joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443850
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51e796
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004fe9c0
xor edi, edi
lea ecx, [esi + 0xef0]
mov dword [esp + 0x18], edi
call fcn.00445740
push edi
lea ecx, [esi + 0x2480]
mov byte [esp + 0x1c], 1
call fcn.004e7580
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x24cc], al
mov dword [esi + 0x24d0], edi
mov dword [esi + 0x24d4], edi
mov dword [esi + 0x24d8], edi
mov dword [esi + 0x247c], edi
mov dword [esi + 0x24c0], edi
mov dword [esi + 0x24bc], edi
mov dword [esi + 0x24c8], edi
mov dword [esi], 0x52572c
mov dword [esi + 4], 0x525718
mov dword [esi + 0x28], 0x525714
mov dword [esi + 0x30], 0x525704
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x443868
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51e796
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004fe9c0
xor edi, edi
lea ecx, [esi + 0xef0]
mov dword [esp + 0x18], edi
call fcn.00445740
push edi
lea ecx, [esi + 0x2480]
mov byte [esp + 0x1c], 1
call fcn.004e7580
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x24cc], al
mov dword [esi + 0x24d0], edi
mov dword [esi + 0x24d4], edi
mov dword [esi + 0x24d8], edi
mov dword [esi + 0x247c], edi
mov dword [esi + 0x24c0], edi
mov dword [esi + 0x24bc], edi
mov dword [esi + 0x24c8], edi
mov dword [esi], 0x52572c
mov dword [esi + 4], 0x525718
mov dword [esi + 0x28], 0x525714
mov dword [esi + 0x30], 0x525704
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x443920
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51e7b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x52572c
mov dword [edi + 4], 0x525718
mov dword [edi + 0x28], 0x525714
mov dword [edi + 0x30], 0x525704
mov ebx, dword [edi + 0x24d4]
mov esi, dword [edi + 0x24d0]
cmp esi, ebx
mov dword [esp + 0x18], 1
je 0x4439a8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esi]
mov edx, dword [0x538120]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4439a0
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4439a0
mov eax, dword [esi]
sub eax, 0xc
push eax
call fcn.0051d19a
add esp, 4
add esi, 4
cmp esi, ebx
jne 0x443979
pop ebp
mov eax, dword [edi + 0x24d0]
push eax
call fcn.0051d19a
xor ebx, ebx
add esp, 4
lea ecx, [edi + 0x2480]
mov dword [edi + 0x24d0], ebx
mov dword [edi + 0x24d4], ebx
mov dword [edi + 0x24d8], ebx
call fcn.004e75d0
lea ecx, [edi + 0xef0]
mov byte [esp + 0x18], bl
call fcn.00445890
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.004fecf0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x445740
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51e868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0050ae80
lea edi, [esi + 0x24]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.004f8480
push ebx
push ebx
push ebx
lea eax, [esi + 0x30]
push ebx
push eax
mov dword [esi], 0x5257b8
mov dword [edi], 0x5257b4
call dword [sym.imp.USER32.dll_SetRect]
push 0xffffff
mov dword [esi + 0x44], 0xffffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x40], eax
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x48]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x250]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll_wcscpy]
lea ecx, [esi + 0x14ac]
push str.BG_EDIT
push ecx
mov dword [esi + 0x458], 0x717171
mov dword [esi + 0x2c], ebx
call edi
lea edx, [esi + 0x14ec]
push str.LeftPad
push edx
call edi
lea eax, [esi + 0x152c]
push str.RightPad
push eax
call edi
add esp, 0x18
mov ecx, 0x412
xor eax, eax
lea edi, [esi + 0x45c]
mov dword [esi + 0x1578], ebx
mov dword [esi + 0x156c], ebx
mov dword [esi + 0x1570], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x1584], ebx
mov dword [esi + 0x157c], 8
mov dword [esi + 0x1580], 5
mov dword [esi + 0x14a8], ebx
mov dword [esi + 0x1588], 0x12
mov dword [esi + 0x1574], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x44642e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51e8ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 0x20]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov cl, byte [esp + 0x30]
xor ebx, ebx
push 0x1c
mov dword [esp + 0x18], esi
mov byte [esi + 0x14], al
mov byte [esi + 0x15], cl
mov byte [esi + 0x1c], bl
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x18], 1
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
cmp dword [0x57977c], ebx
jne 0x446482
mov dword [0x57977c], edi
mov dword [edi], ebx
mov edx, dword [0x57977c]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x579778]
inc ecx
mov dword [0x579778], ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp ebp, ebx
je 0x4464a6
push ebp
call fcn.0051d19a
add esp, 4
mov edi, dword [0x57977c]
push 0x1c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax + 4], edi
mov dword [eax + 0x18], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x18]
add esp, 4
mov dword [eax + 8], eax
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], ebx
push edi
mov dword [esi], 0x5257cc
call fcn.004a83d0
mov ecx, eax
call fcn.004a87b0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc

Function at 0x4475a0
Capabilities:
Move file

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
push 0
push str.user.dat
mov ecx, 0x56d188
stosw word es:[edi], ax
call fcn.0040c290
mov esi, eax
push str.user.dat
lea eax, [esp + 0xc]
push 0x103
push eax
call fcn.0043f210
push 0
push esi
call fcn.0043f120
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
add esp, 0x14
test eax, eax
jne 0x447602
lea ecx, [esp + 8]
push esi
push ecx
call edi
push str.history.dat
lea edx, [esp + 0xc]
push 0x103
push edx
call fcn.0043f210
add esp, 0xc
mov ecx, 0x56d188
push 0
push str.history.dat
call fcn.0040c290
mov esi, eax
push 0
push esi
call fcn.0043f120
add esp, 8
test eax, eax
jne 0x447643
lea eax, [esp + 8]
push esi
push eax
call edi
pop edi
pop esi
add esp, 0x208
ret

Function at 0x44d900
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, ecx
push 0
push str.secache.ini
mov ecx, 0x56d188
lea esi, [edi + 0x2c]
call fcn.0040c290
push eax
push 0x5394a4
push 0x103
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 1
add edi, 0x28
push esi
push edi
call fcn.00495d90
add esp, 0x1c
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
ret
Function at 0x44e0d0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x2c]
push edi
call ebx
lea eax, [esi + 0x28]
push 0
push eax
call fcn.00495f80
add esp, 8
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call ebx
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x44e11c
push 1
push str.HasLastPage
push str.Main
call fcn.0040e8b0
add esp, 0xc
ret

Function at 0x44fbf0
Capabilities:
Parse url

Disassembly:
mov eax, 0x1494
call fcn.0051d1f0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14a4]
test esi, esi
push edi
je 0x44fd59
cmp word [esi], 0
je 0x44fd59
mov eax, dword [esp + 0x14ac]
test eax, eax
je 0x44fd59
mov dx, word [0x56d150]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x256]
mov word [esp + 0x254], dx
mov word [esp + 0x4c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x254]
push edx
mov dword [esp + 0x18], eax
mov eax, 0x104
lea ecx, [esp + 0x50]
push 0
push esi
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
call ebx
mov ebp, dword [sym.imp.WININET.dll_InternetCrackUrlW]
add esp, 4
push eax
push esi
call ebp
test eax, eax
jne 0x44fd08
mov ecx, 0x411
lea edi, [esp + 0x45e]
mov word [esp + 0x45c], ax
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.http:___s_
lea eax, [esp + 0x464]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x45c]
push ecx
push 0
push edx
call ebx
add esp, 4
push eax
lea eax, [esp + 0x468]
push eax
call ebp
test eax, eax
je 0x44fd59
mov edx, dword [esp + 0x14b0]
mov esi, dword [esp + 0x14ac]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx]
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
dec edx
rep stosb byte es:[edi], al
lea ecx, [esp + 0x4c]
lea eax, [esp + 0x254]
push ecx
push eax
push str._s:___s_favicon.ico
push edx
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1494
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1494
ret
Function at 0x450440
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
mov eax, 4
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
push esi
push SysReAllocStringLen
mov dword [esp + 0x30], 0
call edi
mov ebp, eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4504bc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0x557660
push esi
push SysReAllocStringLen
mov dword [esp + 0x3c], 0
call edi
test eax, eax
jne 0x4504bc
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
test ebp, ebp
jne 0x4504cc
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp eax, ecx
je 0x4504ea
lea edx, [esp + 0x28]
push 4
push edx
push 4
push ebx
push esi
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x450570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
lea eax, [esp + 0xc]
push esi
lea ecx, [esp + 0x14]
push eax
xor esi, esi
push ecx
push 1
lea edx, [esp + 0x30]
push esi
push edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], 0xbcde0395
mov word [esp + 0x3c], 0xe52f
mov word [esp + 0x3e], 0x467c
mov byte [esp + 0x40], 0x8e
mov byte [esp + 0x41], 0x3d
mov byte [esp + 0x42], 0xc4
mov byte [esp + 0x43], 0x57
mov byte [esp + 0x44], 0x92
mov byte [esp + 0x45], 0x91
mov byte [esp + 0x46], 0x69
mov byte [esp + 0x47], 0x2e
mov dword [esp + 0x28], 0xa95664d2
mov word [esp + 0x2c], 0x9614
mov word [esp + 0x2e], 0x4f35
mov byte [esp + 0x30], 0xa7
mov byte [esp + 0x31], 0x46
mov byte [esp + 0x32], 0xde
mov byte [esp + 0x33], 0x8d
mov byte [esp + 0x34], 0xb6
mov byte [esp + 0x35], 0x36
mov byte [esp + 0x36], 0x17
mov byte [esp + 0x37], 0xe6
mov dword [esp + 0x48], 0xbfa971f1
mov word [esp + 0x4c], 0x4d5e
mov word [esp + 0x4e], 0x40bb
mov byte [esp + 0x50], 0x93
mov byte [esp + 0x51], 0x5e
mov byte [esp + 0x52], 0x96
mov byte [esp + 0x53], 0x70
mov byte [esp + 0x54], 0x39
mov byte [esp + 0x55], 0xbf
mov byte [esp + 0x56], 0xbe
mov byte [esp + 0x57], 0xe4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4506fd
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4506fd
lea edx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov ecx, dword [eax]
push edx
push 1
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x4506f3
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x4506f3
lea edx, [esp + 8]
mov dword [esp + 8], esi
mov ecx, dword [eax]
push edx
push esi
lea edx, [esp + 0x3c]
push 1
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4506e9
mov eax, dword [esp + 8]
cmp eax, esi
je 0x4506e9
lea edx, [esp + 4]
mov dword [esp + 4], esi
mov ecx, dword [eax]
push edx
push esi
push 0x57a818
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x4506df
mov eax, dword [esp + 4]
cmp eax, esi
je 0x4506df
mov edx, dword [esp + 0x48]
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
mov ecx, dword [eax]
push eax
sbb esi, esi
inc esi
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 0x40
ret
Function at 0x450710
Capabilities:
Create process on windows
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
sub esp, 0x440
push ebx
push esi
mov esi, dword [esp + 0x44c]
xor ebx, ebx
cmp esi, ebx
je 0x4508e2
cmp word [esi], bx
je 0x4508e2
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e]
mov word [esp + 0x3c], bx
mov word [esp + 0x244], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x246]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x248]
push 0x26
push eax
push ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x208
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x244]
lea edx, [esp + 0x3c]
push ecx
push str._sInternet_Exploreriexplore.exe
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.0043f120
add esp, 0x18
test eax, eax
pop edi
jne 0x4508ae
lea ecx, [esp + 0x14]
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push 0x56d150
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 0x38]
push ebx
push ecx
call fcn.0043f120
add esp, 8
test eax, eax
jne 0x4508ae
mov word [esp + 0x38], bx
lea eax, [esp + 8]
mov dword [esp + 8], ebx
push eax
push 0x52c0e0
push 0x15
push ebx
push 0x52c0b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4508e2
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x4508a0
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x94]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x450850
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0xc]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x18]
mov esi, eax
push edx
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
mov word [esp + 0x1c], bx
push edx
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x38]
mov word [esp + 0x38], 8
mov dword [esp + 0x40], esi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
cmp word [esp + 0x38], bx
je 0x4507f6
push 0xa
push ebx
lea edx, [esp + 0x40]
push esi
push edx
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x440
ret
Function at 0x450dc0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x52af10
push 1
push 0
push 0x52af40
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x450e5a
mov ecx, dword [esp]
test ecx, ecx
je 0x450e5a
mov eax, dword [esp + 0x10]
push esi
mov dword [esp + 8], 0
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x50]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x52c180
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x450e4d
mov eax, dword [esp + 8]
test eax, eax
je 0x450e4d
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x4512b0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x410
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x41c]
lea ecx, [esp + 8]
push eax
push 0x5394a4
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
cmp word [esp + eax*2 + 6], 0x5c
je 0x451314
lea eax, [esp + 8]
push 0x539bc8
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x451331
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
rep stosd dword es:[edi], eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
lea edx, [esp + 0x218]
push 0x24
push edx
push 0
stosw word es:[edi], ax
call ebx
test eax, eax
je 0x451387
lea eax, [esp + 0x214]
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
je 0x451387
mov esi, 1
xor eax, eax
lea edx, [esp + 0x214]
push eax
mov ecx, 0x82
lea edi, [esp + 0x218]
push 0x26
push edx
push eax
rep stosd dword es:[edi], eax
call ebx
test eax, eax
pop ebx
je 0x4513c9
lea eax, [esp + 0x210]
lea ecx, [esp + 8]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4513c9
mov esi, 1
mov eax, esi
pop edi
pop esi
add esp, 0x410
ret

Function at 0x4513e0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x451427
push 0x5590ec
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 8], 0xfeff
je 0x451427
push esi
push 1
lea eax, [esp + 0x10]
push 2
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop esi
ret
Function at 0x451430
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
cmp esi, ebx
jne 0x451447
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebx
push esi
call dword [sym.imp.MSVCRT.dll__waccess]
add esp, 8
test eax, eax
je 0x45145e
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
xor eax, eax
push edi
mov dword [esp + 0xd], eax
push 0x5590f8
mov dword [esp + 0x15], eax
push esi
mov dword [esp + 0x1d], eax
mov byte [esp + 0x14], bl
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x4514a9
push edi
push 2
lea ecx, [esp + 0x14]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea edx, [esp + 0xc]
push 0x5590f4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
pop edi
jne 0x4514c9
push esi
call fcn.004adab0
add esp, 4
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x451650
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x451758
cmp word [edi], 0
je 0x451758
push 0x2210
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x451758
mov esi, 0x104
mov ecx, eax
sub edi, eax
lea edx, [esi + 0x7ffffefa]
test edx, edx
je 0x4516ab
mov dx, word [edi + ecx]
test dx, dx
je 0x4516ab
mov word [ecx], dx
add ecx, 2
dec esi
jne 0x45168d
jmp 0x4516af
test esi, esi
jne 0x4516b2
sub ecx, 2
mov esi, dword [esp + 0x14]
mov word [ecx], 0
test esi, esi
je 0x4516fc
cmp word [esi], 0
je 0x4516fc
lea ecx, [eax + 0x208]
mov edi, 0x1000
sub esi, ecx
lea edx, [edi + 0x7fffeffe]
test edx, edx
je 0x4516f0
mov dx, word [esi + ecx]
test dx, dx
je 0x4516f0
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x4516d2
jmp 0x4516f4
test edi, edi
jne 0x4516f7
sub ecx, 2
mov word [ecx], 0
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
push 0
push 4
push eax
push 0x451510
push 0
push 0
mov dword [eax + 0x2208], ecx
mov dword [eax + 0x220c], edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x451758
test edi, edi
je 0x45173a
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x451751
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret