joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443166
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x57f1b0
call fcn.00508ecc
sub esp, 0x50
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x14], 0x596dc8
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 7
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x10], edi
jne 0x4431b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffe
pop eax
jmp 0x44324b
lea ecx, [ebp - 0x5c]
call fcn.00442ca7
lea eax, [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x5c]
push 0x48
push eax
push edi
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4431f5
mov ax, word [ebp - 0x1c]
mov cx, word [ebp - 0x1a]
cmp ax, 3
mov word [esi + 4], ax
mov word [esi + 6], cx
ja 0x4431f5
movzx eax, ax
dec eax
je 0x44322b
dec eax
je 0x443218
dec eax
je 0x443205
cmp edi, ebx
je 0x443200
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x44324b
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00443504
jmp 0x44323c
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00443c0b
jmp 0x44323c
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00443f9b
cmp edi, ebx
mov esi, eax
je 0x443249
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x447636
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x57fa6b
call fcn.00508ecc
push ecx
mov eax, dword [0x663758]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], eax
mov eax, dword [0x663758]
and dword [ebp - 4], 0
mov dword [esi + 0x10], eax
mov eax, dword [0x663758]
mov dword [esi + 0x18], eax
mov eax, dword [0x663758]
mov dword [esi + 0x1c], eax
mov eax, dword [0x663758]
mov dword [esi + 0x20], eax
mov eax, dword [0x663758]
mov dword [esi + 0x24], eax
mov eax, dword [0x663758]
mov dword [esi + 0x28], eax
mov eax, dword [0x663758]
mov dword [esi + 0x2c], eax
mov eax, dword [0x663758]
mov dword [esi + 0x30], eax
mov eax, dword [0x663758]
mov dword [esi + 0x48], eax
mov eax, dword [0x663758]
mov dword [esi + 0x58], eax
mov eax, dword [0x663758]
mov dword [esi + 0x70], eax
mov eax, dword [0x663758]
mov dword [esi + 0x74], eax
mov eax, dword [0x663758]
mov dword [esi + 0x78], eax
mov eax, dword [0x663758]
mov dword [esi + 0x7c], eax
mov eax, dword [0x663758]
mov dword [esi + 0x80], eax
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0xf
call fcn.00435153
push 0
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 0x10
call fcn.004e50d0
mov ecx, esi
mov byte [ebp - 4], 0x11
mov dword [esi], 0x597f7c
call fcn.00446d90
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44770e
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x57fb39
call fcn.00508ecc
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x597f7c
lea edi, [esi + 0x168]
mov dword [ebp - 4], 0x10
mov ecx, edi
mov dword [edi], 0x594640
call fcn.004e51a0
mov ecx, edi
call fcn.004e50f0
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0xf
call fcn.00435453
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0xe
call fcn.0055ff75
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 0xd
call fcn.0055ff75
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xc
call fcn.0055ff75
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 0xb
call fcn.0055ff75
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0xa
call fcn.0055ff75
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 9
call fcn.0055ff75
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 8
call fcn.0055ff75
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 7
call fcn.0055ff75
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 6
call fcn.0055ff75
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 5
call fcn.0055ff75
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.0055ff75
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 3
call fcn.0055ff75
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.0055ff75
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0055ff75
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.0055ff75
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.0055ff75
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x447719
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x57fb39
call fcn.00508ecc
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x597f7c
lea edi, [esi + 0x168]
mov dword [ebp - 4], 0x10
mov ecx, edi
mov dword [edi], 0x594640
call fcn.004e51a0
mov ecx, edi
call fcn.004e50f0
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0xf
call fcn.00435453
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0xe
call fcn.0055ff75
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 0xd
call fcn.0055ff75
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xc
call fcn.0055ff75
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 0xb
call fcn.0055ff75
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0xa
call fcn.0055ff75
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 9
call fcn.0055ff75
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 8
call fcn.0055ff75
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 7
call fcn.0055ff75
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 6
call fcn.0055ff75
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 5
call fcn.0055ff75
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.0055ff75
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 3
call fcn.0055ff75
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.0055ff75
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0055ff75
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.0055ff75
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.0055ff75
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x448430
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x57fe44
call fcn.00508ecc
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x448511
xor ebx, ebx
mov esi, 0x3e8
push dword [ebp + 0xc]
call fcn.004108d4
cmp eax, 0xffffffff
pop ecx
jne 0x448511
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x448511
push dword [ebp + 0x10]
push esi
call fcn.00413c2e
pop ecx
test eax, eax
pop ecx
jne 0x448490
add ebx, esi
cmp ebx, 0x1388
jl 0x448458
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4484dd
push str.If_you_are_previewing_the_downloading_video_audio__please_stop_previewing__then_click_OK_button.
lea ecx, [ebp - 0x10]
call fcn.0055ffe9
push 0x31
push 0x5d375c
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x4484d1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0055ff75
push 1
pop eax
jmp 0x448518
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0055ff75
xor ebx, ebx
push dword [ebp + 0xc]
call fcn.004108d4
cmp eax, 0xffffffff
pop ecx
jne 0x448511
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x448511
push dword [ebp + 0x10]
push esi
call fcn.00413c2e
pop ecx
test eax, eax
pop ecx
jne 0x448515
add ebx, esi
cmp ebx, 0x2710
jge 0x448515
jmp 0x4484df
xor eax, eax
jmp 0x448518
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x448527
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x4485a3
push dword [ebp + 0x10]
call esi
xor ebx, ebx
test eax, eax
je 0x448561
cmp dword [ebp + 0x14], ebx
je 0x4485a8
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00448430
add esp, 0xc
test eax, eax
jl 0x4485a8
mov edi, 0x3e8
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004108f8
add esp, 0xc
cmp eax, 0xffffffff
jne 0x44859f
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x4485a3
push dword [ebp + 0x18]
push edi
call fcn.00413c2e
pop ecx
test eax, eax
pop ecx
jne 0x4485a8
add ebx, edi
cmp ebx, 0x1388
jge 0x4485a8
jmp 0x448566
xor eax, eax
jmp 0x4485ab
push 0xfffffffffffffffe
pop eax
jmp 0x4485ab
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x448d90
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
push esi
push str.Shell_TrayWnd
mov dword [ebx + 4], eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
push 5
mov dword [ebp - 0x3c], 0x24
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
jne 0x448df9
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push esi
call edi
push 1
mov esi, eax
call edi
mov edx, dword [ebx]
sub esi, edx
lea ecx, [esi - 1]
mov dword [ebx + 0x3c], ecx
add ecx, edx
mov dword [ebx + 0x44], ecx
mov ecx, dword [ebx + 4]
sub eax, ecx
dec eax
mov dword [ebx + 0x40], eax
add eax, ecx
jmp 0x448e6a
mov eax, dword [ebp - 0x30]
and byte [ebp - 1], 0
and byte [ebp + 0xf], 0
sub eax, esi
je 0x448e21
dec eax
je 0x448e1b
dec eax
je 0x448e11
dec eax
jne 0x448e29
and byte [ebp - 1], 0
and byte [ebp + 0xf], 0
jmp 0x448e29
mov byte [ebp - 1], 1
jmp 0x448e15
and byte [ebp - 1], 0
mov byte [ebp + 0xf], 1
lea eax, [ebp - 0x18]
push esi
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp byte [ebp + 0xf], 0
je 0x448e43
mov eax, dword [ebp - 0x18]
inc eax
jmp 0x448e49
mov eax, dword [ebp - 0x10]
sub eax, dword [ebx]
dec eax
mov dword [ebx + 0x3c], eax
add eax, dword [ebx]
cmp byte [ebp - 1], 0
mov dword [ebx + 0x44], eax
je 0x448e5d
mov eax, dword [ebp - 0x14]
inc eax
jmp 0x448e64
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 4]
dec eax
mov dword [ebx + 0x40], eax
add eax, dword [ebx + 4]
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0x4c]
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], 4
jmp 0x448e7f
mov eax, dword [ebp + 0xc]
lea esi, [eax - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or ecx, 0xffffffff
movsd dword es:[edi], dword [esi]
sub ecx, dword [ebx + 4]
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
add dword [ebp + 0xc], 0x10
dec dword [ebp - 8]
jne 0x448e7c
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x44f0eb
Capabilities:
Check if file exists

Disassembly:
push dword [0x66b59c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44f110
push 0
push 0x414
push dword [0x66b59c]
call fcn.00410857
add esp, 0xc
ret

Function at 0x450291
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x58030c
call fcn.00508ecc
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
push 0x66b504
lea ecx, [ebp - 0x10]
call fcn.0055ffe9
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0x34], ebx
mov dword [ebp - 4], ebx
jle 0x450313
jmp 0x4502b2
xor ebx, ebx
cmp edi, ebx
jl 0x4502c1
cmp edi, dword [esi + 0x34]
jge 0x4502c1
mov eax, dword [esi + 0x30]
mov ebx, dword [eax + edi*4]
mov ecx, ebx
call fcn.00450373
test eax, eax
je 0x45030b
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x4502e2
push 0x5d4160
lea ecx, [ebp - 0x10]
call fcn.00560366
push 0x5d3f68
lea ecx, [ebp - 0x10]
call fcn.00560366
add ebx, 0x69c
lea ecx, [ebp - 0x10]
push ebx
call fcn.005603a2
push 0x5d3f68
lea ecx, [ebp - 0x10]
call fcn.00560366
inc edi
cmp edi, dword [esi + 0x34]
jl 0x4502b0
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x450356
lea eax, [ebp - 0x14]
push eax
call fcn.00404191
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push 1
push ebx
je 0x45033e
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
jmp 0x450347
push ebx
push dword [ebp - 0x10]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.0055ff75
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0055ff75
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4553ef
Capabilities:
Resume thread

Disassembly:
mov eax, 0x580ad5
call fcn.00508ecc
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 0x70
call fcn.00560564
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x455420
push dword [edi]
call fcn.0045530e
mov esi, eax
jmp 0x455422
xor esi, esi
or eax, 0xffffffff
cmp esi, ebx
mov dword [ebp - 4], eax
je 0x455470
push ebx
push ebx
push 4
mov ecx, esi
call fcn.0056428a
test eax, eax
jne 0x455449
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x455470
mov ecx, dword [edi]
push ebx
push 0x64
push ebx
mov eax, dword [ecx]
push ebx
call dword [eax + 0x128]
push ebx
mov dword [edi + 4], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x455715
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x580c1d
call fcn.00508ecc
push ecx
mov eax, dword [0x663758]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [ecx], eax
mov eax, dword [0x663758]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], eax
mov eax, dword [0x663758]
mov dword [esi + 0x1c], eax
mov eax, dword [0x663758]
mov dword [esi + 0x3c], eax
mov eax, dword [0x663758]
mov dword [esi + 0x40], eax
mov eax, dword [0x663758]
mov dword [esi + 0x44], eax
mov eax, dword [0x663758]
mov dword [esi + 0x48], eax
mov edi, 0x66b504
mov byte [ebp - 4], 6
push edi
mov dword [esi], ebx
mov dword [esi + 4], 1
call fcn.0056010c
push edi
lea ecx, [esi + 0xc]
call fcn.0056010c
push edi
lea ecx, [esi + 0x1c]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call fcn.0056010c
push edi
lea ecx, [esi + 0x3c]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 0x14
call fcn.0056010c
push edi
lea ecx, [esi + 0x40]
call fcn.0056010c
push edi
lea ecx, [esi + 0x44]
call fcn.0056010c
push edi
lea ecx, [esi + 0x48]
call fcn.0056010c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4583f7
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x581076
call fcn.00508ecc
sub esp, 0x2a0
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00419e41
pop ecx
mov eax, dword [eax]
push 1
xor edi, edi
push 1
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.00410387
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0055ff75
lea ecx, [ebp - 0xe4]
call fcn.004581a8
push dword [ebp + 0x2c]
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 3
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.00457d9b
mov esi, eax
cmp esi, edi
je 0x458491
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.0055ff75
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x59a388
call fcn.00424c54
jmp 0x4585ba
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4584c7
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 5
call fcn.0055ff75
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x59a388
call fcn.00424c54
or esi, 0xffffffff
jmp 0x4585ba
push edi
lea ecx, [ebp - 0x2ac]
call fcn.004e50d0
push 3
lea ecx, [ebp - 0x2ac]
push dword [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.004e6240
test al, al
jne 0x45851b
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ac], 0x594640
call fcn.004e51a0
lea ecx, [ebp - 0x2ac]
call fcn.004e50f0
mov byte [ebp - 4], 7
or esi, 0xffffffff
jmp 0x45859d
cmp dword [ebp + 0x24], edi
jle 0x458563
cmp dword [ebp + 0x20], edi
jle 0x458563
lea ecx, [ebp - 0x2ac]
call fcn.004e4070
lea ecx, [ebp - 0x2ac]
mov esi, eax
call fcn.004e4060
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
lea eax, [ebp + 0x18]
push esi
push eax
call fcn.00459ee2
push dword [ebp + 0x1c]
lea eax, [ebp - 0x2ac]
push dword [ebp + 0x18]
push eax
call fcn.0041255b
add esp, 0x20
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2ac]
push edi
push eax
call fcn.004e56f0
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ac], 0x594640
call fcn.004e51a0
lea ecx, [ebp - 0x2ac]
call fcn.004e50f0
mov byte [ebp - 4], 8
xor esi, esi
lea ecx, [ebp - 0x74]
call fcn.0055ff75
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x594f94
call fcn.00424c11
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004103f4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4585d6
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5810ac
call fcn.00508ecc
sub esp, 0xc0
push esi
lea ecx, [ebp - 0xcc]
call fcn.004581a8
push dword [ebp + 0x14]
xor esi, esi
lea ecx, [ebp - 0xcc]
mov dword [ebp - 4], esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00458083
cmp eax, esi
je 0x45861d
mov dword [ebp - 4], 1
mov esi, eax
jmp 0x45863d
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x458636
mov dword [ebp - 4], 2
or esi, 0xffffffff
jmp 0x45863d
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.0055ff75
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0x594f94
call fcn.00424c11
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x459f45
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x581280
call fcn.00508ecc
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, 0x66b51c
push str._sMediaProbe.exe
push edi
call fcn.0055d1d9
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [0x66b51c]
call esi
test eax, eax
jne 0x459f89
push str.MediaProbe.exe
mov ecx, edi
call fcn.0056010c
push ebx
mov edi, 0x66b520
push str._sMediaEncode.exe
push edi
call fcn.0055d1d9
add esp, 0xc
push dword [0x66b520]
call esi
test eax, eax
jne 0x459fb5
push str.MediaEncode.exe
mov ecx, edi
call fcn.0056010c
push dword [0x66b520]
lea eax, [ebp - 0x14]
push eax
call fcn.00411487
pop ecx
pop ecx
and dword [ebp - 4], 0
push 0x5e5804
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0056021a
push eax
mov ecx, 0x66b524
mov byte [ebp - 4], 1
call fcn.005600bc
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0055ff75
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0055ff75
push ebx
mov edi, 0x66b528
push str._sMediaPlay.exe
push edi
call fcn.0055d1d9
add esp, 0xc
push dword [0x66b528]
call esi
test eax, eax
jne 0x45a02c
push str.MediaPlay.exe
mov ecx, edi
call fcn.0056010c
cmp dword [0x66b52c], 0
jne 0x45a130
mov eax, dword [0x663758]
mov dword [ebp + 8], eax
push 2
lea eax, [ebp + 8]
pop edi
push ebx
push str._s_avcodec_60.dll
push eax
mov dword [ebp - 4], edi
call fcn.0055d1d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a06c
mov dword [0x66b52c], 6
cmp dword [0x66b52c], 0
jne 0x45a124
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_59.dll
push eax
call fcn.0055d1d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a09e
mov dword [0x66b52c], 5
cmp dword [0x66b52c], 0
jne 0x45a124
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_58.dll
push eax
call fcn.0055d1d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a0cc
mov dword [0x66b52c], 4
cmp dword [0x66b52c], 0
jne 0x45a124
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_57.dll
push eax
call fcn.0055d1d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a0fa
mov dword [0x66b52c], 3
cmp dword [0x66b52c], 0
jne 0x45a124
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_56.dll
push eax
call fcn.0055d1d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a124
mov dword [0x66b52c], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0055ff75
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x66b530], 1
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45a14b
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [0x66b528]
call esi
test eax, eax
je 0x45a16b
xor eax, eax
push eax
push eax
push eax
push dword [0x66b528]
jmp 0x45a19b
push dword [0x66b520]
call esi
test eax, eax
je 0x45a184
xor eax, eax
push eax
push eax
push eax
push dword [0x66b520]
jmp 0x45a19b
push dword [0x66b51c]
call esi
test eax, eax
je 0x45a1a3
xor eax, eax
push eax
push eax
push eax
push dword [0x66b51c]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop esi
ret

Function at 0x45a408
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x5812dc
call fcn.00508ecc
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45a446
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00411487
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.0055ff75
lea eax, [ebp - 0x14]
push eax
call fcn.00419e41
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00410387
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0055ff75
push dword [ebp + 8]
lea edi, [esi + 0x70]
mov ecx, edi
call fcn.0056010c
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 0x68]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0045a1c8
test eax, eax
je 0x45a49d
mov esi, eax
jmp 0x45a4d2
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x28]
test eax, eax
je 0x45a4b7
or esi, 0xffffffff
jmp 0x45a4d2
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x2c]
or esi, 0xffffffff
cmp eax, esi
je 0x45a4d2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004103f4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x45f6e4
Capabilities:
Resume thread

Disassembly:
mov eax, 0x581fa5
call fcn.00508ecc
push ecx
push esi
mov esi, ecx
push 0x74
call fcn.00560564
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x45f709
push dword [ebp + 8]
push esi
call fcn.004609b6
mov esi, eax
jmp 0x45f70b
xor esi, esi
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x45f72d
push 0
push 0
push 4
mov ecx, esi
call fcn.0056428a
test eax, eax
jne 0x45f731
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
xor eax, eax
jmp 0x45f747
push 0
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4