448831
mov edx, edi
push edx
mov edi, esi
call fcn.00448390
add esp, 4
mov byte [esp + 0x17], al
jmp 0x448836
mov byte [esp + 0x17], 1
cmp ebx, ebp
je 0x448841
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x448855
mov eax, dword [esp + 0x2c]
push eax
call fcn.00498355
add esp, 4
mov al, byte [esp + 0x17]
jmp 0x44887c
cmp ebx, ebp
je 0x448866
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x44887a
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00498355
add esp, 4
xor al, al
mov ecx, dword [esp + 0x44c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.00497c58
add esp, 0x444
ret
Function at 0x44a520
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4ba0bb
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x32c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x354]
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x142]
push ecx
mov word [esp + 0x144], ax
call fcn.0049ca10
add esp, 0xc
lea edx, [esp + 0x138]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x44a5d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00447720
mov esi, eax
push 0x4e36e4
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
push edi
push 0x4e34dc
mov edx, esi
call fcn.00448ff0
add esp, 0x10
xor al, al
jmp 0x44a6cd
lea eax, [esp + 0x138]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44a5e0
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x136], 0x5c
jne 0x44a61d
lea eax, [esp + 0x138]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44a604
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x136], cx
lea ecx, [esp + 0x14]
call fcn.00448930
lea ebx, [esp + 0x138]
mov edx, ebx
test edx, edx
jne 0x44a638
mov ebx, 0x4d6464
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44a640
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
mov ecx, edi
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.004495a0
cmp byte [esp + 0x130], 0
lea eax, [esp + 0x20]
jne 0x44a673
mov eax, dword [esp + 0x1c]
lea ecx, [edi + edi]
push ecx
add eax, 4
push ebx
push eax
call fcn.0049c670
add esp, 0xc
cmp byte [esp + 0x130], 0
lea eax, [esp + 0x20]
jne 0x44a696
mov eax, dword [esp + 0x1c]
add eax, 4
lea edx, [ebp + 0x12c]
call fcn.00448b50
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x44a6cb
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
cmp eax, edx
je 0x44a6cb
push eax
call fcn.00498f5b
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.00497c58
add esp, 0x33c
ret 4
Function at 0x44b0c0
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x4d0]
call fcn.00448b50
cmp byte [esi + 0x5ec], 0
lea eax, [esi + 0x4dc]
jne 0x44b0ee
mov eax, dword [esi + 0x4d8]
add esi, 0x5f4
add eax, 4
mov edx, esi
call fcn.00448b50
mov eax, esi
call fcn.00449540
pop edi
mov al, 1
pop esi
ret
Function at 0x44bb60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bcfd3
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [esp + 0x10c]
mov edi, edx
call fcn.00448930
xor eax, eax
cmp dword [esp + 0x22c], eax
je 0x44bbc2
mov dword [esp + 0x22c], eax
mov ecx, 1
lea esi, [esp + 0x114]
mov dword [esp + 0x110], eax
call fcn.004495a0
cmp byte [esp + 0x228], 0
lea eax, [esp + 0x118]
jne 0x44bbf2
mov eax, dword [esp + 0x114]
xor ecx, ecx
mov word [eax + 4], cx
mov dword [esp + 0x248], ecx
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
lea eax, [esp + 0x10c]
push eax
push edi
mov ecx, ebx
call edx
test al, al
jne 0x44bc4b
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
cmp byte [esp + 0x228], al
jne 0x44bc44
mov eax, dword [esp + 0x114]
lea ecx, [esp + 0x118]
cmp eax, ecx
