joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439b80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x60]
push edx
call dword [0x49c360]
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x439bca
push 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x5c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffff0000
push 0xffffffffffffffff
push 0x465
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5c]
push ecx
call dword [0x49c354]
jmp 0x439bd9
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 8

Function at 0x4404d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], 0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 4], ax
movsx eax, word [ebp - 4]
and eax, 0x8000
je 0x4404f8
mov byte [ebp - 5], 1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 4], ax
movsx ecx, word [ebp - 4]
and ecx, 0x8000
je 0x440514
mov byte [ebp - 5], 1
movzx edx, byte [ebp - 5]
test edx, edx
jne 0x44055d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xd
je 0x440530
cmp dword [ebp - 0x10], 0x20
je 0x440530
jmp 0x44055d
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x201
mov ecx, dword [ebp - 0xc]
call fcn.00440f40
push 0
push 0
push 0x4e1
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.004326c0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x440e90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472c50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
call fcn.0042d350
mov dword [ebp - 0x10], eax
push 5
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00402980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00402980
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4418b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472d2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1824
call fcn.0046fc30
mov eax, dword [0x49c1c8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1828], ecx
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp + 8]
call fcn.00405020
push eax
call dword [0x49c238]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x441939
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x1819], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402980
mov al, byte [ebp - 0x1819]
jmp 0x441b04
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x441979
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x181a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402980
mov al, byte [ebp - 0x181a]
jmp 0x441b04
lea edx, [ebp + 8]
push edx
push str._hr__pre_Dumping:
lea eax, [ebp - 0x1820]
push eax
call fcn.004029e0
add esp, 0xc
mov dword [ebp - 0x182c], eax
mov ecx, dword [ebp - 0x182c]
mov dword [ebp - 0x1830], ecx
mov byte [ebp - 4], 1
push 0x481bcc
mov edx, dword [ebp - 0x1830]
push edx
lea eax, [ebp - 0x818]
push eax
call fcn.0041a890
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1820]
call fcn.00402980
lea ecx, [ebp - 0x818]
call fcn.00402aa0
push eax
mov ecx, dword [ebp - 0x1828]
push ecx
call fcn.00441860
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x818]
call fcn.00402b00
mov dword [ebp - 0x10], 0x7f5
mov dword [ebp - 0x1814], 0
push 0
lea edx, [ebp - 0x1814]
push edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x814]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1810], eax
cmp dword [ebp - 0x1810], 0
jne 0x441a59
push 0x481bfc
push str.bool___thiscall_CHtmlLogger::LogFile_class_ATL::CStringT_unsigned_short_class_ATL::StrTraitATL_unsigned_short_class_ATL::ChTraitsCRT_unsigned_short______
push 0x129
push str..HtmlLogger.cpp
push 0
mov ecx, 0x49d444
call fcn.00441760
jmp 0x441aa2
mov eax, dword [ebp - 0x1814]
mov byte [ebp + eax - 0x814], 0
push 0x7f6
lea ecx, [ebp - 0x180c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x814]
push edx
push 1
push 0
call dword [0x49c2a4]
mov dword [ebp - 0x1818], eax
lea eax, [ebp - 0x180c]
push eax
mov ecx, dword [ebp - 0x1828]
push ecx
call fcn.00441860
add esp, 8
mov edx, dword [ebp - 0x1814]
cmp edx, dword [ebp - 0x10]
sbb eax, eax
neg eax
mov dword [ebp - 0x81c], eax
je 0x441a00
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.__pre__hr_
mov edx, dword [ebp - 0x1828]
push edx
call fcn.00441860
add esp, 8
mov byte [ebp - 0x1821], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x818]
call fcn.00402980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402980
mov al, byte [ebp - 0x1821]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x18]
call fcn.0046faad
mov esp, ebp
pop ebp
ret 4
Function at 0x446510
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov byte [ebp - 5], 0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 4], ax
movsx eax, word [ebp - 4]
and eax, 0x8000
je 0x446538
mov byte [ebp - 5], 1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 4], ax
movsx ecx, word [ebp - 4]
and ecx, 0x8000
je 0x446554
mov byte [ebp - 5], 1
movzx edx, byte [ebp - 5]
test edx, edx
jne 0x4465fb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xd
je 0x446577
cmp dword [ebp - 0x14], 0x20
je 0x446577
jmp 0x4465fb
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x6e], 0
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0xb0]
test eax, eax
jne 0x4465ee
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x94]
test edx, edx
je 0x4465b6
mov ecx, dword [ebp - 0x10]
call fcn.00446190
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00416d50
mov eax, 1
jmp 0x4465fd
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00432910
and eax, 0xffff
movzx edx, ax
push edx
push 0x111
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004090b0
mov ecx, dword [eax]
push ecx
call dword [0x49c340]
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00416d50
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x446b30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4733f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CHPCUEInfcCache.0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.004608e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00407ba0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00407ba0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00407ba0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004477f0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00407ba0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
mov ecx, dword [ebp - 0x10]
call fcn.00446af0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x448ee0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473708
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x10]
call fcn.004028f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004028f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004028f0
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
call fcn.00403bf0
push str.HKEY_LOCAL_MACHINESOFTWAREHewlett_PackardDigitalImagingHP_Photo__Imaging_GalleryMainAppPath
lea ecx, [ebp - 0x10]
call fcn.004381d0
push str.HKEY_LOCAL_MACHINESOFTWAREHewlett_PackardDigitalImagingHP_Photo__Imaging_GalleryProgramPath
lea ecx, [ebp - 0x1c]
call fcn.004381d0
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x10]
push edx
call fcn.00402a80
mov dword [ebp - 0x2c], eax
call fcn.00410c30
add esp, 8
mov byte [ebp - 0x2d], al
movzx eax, byte [ebp - 0x2d]
test eax, eax
jne 0x448fe2
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push str.Unable_to_get_registry_value:__s.__Checking_for:__s
push 0x49d444
call fcn.00441600
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.00403bf0
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [ebp - 0x1c]
push edx
call fcn.00402a80
mov dword [ebp - 0x34], eax
call fcn.00410c30
add esp, 8
mov byte [ebp - 0x35], al
movzx eax, byte [ebp - 0x35]
test eax, eax
jne 0x448fd4
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x4841e0
push 0x49d444
call fcn.00441600
add esp, 0xc
jmp 0x448fe0
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00412690
jmp 0x448fee
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00412690
mov ecx, dword [ebp + 8]
call fcn.00413020
movzx ecx, al
test ecx, ecx
jne 0x449030
mov ecx, dword [ebp + 8]
call fcn.00405020
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x449016
mov byte [ebp - 0x11], 1
jmp 0x44902e
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.Path:__s_for_HP_Image_Zone_does_not_exist
push 0x49d444
call fcn.00441600
add esp, 0xc
jmp 0x449042
push str.Unable_to_get_path_for_Image_Zone
push 0x49d444
call fcn.00441600
add esp, 8
mov cl, byte [ebp - 0x11]
mov byte [ebp - 0x25], cl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402980
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402980
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4495b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4737c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x10]
call fcn.004028f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004028f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
call fcn.00403bf0
mov ecx, dword [ebp + 0xc]
call fcn.00403bf0
push str.HKEY_LOCAL_MACHINESOFTWAREHewlett_PackardDigitalImagingDocumentViewerProgramPath
lea ecx, [ebp - 0x10]
call fcn.004381d0
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [ebp - 0x10]
push edx
call fcn.00402a80
mov dword [ebp - 0x2c], eax
call fcn.00410c30
add esp, 8
mov byte [ebp - 0x2d], al
movzx eax, byte [ebp - 0x2d]
test eax, eax
jne 0x44970d
mov ecx, dword [ebp - 0x10]
push ecx
push str.Unable_to_get_registry_value:__s
push 0x49d444
call fcn.00441600
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
call fcn.0040fc10
add esp, 4
mov byte [ebp - 4], 2
push str.hpqmydoc.doc.config
lea ecx, [ebp - 0x1c]
call fcn.004126b0
lea ecx, [ebp - 0x1c]
call fcn.00405020
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4496e9
lea eax, [ebp - 0x20]
push eax
call fcn.0040fc10
add esp, 4
mov byte [ebp - 4], 3
push str.hpqgalry.exe
lea ecx, [ebp - 0x20]
call fcn.004126b0
lea ecx, [ebp - 0x20]
call fcn.00405020
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4496c5
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00412690
push str._Document
mov ecx, dword [ebp + 0xc]
call fcn.004126b0
jmp 0x4496db
mov edx, dword [ebp - 0x20]
push edx
push 0x4849e4
push 0x49d444
call fcn.00441600
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00402980
jmp 0x4496ff
mov eax, dword [ebp - 0x1c]
push eax
push str.Path:__s_does_not_exist
push 0x49d444
call fcn.00441600
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00402980
jmp 0x449740
lea ecx, [ebp - 0x18]
call fcn.00413020
movzx ecx, al
test ecx, ecx
jne 0x44972a
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00412690
jmp 0x449740
mov eax, dword [ebp - 0x10]
push eax
push str.The_registry_value:__s_is_empty.
push 0x49d444
call fcn.00441600
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00413020
movzx ecx, al
test ecx, ecx
jne 0x449782
mov ecx, dword [ebp + 8]
call fcn.00405020
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x449768
mov byte [ebp - 0x11], 1
jmp 0x449780
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.Path:__s_for_HP_Document_Viewer_does_not_exist
push 0x49d444
call fcn.00441600
add esp, 0xc
jmp 0x449794
push str.Unable_to_get_path_for_Document_Viewer
push 0x49d444
call fcn.00441600
add esp, 8
mov cl, byte [ebp - 0x11]
mov byte [ebp - 0x25], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402980
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4497d0
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4737fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
mov eax, dword [0x49c1c8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0x220]
call fcn.004028f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.004028f0
mov byte [ebp - 4], 1
push 0
push 0x26
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44992c
push str.HPDIYProgramHP_Marketing_Assistant.exe
lea ecx, [ebp - 0x228]
call fcn.00402910
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x22c]
push eax
call fcn.004029e0
add esp, 0xc
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x238], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x238]
push edx
lea ecx, [ebp - 0x220]
call fcn.004029a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
call fcn.00402980
lea ecx, [ebp - 0x220]
call fcn.00405020
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44990d
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402a80
mov ecx, dword [ebp - 0x230]
or ecx, 1
mov dword [ebp - 0x230], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x228]
call fcn.00402980
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.00402980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00402980
mov eax, dword [ebp + 8]
jmp 0x44996e
push 0x484b98
lea ecx, [ebp - 0x220]
call fcn.004029c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x228]
call fcn.00402980
lea edx, [ebp - 0x220]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402a80
mov eax, dword [ebp - 0x230]
or eax, 1
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.00402980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00402980
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0046faad
mov esp, ebp
pop ebp
ret
Function at 0x44f3e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473f48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x74], 0
je 0x44f4f4
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0x74]
call fcn.00432630
movzx edx, al
test edx, edx
je 0x44f4f4
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x74]
call fcn.0044ff30
movzx ecx, al
test ecx, ecx
je 0x44f4f4
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x74]
call fcn.0044ff50
movzx eax, al
test eax, eax
jne 0x44f4f4
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x20], 0
push 0x4871d0
lea ecx, [ebp - 0x14]
call fcn.00402910
mov dword [ebp - 4], 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0x74]
call fcn.00465c10
mov byte [ebp - 4], 1
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.004029a0
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00405020
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44f4d9
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x74]
mov edx, dword [ecx + 0x10]
push edx
push 0x487210
lea eax, [ebp - 0x14]
push eax
call fcn.00412d50
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 8
call fcn.004029a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402980
movzx edx, byte [ebp - 0xd]
test edx, edx
jne 0x44f540
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x20], 3
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004106e0
add esp, 4
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.004029a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00402980
mov ecx, dword [ebp - 0x20]
call fcn.0044f560
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4506f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x40]
add ecx, 0x14
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402a80
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.00410810
add esp, 8
lea ecx, [ebp - 0x14]
call fcn.00405020
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne cl
mov byte [ebp - 0x15], cl
lea ecx, [ebp - 0x14]
call fcn.00402980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402980
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x453440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474380
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov dword [ebp - 0x44], ecx
push 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x50]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00453830
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x49d3e0
call fcn.00454220
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 1
push 0
mov ecx, dword [ebp - 0x4c]
call fcn.00405020
push eax
lea ecx, [ebp - 0x24]
call fcn.00413330
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00402980
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 8]
push edx
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.00453270
mov ecx, dword [ebp - 0x44]
add ecx, 0x30
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
push 2
push 0
mov ecx, dword [ebp - 0x44]
fild dword [ecx + 0xc]
push ecx
fstp dword [esp]
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004133e0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x44]
add eax, 0x40
push eax
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.00416950
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.00402ae0
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.00405020
push eax
lea ecx, [ebp - 0x14]
call fcn.00416aa0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.00413440
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00413380
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004131d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x453a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call dword [0x49c298]
cmp eax, 1
jne 0x453a34
mov eax, 3
jmp 0x453b07
cmp dword [ebp + 0x14], 0
je 0x453a55
push 8
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
jne 0x453a55
mov eax, 3
jmp 0x453b07
cmp dword [0x49cdf4], 0
jne 0x453a7a
cmp dword [0x49bc80], 7
jne 0x453a7a
call fcn.00453980
test eax, eax
jne 0x453a7a
mov eax, dword [0x49bc80]
jmp 0x453b07
cmp dword [0x49cdf4], 0
jne 0x453a8a
mov eax, dword [0x49bc80]
jmp 0x453b07
mov dword [ebp - 8], 7
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x453b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x453aea
push 0xffffffffffffffff
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x453afa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret