joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45a7f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x1c]
xor edi, edi
test eax, eax
mov dword [esp + 0x18], 6
jle 0x432779
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x432771
mov edx, dword [ecx]
push 1
call dword [edx + 8]
mov eax, dword [esi + 0x1c]
inc edi
cmp edi, eax
jl 0x432760
mov ebx, dword [sym.imp.MSVCRT.dll_free]
mov dword [esi + 0x1c], 0
mov ecx, 0x11
xor eax, eax
lea edi, [esi + 0xe8]
mov dword [esi], 0
mov dword [esi + 8], 0
rep stosd dword es:[edi], eax
mov dword [esi + 0x8c], 0x45ca18
mov eax, dword [esi + 0x84]
test eax, eax
mov dword [esi + 0x78], 0x45ca40
je 0x4327c3
push eax
call ebx
add esp, 4
mov dword [esi + 0x78], 0x45ca3c
mov eax, dword [esi + 0x70]
test eax, eax
mov dword [esi + 0x64], 0x45ca38
je 0x4327de
push eax
call ebx
add esp, 4
mov dword [esi + 0x64], 0x45ca34
mov eax, dword [esi + 0x5c]
test eax, eax
mov dword [esi + 0x50], 0x45ca30
je 0x4327f9
push eax
call ebx
add esp, 4
mov dword [esi + 0x50], 0x45ca2c
mov eax, dword [esi + 0x48]
test eax, eax
mov dword [esi + 0x3c], 0x45ca28
je 0x432814
push eax
call ebx
add esp, 4
mov dword [esi + 0x3c], 0x45ca24
mov eax, dword [esi + 0x34]
test eax, eax
mov dword [esi + 0x28], 0x45ca20
je 0x43282f
push eax
call ebx
add esp, 4
mov edi, 0x45ca1c
mov dword [esi + 0x28], edi
mov eax, dword [esi + 0x20]
test eax, eax
mov dword [esi + 0x14], 0x45ca20
je 0x43284b
push eax
call ebx
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x14], edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x432860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45a868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
lea edi, [esi + 0x14]
push ebp
push ebp
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.00434770
mov dword [edi], 0x45ca20
mov dword [edi + 0x10], ebp
mov dword [edi + 0xc], ebp
lea ecx, [esi + 0x28]
mov dword [esp + 0x34], ebp
call fcn.00434230
lea ecx, [esi + 0x3c]
mov byte [esp + 0x34], 1
call fcn.00434250
lea ecx, [esi + 0x50]
mov byte [esp + 0x34], 2
call fcn.00434270
lea ecx, [esi + 0x64]
mov byte [esp + 0x34], 3
call fcn.00434290
lea ecx, [esi + 0x78]
mov byte [esp + 0x34], 4
call fcn.004342b0
mov edi, 0x45ca18
mov dword [esi + 0x90], ebp
mov dword [esi + 0x8c], edi
mov dword [esi + 0x94], ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esi + 0x98]
mov byte [esp + 0x44], 6
call fcn.00433d20
push ebp
push ebp
push ebp
push ebp
lea ecx, [esi + 0xa8]
call fcn.00433d20
push ebp
push ebp
push ebp
push ebp
lea ecx, [esi + 0xb8]
call fcn.00433d20
push ebp
push ebp
push ebp
push ebp
lea ecx, [esi + 0xc8]
call fcn.00433d20
mov ecx, esi
call fcn.00433760
mov ebx, dword [esp + 0x3c]
xor edx, edx
cmp ebx, ebp
mov dword [esp + 0x34], 7
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
je 0x432969
cmp word [ebx], bp
je 0x432969
inc edx
cmp word [ebx + edx*2], bp
jne 0x43295e
mov dword [esp + 0x1c], edx
mov eax, dword [esi + 0x1c]
xor edi, edi
cmp eax, ebp
mov byte [esp + 0x34], 8
jle 0x432994
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + edi*4]
cmp ecx, ebp
je 0x43298c
mov edx, dword [ecx]
push 1
call dword [edx + 8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x1c]
inc edi
cmp edi, eax
jl 0x432977
mov dword [esi + 0x1c], ebp
mov ecx, 0x11
xor eax, eax
lea edi, [esi + 0xe8]
mov dword [esi], ebp
mov dword [esi + 8], ebp
cmp ebx, ebp
rep stosd dword es:[edi], eax
je 0x4329d5
mov dword [esp + 0x20], 0x45ca18
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x3c], 9
call fcn.00433d50
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x43efd0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x45aef0
push eax
mov eax, 0x2204
mov dword fs:[0], esp
call fcn.00457870
push ebx
push ebp
push esi
push edi
mov edx, ecx
mov dword [esp + 0x10], 0
mov ax, word [0x468b0c]
mov ecx, 0x7ff
mov word [esp + 0x214], ax
xor eax, eax
lea edi, [esp + 0x216]
mov ebp, dword [esp + 0x2228]
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 0x14]
lea edx, [esp + 0x214]
push ecx
push 0x1000
stosw word es:[edi], ax
mov eax, dword [esp + 0x2234]
push edx
push 0x468b0c
push eax
push ebp
mov dword [esp + 0x2234], 1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, dword [esp + 0x2224]
mov ecx, dword [0x4631a0]
lea edx, [esp + 0x214]
test edx, edx
mov dword [ebx], ecx
je 0x43f13f
lea eax, [esp + 0x214]
shr eax, 0x10
jne 0x43f0fd
xor edi, edi
lea ecx, [esp + 0x214]
lea edx, [esp + 0x14]
mov di, cx
push 0x100
push edx
push edi
call fcn.00405690
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x43f0b7
lea edx, [esp + 0x14]
mov ecx, ebx
push edx
call fcn.00405430
jmp 0x43f13f
push 0x1ff
mov ecx, ebx
mov esi, 0x200
call fcn.00405500
test eax, eax
je 0x43f0f2
push esi
push eax
push edi
call fcn.00405690
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x43f0f2
add esi, 0x100
mov ecx, ebx
lea edx, [esi - 1]
push edx
call fcn.00405500
test eax, eax
jne 0x43f0cc
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004055c0
jmp 0x43f13f
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x43f13f
push esi
mov ecx, ebx
call fcn.00404720
test eax, eax
je 0x43f13f
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
cmp edx, ecx
jb 0x43f13f
mov edi, dword [ebx]
mov eax, ecx
lea esi, [esp + 0x214]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x4631a4]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [ebp - 0xc]
cmp ecx, eax
je 0x43f164
lea esi, [ebp - 0xc]
push esi
call edi
test eax, eax
jg 0x43f164
push esi
call fcn.0044bf22
add esp, 4
mov esi, dword [esp + 0x222c]
mov eax, dword [0x4631a4]
lea edx, [esi - 0xc]
cmp edx, eax
je 0x43f18a
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x43f18a
push esi
call fcn.0044bf22
add esp, 4
mov ecx, dword [esp + 0x2214]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2210
ret 0xc

Function at 0x43f1b0
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [ecx + 0x14]
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebx, eax
mov eax, dword [0x4631a4]
lea ecx, [esi - 0xc]
cmp ecx, eax
je 0x43f1f4
add esi, 0xfffffff4
push esi
call ebp
test eax, eax
jg 0x43f1f4
push esi
call fcn.0044bf22
add esp, 4
mov eax, dword [0x4631a4]
lea edx, [edi - 0xc]
cmp edx, eax
je 0x43f213
lea esi, [edi - 0xc]
push esi
call ebp
test eax, eax
jg 0x43f213
push esi
call fcn.0044bf22
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 0xc
Function at 0x446160
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1028
call fcn.00457870
mov ax, word [0x468b0c]
push esi
mov esi, ecx
push edi
mov word [esp + 0x810], ax
mov ecx, 0x207
xor eax, eax
lea edi, [esp + 0x812]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x9c]
test eax, eax
jne 0x4462c2
mov eax, dword [0x468ad4]
test eax, eax
je 0x4461b3
mov ecx, dword [0x468ad8]
test ecx, ecx
jne 0x4462b4
push ebx
lea ecx, [esp + 0x14]
push 0x400
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x14]
push edx
call ebx
mov eax, dword [0x468adc]
xor edi, edi
test eax, eax
jle 0x4461ef
lea eax, [esp + 0x14]
push eax
call ebx
mov eax, dword [0x468adc]
inc edi
cmp edi, eax
jl 0x4461de
lea ecx, [esp + 0x14]
push str.MiniUI.dll
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004026a0
add esp, 8
test eax, eax
pop ebx
jne 0x44625b
lea eax, [esp + 0x10]
test eax, eax
je 0x446257
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44625b
lea edx, [esp + 0x10]
push edx
call fcn.00401e30
add esp, 4
test eax, eax
jne 0x44625b
push 1
call fcn.004568c0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00456b50
add esp, 0xc
xor eax, eax
jmp 0x446266
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x468ad8], eax
je 0x44629b
push str.GetMiniUI
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x468ad4], eax
jne 0x4462b4
mov edx, dword [0x468ad8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x468ad8], 0
xor eax, eax
test eax, eax
mov dword [esi + 0x9c], eax
jne 0x4462c2
pop edi
xor eax, eax
pop esi
add esp, 0x1028
ret 0x10
call eax
test eax, eax
je 0x44629b
mov ecx, dword [eax]
push eax
call dword [ecx + 0x54]
jmp 0x44629d
mov eax, dword [esp + 0x1040]
lea edx, [esp + 0x810]
push 0x410
push edx
push eax
push 0
call fcn.004083e0
mov ecx, dword [esi + 0x9c]
add esp, 0x10
lea eax, [esp + 0x810]
mov edx, dword [ecx]
push 0
push eax
call dword [edx + 0xc]
mov ecx, dword [esi + 0x9c]
mov edx, dword [ecx]
call dword [edx]
test eax, eax
je 0x446311
pop edi
xor eax, eax
pop esi
add esp, 0x1028
ret 0x10
mov ecx, dword [esi + 0x9c]
lea edx, [esp + 8]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [esi + 0x9c]
mov dword [esp + 0xc], edx
cdq
mov edi, dword [ecx]
and edx, 3
add eax, edx
sar eax, 2
push eax
lea eax, [esp + 0x814]
push eax
call dword [edi + 0xc]
mov ecx, dword [esi + 0x9c]
mov edx, dword [ecx]
call dword [edx]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x1028
ret 0x10
Function at 0x448560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45b5cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0xb]
push edi
xor ebx, ebx
push 0x1c
mov dword [esp + 0x14], esi
mov byte [esi + 0x18], al
mov byte [esi + 0x19], cl
mov byte [esi + 0x24], bl
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], ebx
mov byte [eax + 0x18], 1
mov byte [eax + 0x19], bl
mov dword [esi + 0x20], eax
mov byte [eax + 0x19], 1
mov eax, dword [esi + 0x20]
push 0x1c
mov dword [eax], ebx
mov edx, dword [esi + 0x20]
mov dword [edx + 8], ebx
mov edi, dword [esi + 0x20]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], edi
mov byte [eax + 0x18], bl
mov byte [eax + 0x19], bl
mov dword [esi + 0x1c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x1c]
mov dword [eax + 8], eax
mov dword [esi + 0x28], ebx
mov al, byte [esp + 0x17]
mov cl, byte [esp + 0x17]
push 0x24
mov dword [esp + 0x28], ebx
mov byte [esi + 0x2c], al
mov byte [esi + 0x2d], cl
mov byte [esi + 0x38], bl
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], ebx
mov byte [eax + 0x20], 1
mov byte [eax + 0x21], bl
mov dword [esi + 0x34], eax
mov byte [eax + 0x21], 1
mov edx, dword [esi + 0x34]
push 0x24
mov dword [edx], ebx
mov eax, dword [esi + 0x34]
mov dword [eax + 8], ebx
mov edi, dword [esi + 0x34]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], edi
mov byte [eax + 0x20], bl
mov byte [eax + 0x21], bl
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x30], eax
mov dword [eax], eax
mov eax, dword [esi + 0x30]
add esp, 0x10
mov dword [eax + 8], eax
mov dword [esi + 0x3c], ebx
mov dword [esi], 0x45cb80
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 1
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4491f0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x80c
push ebp
mov ebp, ecx
mov eax, dword [ebp + 4]
test eax, eax
jne 0x44935e
mov eax, dword [0x468ad4]
test eax, eax
je 0x44921b
mov ecx, dword [0x468ad8]
test ecx, ecx
jne 0x449371
push esi
push edi
lea eax, [esp + 0x18]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x18]
push ecx
call edi
mov eax, dword [0x468adc]
xor esi, esi
test eax, eax
jle 0x449258
lea edx, [esp + 0x18]
push edx
call edi
mov eax, dword [0x468adc]
inc esi
cmp esi, eax
jl 0x449247
lea eax, [esp + 0x18]
push str.MiniUI.dll
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..360SelfProtection
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4492d6
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x14]
push 4
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push 0x22204c
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4492d6
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x449317
lea edx, [esp + 0x18]
test edx, edx
je 0x449313
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x449317
lea ecx, [esp + 0x18]
push ecx
call fcn.00401e30
add esp, 4
test eax, eax
jne 0x449317
push 1
call fcn.004568c0
lea edx, [esp + 0x1c]
push eax
push edx
call fcn.00456b50
add esp, 0xc
xor eax, eax
jmp 0x449322
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
mov dword [0x468ad8], eax
test eax, eax
pop esi
je 0x449359
push str.GetMiniUI
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x468ad4], eax
jne 0x449371
mov ecx, dword [0x468ad8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x468ad8], 0
xor eax, eax
mov dword [ebp + 4], eax
mov ecx, dword [ebp + 4]
test ecx, ecx
jne 0x44937f
xor eax, eax
pop ebp
add esp, 0x80c
ret 4
call eax
test eax, eax
je 0x449359
mov edx, dword [eax]
push eax
call dword [edx + 0x54]
jmp 0x44935b
mov edx, dword [esp + 0x814]
mov eax, dword [ecx]
push 0
push edx
call dword [eax + 0xc]
mov ecx, dword [ebp + 4]
mov eax, dword [ecx]
call dword [eax]
neg eax
sbb eax, eax
pop ebp
inc eax
add esp, 0x80c
ret 4
Function at 0x449d20
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x468ad4]
sub esp, 0x814
test eax, eax
push ebx
push esi
mov ebx, ecx
je 0x449d41
mov ecx, dword [0x468ad8]
test ecx, ecx
jne 0x449e3a
push edi
lea eax, [esp + 0x20]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x20]
push ecx
call edi
mov eax, dword [0x468adc]
xor esi, esi
test eax, eax
jle 0x449d7d
lea edx, [esp + 0x20]
push edx
call edi
mov eax, dword [0x468adc]
inc esi
cmp esi, eax
jl 0x449d6c
lea eax, [esp + 0x20]
push str.MiniUI.dll
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004026a0
add esp, 8
test eax, eax
pop edi
jne 0x449de9
lea edx, [esp + 0x1c]
test edx, edx
je 0x449de5
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x449de9
lea ecx, [esp + 0x1c]
push ecx
call fcn.00401e30
add esp, 4
test eax, eax
jne 0x449de9
push 1
call fcn.004568c0
lea edx, [esp + 0x20]
push eax
push edx
call fcn.00456b50
add esp, 0xc
xor eax, eax
jmp 0x449df4
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x468ad8], eax
je 0x449ed4
push str.GetMiniUI
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x468ad4], eax
jne 0x449e3a
mov ecx, dword [0x468ad8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov dword [0x468ad8], 0
xor eax, eax
pop ebx
add esp, 0x814
ret 0x10
call eax
test eax, eax
je 0x449ed4
mov edx, dword [eax]
push eax
call dword [edx + 0x54]
mov esi, eax
test esi, esi
je 0x449ed4
mov edx, dword [esp + 0x820]
mov ecx, dword [esp + 0x824]
mov eax, dword [esi]
push 0
and edx, 0xffff
push ecx
push edx
push 0
mov ecx, esi
call dword [eax + 0x1c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
test eax, eax
jne 0x449ecb
xor ecx, ecx
lea edx, [esp + 8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x10]
push ecx
push edx
lea ecx, [ebx + 0x18]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
call fcn.0044a8d0
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x828]
mov edx, dword [esp + 0x82c]
pop esi
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 4]
pop ebx
mov dword [eax + 0x14], edx
mov eax, 1
add esp, 0x814
ret 0x10
push esi
call fcn.0044bf22
add esp, 4
pop esi
xor eax, eax
pop ebx
add esp, 0x814
ret 0x10
Function at 0x44ebe0
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
mov ecx, 0x468f6c
jmp fcn.0044ebf0
Function at 0x450b50
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x450b7f
push str.GetFileSizeEx__
push eax
push 0x112
push str.E:_build2011_12_30_Release_AQHImageHlp.c
call fcn.0044c4a0
add esp, 0x10
xor eax, eax
ret
mov eax, 1
ret

Function at 0x450dd0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
push 0
push 0
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x450e0c
push str.SetFilePointerEx__
push eax
push 0xed
push str.E:_build2011_12_30_Release_AQHImageHlp.c
call fcn.0044c4a0
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xc]
push 0
push edx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x450e45
push str.ReadFile__
push eax
push 0xf0
push str.E:_build2011_12_30_Release_AQHImageHlp.c
call fcn.0044c4a0
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret
cmp edi, dword [esp + 0xc]
je 0x450e69
push 0x467f68
push 1
push 0xf2
push str.E:_build2011_12_30_Release_AQHImageHlp.c
call fcn.0044c9b0
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x4512d0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
push 0
push 0
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x45130c
push str.SetFilePointerEx__
push eax
push 0x102
push str.E:_build2011_12_30_Release_AQHImageHlp.c
call fcn.0044c4a0
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xc]
push 0
push edx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x451345
push str.WriteFile__
push eax
push 0x105
push str.E:_build2011_12_30_Release_AQHImageHlp.c
call fcn.0044c4a0
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret
cmp edi, dword [esp + 0xc]
je 0x451369
push 0x468024
push 1
push 0x107
push str.E:_build2011_12_30_Release_AQHImageHlp.c
call fcn.0044c9b0
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x4522a0
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4522ca
push str.SetEndOfFile__
push eax
push 0x126
push str.E:_build2011_12_30_Release_AQHImageHlp.c
call fcn.0044c4a0
add esp, 0x10
xor eax, eax
ret
mov eax, 1
ret

Function at 0x452c90
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x454440
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x454470
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x4544a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x454c60
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4

Function at 0x456970
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x808
push esi
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4569d4
pop edi
mov eax, 1
pop esi
add esp, 0x808
ret
lea eax, [esp + 0x10]
push str.360ver.dll
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x456a06
pop edi
mov eax, 1
pop esi
add esp, 0x808
ret
lea eax, [esp + 0x10]
push eax
call fcn.00456a70
add esp, 4
test eax, eax
jne 0x456a25
pop edi
mov eax, 1
pop esi
add esp, 0x808
ret
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x456a44
pop edi
mov eax, 1
pop esi
add esp, 0x808
ret
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x808
ret