je 0x44bc44
push eax
call fcn.00498f5b
add esp, 4
xor al, al
jmp 0x44bd99
cmp byte [esp + 0x228], 0
lea eax, [esp + 0x118]
jne 0x44bc63
mov eax, dword [esp + 0x114]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44bd67
shr eax, 4
not al
and al, 1
je 0x44bd67
cmp byte [ebx + 0x992], 0
lea ecx, [esp + 0x3c]
sete dl
movzx eax, dl
push eax
push ecx
call fcn.00456e70
mov byte [esp + 0x248], 1
cmp byte [esp + 0x228], 0
lea eax, [esp + 0x118]
jne 0x44bcbb
mov eax, dword [esp + 0x114]
add eax, 4
push eax
lea edi, [esp + 0x40]
call fcn.004567d0
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], fcn.00499078
mov dword [esp + 0x30], fcn.0049b4da
mov dword [esp + 0x34], fcn.00498f5b
mov dword [esp + 0x38], esi
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
mov byte [esp + 0x24c], 2
call fcn.00457230
xor edi, edi
cmp dword [esp + 0x38], esi
jle 0x44bd44
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
jmp 0x44bd22
xor esi, esi
cmp edi, esi
jl 0x44bd30
cmp edi, dword [esp + 0x38]
jge 0x44bd30
mov esi, dword [esp + 0x18]
call fcn.0044be50
add dword [esp + 0x18], 0x398
inc edi
cmp edi, dword [esp + 0x38]
jl 0x44bd20
lea esi, [esp + 0x1c]
mov byte [esp + 0x248], 1
call fcn.0044c920
lea ecx, [esp + 0x3c]
push ecx
mov byte [esp + 0x24c], 0
call fcn.0044bdc0
cmp byte [esp + 0x228], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x44bd97
mov eax, dword [esp + 0x114]
lea edx, [esp + 0x118]
cmp eax, edx
je 0x44bd97
push eax
call fcn.00498f5b
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00497c58
mov esp, ebp
pop ebp
ret
Function at 0x44cf70
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x804
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x5042c0
push esi
call fcn.0049d7ce
add esp, 8
test eax, eax
je 0x44cfb6
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00497c58
add esp, 0x804
ret
mov eax, 0x4000
test word [0x5042c6], ax
je 0x44d0d7
push edi
push esi
lea ecx, [esp + 0xc]
push str._s.
push ecx
call fcn.0044e3b0
add esp, 0xc
push 0x504070
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44d0d6
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, edi
mov ecx, 0x4de91c
mov eax, 0x50409c
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44d036
test dx, dx
je 0x44d032
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44d036
add eax, 4
add ecx, 4
test dx, dx
jne 0x44d010
xor eax, eax
jmp 0x44d03b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44d0be
mov ecx, 0x4de920
mov eax, 0x50409c
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44d076
test dx, dx
je 0x44d072
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44d076
add eax, 4
add ecx, 4
test dx, dx
jne 0x44d050
xor eax, eax
jmp 0x44d07b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44d0be
push 0x50409c
push esi
lea eax, [esp + 0x14]
push 0x4dc3cc
push eax
call fcn.0044e3b0
add esp, 0x10
test byte [0x504070], 0x10
je 0x44d0af
lea ecx, [esp + 0xc]
push ecx
call fcn.0044cf70
add esp, 4
jmp 0x44d0be
push 4
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x504070
push edi
call ebp
test eax, eax
jne 0x44d000
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.00497c58
add esp, 0x804
ret
Function at 0x44d110
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x804
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x504040
push esi
call fcn.0049d7ce
add esp, 8
test eax, eax
je 0x44d156
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00497c58
add esp, 0x804
ret
mov eax, 0x4000
test word [0x504046], ax
je 0x44d279
push edi
push esi
lea ecx, [esp + 0xc]
push str._s.
push ecx
call fcn.0044e3b0
add esp, 0xc
push 0x503df0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44d25b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, edi
mov ecx, 0x4de91c
mov eax, 0x503e1c
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44d1d6
test dx, dx
je 0x44d1d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44d1d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x44d1b0
xor eax, eax
jmp 0x44d1db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44d243
mov ecx, 0x4de920
mov eax, 0x503e1c
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44d216
test dx, dx
je 0x44d212
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44d216
add eax, 4
add ecx, 4
test dx, dx
jne 0x44d1f0
xor eax, eax
jmp 0x44d21b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44d243
push 0x503e1c
push esi
lea eax, [esp + 0x14]
push 0x4dc3cc
push eax
call fcn.0044e3b0
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.0044d110
add esp, 0x18
push 0x503df0
push edi
call ebx
test eax, eax
jne 0x44d1a0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00497c58
add esp, 0x804
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.00497c58
add esp, 0x804
ret

Function at 0x44d2c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x44d2f6
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.00499078
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44d354
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x4d6528
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44d354
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
mov word [edi], cx
movzx edx, word [eax + 8]
mov word [edi + 2], dx
movzx ecx, word [eax + 0xe]
mov word [edi + 4], cx
movzx edx, word [eax + 0xc]
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x44d361
push esi
call fcn.00498f5b
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x44d370
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0049ca10
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x44d3c9
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00497c58
add esp, 0x214
ret
push edi
push 0x4de8cc
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0049dcea
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x14]
call fcn.0044d2c0
add esp, 0x10
pop edi
test al, al
je 0x44d3b2
movzx ecx, word [esp + 4]
movzx edx, word [esp]
movzx eax, word [esp + 2]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x210]
mov dword [esi + 4], edx
xor edx, edx
mov dword [esi + 8], eax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], dx
mov al, 1
call fcn.00497c58
add esp, 0x214
ret
Function at 0x44e480
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bbd0b
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x368], eax
push ebx
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x380]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], ecx
call fcn.00457460
xor esi, esi
push esi
push edi
push ebx
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x398], esi
call fcn.004435c0
test al, al
je 0x44e548
mov edx, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], esi
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x44e516
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44e516
xor esi, esi
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x374], esi
mov dword [esp + 0x1c], 0
call edi
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x44e58e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44e58e
xor eax, eax
jmp 0x44e590
mov ecx, ebx
call fcn.00447720
push 0x4e2960
push 0x4d65ac
mov edx, eax
call fcn.00448ff0
mov dword [esp + 0x390], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.004434f0
xor al, al
jmp 0x44e5ff
mov eax, esi
mov esi, dword [esp + 0x18]
push eax
mov dword [esi + 8], eax
call fcn.00499078
mov edx, dword [esi + 8]
add esp, 4
push edx
push eax
push ebx
lea ecx, [esp + 0x374]
mov dword [esi + 4], eax
call fcn.00457580
test al, al
jne 0x44e5da
mov ecx, ebx
call fcn.00447720
push 0x4e2960
push 0x4d65ac
mov edx, eax
call fcn.00448ff0
mov dword [esp + 0x390], edi
jmp 0x44e56b
mov dword [esp + 0x388], edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.004434f0
mov al, 1
mov ecx, dword [esp + 0x380]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x368]
xor ecx, esp
call fcn.00497c58
mov esp, ebp
pop ebp
ret 8

Function at 0x44e900
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.004583d0
Function at 0x450170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bc820
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor eax, eax
mov byte [esp + 0x10], al
mov dword [esp + 0xc], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], fcn.00499078
mov dword [esp + 0x28], fcn.0049b4da
mov dword [esp + 0x2c], fcn.00498f5b
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0x1fff8
mov dword [esp + 0x20], vtable.t_heap.0
mov eax, dword [esp + 0x4c]
push eax
push ecx
lea edx, [esp + 0x14]
push edx
lea ebx, [esp + 0x20]
mov byte [esp + 0x4c], 1
call fcn.00459c10
test al, al
jne 0x450222
mov esi, ebx
mov byte [esp + 0x40], al
call fcn.00459950
lea ecx, [esp + 0xc]
call fcn.004476c0
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x38
ret 8
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00450670
lea esi, [esp + 0x14]
mov byte [esp + 0x40], 0
call fcn.00459950
lea ecx, [esp + 0xc]
call fcn.004476c0
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x38
ret 8