joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4100b0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
xor esi, esi
push esi
mov ebp, 1
push 0xd
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0xd
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x18], eax
mov eax, dword [edi]
push eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call ebx
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0xc], eax
je 0x41014d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
call ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, dword [edi]
push edx
call ebx
test eax, eax
je 0x41013a
push 0x1c
lea eax, [esp + 0x14]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
push 0
push esi
call ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, dword [edi]
push ecx
call ebx
test eax, eax
je 0x410164
push 0x1c
lea edx, [esp + 0x14]
push edx
push ebp
call dword [sym.imp.USER32.dll_SendInput]
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x411bc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x411bd9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x411c14
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x411c10
lea ebx, [ebx]
cmp esi, eax
jae 0x411c14
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x411c00
cmp esi, eax
jb 0x411c1a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x412cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412d2e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x412cff
cmp eax, 2
jne 0x412d1a
test esi, esi
mov eax, dword [esp]
je 0x412d28
test eax, eax
je 0x412d23
test al, 1
jne 0x412d1a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x412d28
mov eax, 0xd
pop ecx
ret 8
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x415560
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x20c], eax
push 0x208
lea eax, [esp + 8]
push eax
push 0
push esi
mov dword [esp + 0x10], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4155aa
xor al, al
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00483bf3
add esp, 0x210
ret
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push esi
mov dword [esp + 0x20], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, dword [esp + 0x20c]
test eax, eax
setne al
xor ecx, esp
call fcn.00483bf3
add esp, 0x210
ret
Function at 0x419500
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4a6100
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x5c]
test esi, esi
mov edi, ecx
je 0x4195f5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x4195f5
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], 0
push 0x19
mov ecx, edi
mov dword [esp + 0x58], 0
xor ebx, ebx
call fcn.004196b0
cmp eax, 1
jne 0x41957f
mov ebx, eax
push 0x10
mov ecx, edi
call fcn.004196b0
cmp eax, 1
jne 0x41958f
mov ebx, eax
push 0x17
mov ecx, edi
call fcn.004196b0
cmp eax, 1
jne 0x41959f
mov ebx, eax
push 2
mov ecx, edi
call fcn.004196b0
cmp eax, 1
jne 0x4195af
mov ebx, eax
push 0x26
mov ecx, edi
call fcn.004196b0
cmp eax, 1
jne 0x4195bf
mov ebx, eax
push 0x25
mov ecx, edi
call fcn.004196b0
cmp eax, 1
jne 0x4195cf
mov ebx, eax
push 0x24
mov ecx, edi
call fcn.004196b0
cmp eax, 1
je 0x41961a
test ebx, ebx
jne 0x41961a
cmp dword [esp + 0x28], 8
jb 0x4195f5
mov eax, dword [esp + 0x14]
push eax
call fcn.004692b1
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00483bf3
add esp, 0x48
ret 4
mov ecx, esi
call fcn.004197f0
cmp eax, 1
je 0x41966e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41963d
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x41966e
mov edx, esi
lea eax, [esp + 0x2c]
call fcn.00405e60
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 1
call fcn.00419a20
test eax, eax
jne 0x41967c
lea ecx, [esp + 0x2c]
call fcn.00401a00
lea ecx, [esp + 0x10]
call fcn.00401a00
jmp 0x4195f5
cmp dword [esp + 0x44], 8
mov eax, dword [esp + 0x30]
jae 0x41968b
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.00419500
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.00401a00
lea ecx, [esp + 0x10]
call fcn.00401a00
mov eax, esi
jmp 0x4195fa
Function at 0x4197f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a6076
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x2a0]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp esi, edi
je 0x4199d1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x4199d1
mov eax, esi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
lea edx, [eax + 2]
jmp 0x419860
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x419860
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x1c]
call fcn.00406d50
mov dword [esp + 0x2a8], edi
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x4198cb
mov ecx, dword [esp + 0x2c]
cmp ecx, 8
mov esi, dword [esp + 0x18]
mov edi, eax
mov edx, esi
jae 0x41989e
lea edx, [esp + 0x18]
cmp ecx, 8
lea eax, [edx + eax*2]
mov ecx, esi
jae 0x4198ac
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_CharPrevW]
cmp word [eax], 0x5c
jne 0x4198cb
lea ebx, [edi - 1]
mov eax, 1
lea esi, [esp + 0x14]
call fcn.00405ed0
push 1
push 0x4b55a0
lea ecx, [esp + 0x1c]
call fcn.00408260
push 3
push 0x4b5468
lea ecx, [esp + 0x1c]
call fcn.00408260
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x18]
jae 0x4198fa
lea eax, [esp + 0x18]
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41992a
cmp dword [esp + 0x2c], 8
jb 0x4199d1
mov edx, dword [esp + 0x18]
push edx
call fcn.004692b1
add esp, 4
jmp 0x4199d1
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], 0
mov byte [esp + 0x2a8], 1
lea esp, [esp]
lea eax, [esp + 0x78]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419957
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x7c]
push eax
lea esi, [esp + 0x38]
call fcn.00406d50
mov eax, dword [esp + 0x44]
push 0x4b5470
mov edi, 1
mov ecx, esi
call fcn.00406a90
test eax, eax
je 0x4199a7
mov eax, dword [esp + 0x44]
push 0x4b5474
mov edi, 2
mov ecx, esi
call fcn.00406a90
test eax, eax
jne 0x4199fa
lea ecx, [esp + 0x4c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x419950
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x30]
call fcn.00401a00
lea ecx, [esp + 0x14]
call fcn.00401a00
xor eax, eax
mov ecx, dword [esp + 0x2a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28c]
xor ecx, esp
call fcn.00483bf3
add esp, 0x29c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x30]
call fcn.00401a00
lea ecx, [esp + 0x14]
call fcn.00401a00
mov eax, 1
jmp 0x4199d3
Function at 0x419b30
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
sub esp, 0x414
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
mov esi, dword [esp + 0x420]
push edi
mov edi, dword [esp + 0x428]
push 0
push edi
lea eax, [esp + 0x14]
push eax
push 0
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x419ba4
lea eax, [esp + 0xc]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419b80
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x10]
push edx
call fcn.00406d50
mov eax, 1
jmp 0x419cc9
lea eax, [edi - 2]
cmp eax, 0x29
ja case.0x419bb7.3
movzx eax, byte [eax + 0x419d0c]
jmp dword [eax*4 + 0x419ce4]
push reloc.OLEAUT32.dll_SysReAllocString
push esi
mov edx, str.Common_Desktop
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00419d40
test eax, eax
jne 0x419b9a
push 0x10
push esi
mov ecx, ebx
call fcn.00419b30
jmp 0x419cc9
push reloc.OLEAUT32.dll_SysReAllocString
push esi
mov edx, str.Common_Programs
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00419d40
test eax, eax
jne 0x419b9a
push 2
push esi
mov ecx, ebx
call fcn.00419b30
jmp 0x419cc9
push SysReAllocStringLen
push esi
mov edx, str.Desktop
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00419d40
jmp 0x419cc9
push reloc.OLEAUT32.dll_SysReAllocString
push esi
mov edx, str.ProgramFilesDir
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersion
call fcn.00419d40
jmp 0x419cc9
push reloc.OLEAUT32.dll_SysReAllocString
push esi
mov edx, str.CommonFilesDir
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersion
call fcn.00419d40
jmp 0x419cc9
push SysReAllocStringLen
push esi
mov edx, str.Programs
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00419d40
jmp 0x419cc9
push SysReAllocStringLen
push esi
mov edx, str.My_Pictures
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00419d40
jmp 0x419cc9
push 0x104
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je case.0x419bb7.3
push esi
lea edx, [esp + 0x218]
call fcn.00405ea0
mov eax, 1
jmp 0x419cc9
push 0x104
lea edx, [esp + 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x419c9a
xor eax, eax
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00483bf3
add esp, 0x414
ret 8
Function at 0x41e710
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov dword [esp + 0x10], 0x104
mov word [esp + 0x14], 0
call fcn.0048a580
add esp, 0xc
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x41e755
mov eax, dword [edi]
jmp 0x41e757
mov eax, edi
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e79d
cmp dword [esi + 0x18], 8
jb 0x41e779
mov edi, dword [edi]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x41e79d
mov al, 1
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00483bf3
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
pop edi
xor ecx, esp
xor al, al
call fcn.00483bf3
add esp, 0x210
ret

Function at 0x41e7c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x410
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, dword [esp + 0x414]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x41c]
cmp dword [eax + 0x18], 8
push ebp
mov ebp, dword [esp + 0x41c]
mov dword [esp + 4], 0x3e8
jb 0x41e801
mov edx, dword [eax + 4]
jmp 0x41e804
lea edx, [eax + 4]
push ebx
xor ebx, ebx
mov eax, edx
push esi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41e820
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x1c]
call fcn.00406d50
lea ecx, [esp + 0x30]
push ecx
mov eax, 1
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.00413b30
test al, al
sete bl
cmp dword [esp + 0x2c], 8
jb 0x41e868
mov edx, dword [esp + 0x18]
push edx
call fcn.004692b1
add esp, 4
pop esi
test bl, bl
pop ebx
je 0x41e888
xor al, al
pop ebp
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.00483bf3
add esp, 0x410
ret 0xc
cmp dword [ebp + 0x18], 8
jb 0x41e893
mov eax, dword [ebp + 4]
jmp 0x41e896
lea eax, [ebp + 4]
mov ecx, dword [esp + 4]
push ecx
lea edx, [esp + 0x2c]
push edx
push 1
push 0
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x410]
test eax, eax
sete al
pop ebp
xor ecx, esp
call fcn.00483bf3
add esp, 0x410
ret 0xc

Function at 0x41ea40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push str.Result_Value
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call edi
test eax, eax
jne 0x41eab3
cmp dword [esp + 4], 4
jne 0x41eab3
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push str.Result_Value
push esi
call edi
test eax, eax
jne 0x41eab3
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [eax], edx
mov al, 1
pop edi
add esp, 0xc
ret 4
xor al, al
pop edi
add esp, 0xc
ret 4
Function at 0x41ec50
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x24
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push 0x16
push str.SOFTWARECanon_Inc_IC_
lea esi, [esp + 0x10]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], 0
call fcn.00406d50
mov eax, dword [esp + 0xc]
mov esi, 8
cmp dword [esp + 0x20], esi
mov dword [esp + 4], 0
jae 0x41eca1
lea eax, [esp + 0xc]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41ece4
mov eax, dword [esp + 4]
push str.Auto_Update_Shared
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x41ed09
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x20], esi
jb 0x41ecf7
mov edx, dword [esp + 0xc]
push edx
call fcn.004692b1
add esp, 4
xor al, al
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00483bf3
add esp, 0x24
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x41ed3d
cmp dword [esp + 0x20], esi
jb 0x41ecf7
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004692b1
add esp, 4
xor al, al
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00483bf3
add esp, 0x24
ret
cmp dword [esp + 0x20], esi
jb 0x41ed50
mov edx, dword [esp + 0xc]
push edx
call fcn.004692b1
add esp, 4
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
mov al, 1
call fcn.00483bf3
add esp, 0x24
ret
Function at 0x4258f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a408b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004a177a
push 4
mov dword [esp + 0x20], 0
call fcn.00469281
mov edi, eax
add esp, 4
test edi, edi
je 0x425970
call fcn.004a103e
mov dword [edi], eax
call fcn.004a0e72
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004a0de4
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x425965
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004a0e05
jmp 0x425972
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x42b530
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a5bfb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
push 0x104
xor edi, edi
lea eax, [esp + 0x34]
push edi
push eax
mov ebx, ecx
call fcn.0048a580
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x19
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x42b5ae
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42b5c6
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x34]
push edx
lea esi, [esp + 0x1c]
call fcn.00406d50
mov dword [esp + 0x244], edi
mov edi, dword [ebx + 0x14]
mov esi, 8
cmp dword [ebx + 0x18], esi
jb 0x42b5fd
mov ebx, dword [ebx + 4]
jmp 0x42b600
add ebx, 4
mov eax, dword [esp + 0x28]
push ebx
lea ecx, [esp + 0x18]
call fcn.00406a90
test eax, eax
jne 0x42b629
cmp dword [esp + 0x2c], esi
jb 0x42b625
mov eax, dword [esp + 0x18]
push eax
call fcn.004692b1
add esp, 4
mov al, 1
jmp 0x42b63e
cmp dword [esp + 0x2c], esi
jb 0x42b63c
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004692b1
add esp, 4
xor al, al
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00483bf3
add esp, 0x238
ret
Function at 0x42fff0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4aa1de
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0xbc], eax
push ebp
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
test ecx, ecx
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x14], eax
je 0x43010a
test eax, eax
je 0x43010a
mov eax, ecx
mov dword [esp + 0xc8], 7
mov dword [esp + 0xc4], 0
mov word [esp + 0xb4], 0
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x430075
sub eax, esi
sar eax, 1
push eax
push ecx
lea esi, [esp + 0xb8]
call fcn.00406d50
mov dword [esp + 0xd8], 0
mov dword [esp + 0x18], 0x4b6220
mov ecx, esi
push ecx
mov byte [esp + 0xdc], 1
call fcn.0042bde0
mov eax, dword [esp + 0xb4]
mov edi, 8
cmp dword [esp + 0xc8], edi
jae 0x4300d1
lea eax, [esp + 0xb4]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x430135
cmp dword [esp + 0xc8], edi
jb 0x43010a
mov edx, dword [esp + 0xb4]
push edx
call fcn.004692b1
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.00483bf3
add esp, 0xcc
ret 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xffffffff
je 0x4301d9
lea eax, [esp + 0x1c]
push eax
call fcn.00432980
push 0x4b3a7f
push 0
mov byte [esp + 0xe0], 2
call fcn.00487015
mov ecx, dword [esp + 0xbc]
add esp, 8
cmp dword [esp + 0xc8], edi
jae 0x430188
lea ecx, [esp + 0xb4]
push 1
lea esi, [esp + 0x28]
call fcn.00433100
test eax, eax
jne 0x4301ba
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 4]
mov eax, dword [esp + ecx + 0x24]
lea ecx, [esp + ecx + 0x1c]
or eax, 2
cmp dword [ecx + 0x28], 0
jne 0x4301b2
or eax, 4
push 0
push eax
call fcn.00412820
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 4]
test byte [esp + eax + 0x24], 6
je 0x4301ea
mov byte [esp + 0xd8], 1
lea eax, [esp + 0x1c]
call fcn.00430270
lea ecx, [esp + 0xb0]
call fcn.00401a00
jmp 0x43010a
lea edi, [ebp + 0x100]
push edi
call fcn.004692ac
mov esi, eax
add esp, 4
test esi, esi
je 0x4301c8
push edi
push 0
push esi
call fcn.0048a580
add esp, 0xc
push esi
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebp
call fcn.00432fe0
mov edi, dword [esp + 0x10]
push esi
lea edx, [edi + 0xc]
push edx
mov ecx, ebp
call fcn.00431180
push esi
call fcn.004692b1
mov ecx, dword [esp + 0x18]
add esp, 4
push edi
call fcn.00430290
test eax, eax
mov byte [esp + 0xd8], 1
lea eax, [esp + 0x1c]
je 0x4301d4
call fcn.00430270
lea ecx, [esp + 0xb0]
call fcn.00401a00
mov eax, 1
jmp 0x43010c
Function at 0x4313e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a408b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004a177a
push 4
mov dword [esp + 0x20], 0
call fcn.00469281
mov edi, eax
add esp, 4
test edi, edi
je 0x431460
call fcn.004a103e
mov dword [edi], eax
call fcn.004a0e72
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004a0de4
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x431455
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004a0e05
jmp 0x431462
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4