joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443bb2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x558ade
call fcn.004d8d80
push ecx
mov eax, dword [0x62b3ec]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov eax, dword [0x62b3ec]
and dword [ebp - 4], 0
mov dword [esi + 0xc], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x30], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x34], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x50], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x54], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x58], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x68], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x80], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x84], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x88], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x98], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x9c], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xa0], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xa8], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xac], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xb0], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xb4], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xdc], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xe0], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xe4], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xe8], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0xec], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x11c], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x120], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x124], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x13c], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x140], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x144], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x148], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x150], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x160], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x164], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x168], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x16c], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x170], eax
mov eax, dword [0x62b3ec]
mov dword [esi + 0x174], eax
mov byte [ebp - 4], 0x24
call fcn.00452327
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x443db1
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x558cc8
call fcn.004d8d80
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x174]
mov dword [ebp - 4], 0x23
call fcn.0053da4f
lea ecx, [esi + 0x170]
mov byte [ebp - 4], 0x22
call fcn.0053da4f
lea ecx, [esi + 0x16c]
mov byte [ebp - 4], 0x21
call fcn.0053da4f
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 0x20
call fcn.0053da4f
lea ecx, [esi + 0x164]
mov byte [ebp - 4], 0x1f
call fcn.0053da4f
lea ecx, [esi + 0x160]
mov byte [ebp - 4], 0x1e
call fcn.0053da4f
lea ecx, [esi + 0x150]
mov byte [ebp - 4], 0x1d
call fcn.0053da4f
lea ecx, [esi + 0x148]
mov byte [ebp - 4], 0x1c
call fcn.0053da4f
lea ecx, [esi + 0x144]
mov byte [ebp - 4], 0x1b
call fcn.0053da4f
lea ecx, [esi + 0x140]
mov byte [ebp - 4], 0x1a
call fcn.0053da4f
lea ecx, [esi + 0x13c]
mov byte [ebp - 4], 0x19
call fcn.0053da4f
lea ecx, [esi + 0x124]
mov byte [ebp - 4], 0x18
call fcn.0053da4f
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 0x17
call fcn.0053da4f
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 0x16
call fcn.0053da4f
lea ecx, [esi + 0xec]
mov byte [ebp - 4], 0x15
call fcn.0053da4f
lea ecx, [esi + 0xe8]
mov byte [ebp - 4], 0x14
call fcn.0053da4f
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 0x13
call fcn.0053da4f
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], 0x12
call fcn.0053da4f
lea ecx, [esi + 0xdc]
mov byte [ebp - 4], 0x11
call fcn.0053da4f
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 0x10
call fcn.0053da4f
lea ecx, [esi + 0xb0]
mov byte [ebp - 4], 0xf
call fcn.0053da4f
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 0xe
call fcn.0053da4f
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 0xd
call fcn.0053da4f
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 0xc
call fcn.0053da4f
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 0xb
call fcn.0053da4f
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 0xa
call fcn.0053da4f
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 9
call fcn.0053da4f
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 8
call fcn.0053da4f
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 7
call fcn.0053da4f
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 6
call fcn.0053da4f
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 5
call fcn.0053da4f
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 4
call fcn.0053da4f
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
call fcn.0053da4f
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
call fcn.0053da4f
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0053da4f
and byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.0053da4f
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 8]
call fcn.0053da4f
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x444917
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x558dd0
call fcn.004d8d80
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 2
jne 0x444989
mov eax, dword [0x62b3ec]
mov dword [ebp - 0x14], eax
push dword [esi + 0xcc]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
mov dword [ebp - 4], ebx
call edi
push dword [esi + 0xcc]
test eax, eax
je 0x44494e
call fcn.00423326
pop ecx
jmp 0x4449a2
lea eax, [ebp - 0x10]
push eax
call fcn.00422b46
pop ecx
pop ecx
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
call edi
test eax, eax
jne 0x44498e
push ebx
push ebx
push 0x5abac8
call fcn.00546161
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0053da4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0053da4f
or eax, 0xffffffff
jmp 0x4449b0
push dword [ebp - 0x10]
call fcn.0042339e
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.0053da4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0053da4f
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4449cc
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x558dec
call fcn.004d8d80
sub esp, 0xc
push esi
mov esi, ecx
call fcn.0041105a
test eax, eax
jne 0x4449e0
or eax, 0xffffffff
jmp 0x444a9e
mov eax, dword [0x62b3ec]
push ebx
push edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00444cff
test eax, eax
je 0x444a06
or ebx, 0xffffffff
jmp 0x444a8e
push dword [ebp - 0x14]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
test eax, eax
je 0x4449fe
push 0x633610
lea ecx, [ebp - 0x10]
call fcn.0053dac3
mov esi, 0x5a1c20
lea ecx, [ebp - 0x10]
push esi
mov byte [ebp - 4], 1
call fcn.0053de40
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.0053de7c
push esi
lea ecx, [ebp - 0x10]
call fcn.0053de40
lea eax, [ebp - 0x18]
push eax
call fcn.00404be2
pop ecx
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x444a68
push 5
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push ebx
jmp 0x444a74
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.0053da4f
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0053da4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0053da4f
mov eax, ebx
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x44a864
Capabilities:
Check if file exists

Disassembly:
push dword [0x6336d0]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44a889
push 0
push 0x414
push dword [0x6336d0]
call fcn.00421d93
add esp, 0xc
ret

Function at 0x44c2df
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x559168
call fcn.004d8d80
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
push 0x633610
lea ecx, [ebp - 0x10]
call fcn.0053dac3
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
jle 0x44c361
jmp 0x44c300
xor ebx, ebx
cmp edi, ebx
jl 0x44c30f
cmp edi, dword [esi + 0x10]
jge 0x44c30f
mov eax, dword [esi + 0xc]
mov ebx, dword [eax + edi*4]
mov ecx, ebx
call fcn.00411037
test eax, eax
je 0x44c359
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x44c330
push 0x5a1c1c
lea ecx, [ebp - 0x10]
call fcn.0053de40
push 0x5a1c20
lea ecx, [ebp - 0x10]
call fcn.0053de40
add ebx, 0x474
lea ecx, [ebp - 0x10]
push ebx
call fcn.0053de7c
push 0x5a1c20
lea ecx, [ebp - 0x10]
call fcn.0053de40
inc edi
cmp edi, dword [esi + 0x10]
jl 0x44c2fe
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x44c3a4
lea eax, [ebp - 0x14]
push eax
call fcn.00404be2
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push 1
push ebx
je 0x44c38c
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
jmp 0x44c395
push ebx
push dword [ebp - 0x10]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.0053da4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0053da4f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x44e8b4
Capabilities:
Resume thread

Disassembly:
mov eax, 0x55956d
call fcn.004d8d80
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
xor ebx, ebx
lea edi, [ecx + 0x84]
push 0x80
call fcn.0053d788
pop ecx
mov dword [ebp - 0x14], eax
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], esi
je 0x44e8f2
push ebx
mov ecx, eax
push dword [ebp - 0x10]
call fcn.0044f187
mov esi, eax
or eax, 0xffffffff
test esi, esi
mov dword [ebp - 4], eax
je 0x44e92e
push 0
push 0
push 4
mov ecx, esi
call fcn.0053eb7c
test eax, eax
je 0x44e93d
push 0
mov dword [edi], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc ebx
add edi, 4
cmp ebx, 2
jl 0x44e8ce
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
test esi, esi
je 0x44e94a
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x44e92e
Function at 0x44fe68
Capabilities:
Resume thread

Disassembly:
mov eax, 0x5596e9
call fcn.004d8d80
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
xor ebx, ebx
lea edi, [ecx + 0x78]
push 0x80
call fcn.0053d788
pop ecx
mov dword [ebp - 0x14], eax
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], esi
je 0x44fea3
push ebx
mov ecx, eax
push dword [ebp - 0x10]
call fcn.0045063c
mov esi, eax
or eax, 0xffffffff
test esi, esi
mov dword [ebp - 4], eax
je 0x44fedf
push 0
push 0
push 4
mov ecx, esi
call fcn.0053eb7c
test eax, eax
je 0x44feee
push 0
mov dword [edi], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc ebx
add edi, 4
cmp ebx, 2
jl 0x44fe7f
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
test esi, esi
je 0x44fefb
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x44fedf

Function at 0x452648
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5598fc
call fcn.004d8d80
sub esp, 0xc
mov eax, dword [0x633640]
push esi
mov esi, ecx
cmp dword [eax - 8], 0
je 0x452769
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x452769
mov eax, dword [0x62b3ec]
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
mov eax, dword [esi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
je 0x45269c
or esi, 0xffffffff
jmp 0x452759
mov eax, dword [0x62b3ec]
push edi
mov dword [ebp - 0x14], eax
cmp dword [esi + 0x14], 0
mov byte [ebp - 4], 1
mov edi, 0x5a22e0
je 0x4526e0
push 0x5ad7d0
lea ecx, [ebp - 0x10]
call fcn.0053de40
mov eax, dword [esi + 0x14]
cdq
push edx
push eax
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00536b61
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.0053de7c
push 0x5ad7a8
lea ecx, [ebp - 0x10]
call fcn.0053de40
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00536b61
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.0053de7c
mov eax, dword [0x62b3ec]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push dword [0x633640]
push str.CMD__C____s___s_
push eax
call fcn.00536b61
mov eax, dword [esi]
add esp, 0x10
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call dword [eax + 4]
lea ecx, [ebp - 0x18]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.0053da4f
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0053da4f
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0053da4f
mov eax, esi
jmp 0x45276c
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x453f94
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x559b00
call fcn.004d8d80
sub esp, 0x58
push esi
lea ecx, [ebp - 0x64]
call fcn.00453dbc
push dword [ebp + 0x24]
xor esi, esi
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004539b0
cmp eax, esi
je 0x453fde
mov dword [ebp - 4], 1
mov esi, eax
jmp 0x453ffe
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x453ff7
mov dword [ebp - 4], 2
or esi, 0xffffffff
jmp 0x453ffe
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x54]
call fcn.0053da4f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x454015
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x559b2c
call fcn.004d8d80
sub esp, 0x58
push esi
lea ecx, [ebp - 0x64]
call fcn.00453dbc
push dword [ebp + 0x14]
xor esi, esi
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00453c95
cmp eax, esi
je 0x454053
mov dword [ebp - 4], 1
mov esi, eax
jmp 0x454073
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45406c
mov dword [ebp - 4], 2
or esi, 0xffffffff
jmp 0x454073
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x54]
call fcn.0053da4f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4549ec
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x559bf0
call fcn.004d8d80
sub esp, 0xc
push esi
push edi
push dword [ebp + 8]
mov edi, 0x633638
push str._sMediaProbe.exe
push edi
call fcn.00536b61
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [0x633638]
call esi
test eax, eax
jne 0x454a2f
push str.MediaProbe.exe
mov ecx, edi
call fcn.0053dbe6
push dword [ebp + 8]
mov edi, 0x63363c
push str._sMediaPlay.exe
push edi
call fcn.00536b61
add esp, 0xc
push dword [0x63363c]
call esi
test eax, eax
jne 0x454a5d
push str.MediaPlay.exe
mov ecx, edi
call fcn.0053dbe6
push dword [ebp + 8]
mov edi, 0x633640
push str._sMediaEncode.exe
push edi
call fcn.00536b61
add esp, 0xc
push dword [0x633640]
call esi
test eax, eax
jne 0x454a8b
push str.MediaEncode.exe
mov ecx, edi
call fcn.0053dbe6
push dword [0x633640]
lea eax, [ebp - 0x18]
push eax
call fcn.00422b46
pop ecx
pop ecx
and dword [ebp - 4], 0
push str.Presets
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0053dcf4
push eax
mov ecx, 0x633644
mov byte [ebp - 4], 1
call fcn.0053db96
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0053da4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0053da4f
cmp dword [0x633648], 0
jne 0x454b72
mov eax, dword [0x62b3ec]
mov dword [ebp - 0x10], eax
push 2
lea eax, [ebp - 0x10]
pop edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
push str._s_avcodec_58.dll
push eax
call fcn.00536b61
add esp, 0xc
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x454b1a
mov dword [0x633648], 4
jmp 0x454b66
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._s_avcodec_57.dll
push eax
call fcn.00536b61
add esp, 0xc
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x454b43
mov dword [0x633648], 3
jmp 0x454b66
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._s_avcodec_56.dll
push eax
call fcn.00536b61
add esp, 0xc
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x454b66
mov dword [0x633648], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0053da4f
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [0x63364c], 1
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x454b8c
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push dword [0x633638]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x454ba0
or eax, 0xffffffff
ret
xor eax, eax
push eax
push eax
push eax
push dword [0x633638]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
ret
Function at 0x454bd7
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x559c0c
call fcn.004d8d80
push ecx
push ecx
mov eax, dword [0x633638]
push esi
mov esi, ecx
cmp dword [eax - 8], 0
je 0x454c9d
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x454c9d
mov eax, dword [0x62b3ec]
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
mov eax, dword [esi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
je 0x454c27
or esi, 0xffffffff
jmp 0x454c8d
mov eax, dword [0x62b3ec]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
mov byte [ebp - 4], 1
je 0x454c58
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
push dword [0x633638]
push str.CMD__C____s___s____s__
push eax
call fcn.00536b61
add esp, 0x14
jmp 0x454c72
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push dword [0x633638]
push str.CMD__C____s___s_
push eax
call fcn.00536b61
add esp, 0x10
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x10]
call dword [eax + 4]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0053da4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0053da4f
mov eax, esi
jmp 0x454ca0
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x454e41
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x559c44
call fcn.004d8d80
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x454e7e
lea eax, [ebp + 8]
push ebx
push eax
call fcn.00422b46
pop ecx
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp + 8]
call fcn.0053da4f
lea eax, [ebp - 0x10]
push eax
call fcn.0042d665
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x24]
call fcn.00421bd3
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0053da4f
push ebx
lea ecx, [esi + 0xc]
call fcn.0053dbe6
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x20]
lea ecx, [esi + 8]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.00454bd7
test eax, eax
je 0x454ed1
mov esi, eax
jmp 0x454f09
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push edi
push dword [ebp - 0x20]
call dword [eax + 0x14]
test eax, eax
je 0x454eeb
or esi, 0xffffffff
jmp 0x454f09
mov eax, dword [edi + 0x18]
or eax, dword [edi + 0x1c]
jne 0x454f00
push ebx
call fcn.00422c11
mov dword [edi + 0x18], eax
pop ecx
mov dword [edi + 0x1c], edx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00421c40
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x45df9d
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x633610
mov dword [edi], esi
call fcn.0053dbe6
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
push 1
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45e07e
cmp dword [ebp + 8], esi
je 0x45e07e
push ebx
push 4
pop eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push str.ProxyEnable
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x45e01d
cmp dword [ebp - 0xc], esi
setne al
mov dword [edi], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x80a]
mov word [ebp - 0x80c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 4]
push eax
push esi
push str.ProxyServer
mov dword [ebp - 8], 0x400
push dword [ebp + 8]
call ebx
test eax, eax
pop ebx
jne 0x45e071
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x80c]
push eax
call fcn.0053dbe6
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x45e081
or eax, 0xffffffff
pop edi
pop esi
leave
ret 8

Function at 0x45ebdf
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x55a670
call fcn.004d8d80
push ecx
mov eax, dword [0x62b3ec]
push esi
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push str._sNIO_curl.exe
push eax
call fcn.00536b61
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x45ec28
lea eax, [ebp - 0x10]
mov ecx, 0x633628
push eax
call fcn.0053db96
cmp dword [0x63361c], 0
jne 0x45ec46
push dword [0x633628]
call esi
neg eax
sbb eax, eax
and eax, 2
dec eax
mov dword [0x63361c], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._sNIO_msdl.exe
push eax
call fcn.00536b61
add esp, 0xc
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x45ec71
lea eax, [ebp - 0x10]
mov ecx, 0x63362c
push eax
call fcn.0053db96
cmp dword [0x633620], 0
jne 0x45ec8f
push dword [0x63362c]
call esi
neg eax
sbb eax, eax
and eax, 2
dec eax
mov dword [0x633620], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._sNIO_rtmp.exe
push eax
call fcn.00536b61
add esp, 0xc
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x45ecba
lea eax, [ebp - 0x10]
mov ecx, 0x633630
push eax
call fcn.0053db96
cmp dword [0x633624], 0
jne 0x45ecd8
push dword [0x633630]
call esi
neg eax
sbb eax, eax
and eax, 2
dec eax
mov dword [0x633624], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0053da4f
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret