joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442520
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 1
push edi
mov edi, dword [esp + 0x18]
cmp dword [esi + 0xc], ebp
jne 0x44254c
cmp edi, 0x4e20
jbe 0x442541
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4425ee
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4425a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x442584
cmp eax, 3
jne 0x4425a0
cmp edi, 0x4e20
jbe 0x4425a0
push 0x4e20
push ebx
mov ecx, esi
call fcn.00442520
pop edi
pop esi
pop ebp
pop ebx
ret 8
cmp dword [esi + 0xc], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4425bb
call ebp
cmp eax, 0x6d
jne 0x4425bb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
cmp dword [esi + 0xc], 0
jne 0x4425e4
cmp edi, 0x8000
jbe 0x4425e4
call ebp
cmp eax, 0x21
jne 0x4425e4
push 0x8000
push ebx
mov ecx, esi
call fcn.00442520
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x442b00
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push 0x800
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00451890
movzx edx, word [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x442b66
cmp eax, 5
je 0x442b66
xor eax, eax
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004df2c4
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
xor ecx, esp
mov eax, 1
call fcn.004df2c4
add esp, 0x1004
ret 4

Function at 0x442b90
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
push esi
push 0x800
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.004511c0
lea edx, [esp + 0xc]
push edx
movzx edx, word [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x18]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x24]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x442c27
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x10]
ja 0x442c27
push 1
push esi
push esi
push eax
call fcn.004e0250
mov ecx, dword [esp + 4]
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.004df2c4
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x101c]
pop esi
xor ecx, esp
xor eax, eax
xor edx, edx
call fcn.004df2c4
add esp, 0x101c
ret 4
Function at 0x442c50
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
push 0x800
lea ecx, [esp + 0x210]
push ecx
push eax
call fcn.00451890
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x442d54
mov ecx, 0x4faeb4
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442cda
test dx, dx
je 0x442cd6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442cda
add eax, 4
add ecx, 4
test dx, dx
jne 0x442cb4
xor eax, eax
jmp 0x442cdf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x442d38
mov ecx, 0x4faea8
lea eax, [esp]
jmp 0x442cf0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442d16
test dx, dx
je 0x442d12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442d16
add eax, 4
add ecx, 4
test dx, dx
jne 0x442cf0
xor eax, eax
jmp 0x442d1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x442d38
xor eax, eax
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004df2c4
add esp, 0x1210
ret 4
mov eax, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004df2c4
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor ecx, esp
xor al, al
call fcn.004df2c4
add esp, 0x1210
ret 4

Function at 0x442db0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push edi
mov edi, dword [esp + 0x1014]
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x442e01
push 0x800
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00451950
test al, al
je 0x442dff
lea ecx, [esp + 0xc]
push ecx
call ebx
jmp 0x442e01
mov eax, esi
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x1004
ret 4

Function at 0x442e20
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
mov esi, dword [esp + 0x1014]
push edi
mov edi, dword [esp + 0x101c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x442e80
push 0x800
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00451950
test al, al
je 0x442e80
push edi
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
setne al
jmp 0x442e82
mov al, bl
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x1004
ret 8
Function at 0x442ea0
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x201c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x442f1e
push 0x800
lea eax, [esp + 0x1014]
push eax
push esi
call fcn.00451950
test al, al
je 0x442f1e
push 0x800
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.00451950
test al, al
je 0x442f1e
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1014]
push eax
call ebp
test eax, eax
setne al
jmp 0x442f20
mov al, bl
mov ecx, dword [esp + 0x2010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x2004
ret 8

Function at 0x442f40
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x442f96
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00451950
test al, al
je 0x442f96
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x442f98
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x1004
ret 4

Function at 0x442fc0
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x443016
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00451950
test al, al
je 0x443016
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x443018
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x1004
ret 4

Function at 0x443320
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0x10], eax
jbe 0x443378
mov dword [ecx + 0x10], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x443620
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x1004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x44367c
push esi
call fcn.00442db0
cmp eax, 0xffffffff
jne 0x443698
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00451950
test al, al
je 0x443698
push 0
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
je 0x443698
cmp byte [esp + 0x1014], 0
je 0x443694
mov edx, dword [esp + 0x1018]
push edx
push esi
call fcn.00442e20
xor eax, eax
jmp 0x4436b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4436ad
cmp eax, 3
mov eax, 1
jne 0x4436b2
mov eax, 2
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004df2c4
add esp, 0x1004
ret 0xc
Function at 0x444bc0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
push ebp
push esi
mov esi, dword [esp + 0x126c]
push edi
mov edi, dword [esp + 0x1268]
cmp edi, 0xffffffff
jne 0x444c6f
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x444ca3
push 0x800
lea ecx, [esp + 0x264]
push ecx
push ebx
call fcn.00451950
test al, al
je 0x444c3c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x444ca3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x444c58
cmp eax, 3
je 0x444c58
cmp eax, 0x12
je 0x444c58
mov eax, 1
jmp 0x444c5a
xor eax, eax
mov byte [esi + 0x1044], al
mov dword [esi + 0x1040], 0
jmp 0x444d82
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x444ca3
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne dl
mov byte [esi + 0x1044], dl
mov dword [esi + 0x1040], 0
jmp 0x444d82
push 0x800
push ebx
push esi
call fcn.00466930
push 0x800
lea eax, [esp + 0x40]
push eax
push esi
call fcn.004510f0
mov ecx, dword [esp + 0x2c]
push 1
push 0
push 0
push ecx
call fcn.004e0250
mov ecx, dword [esp + 0x30]
xor ebx, ebx
add eax, ecx
mov ecx, dword [esp + 0x18]
adc edx, ebx
mov dword [esi + 0x1000], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1004], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1028], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1008], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x102c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1034], eax
mov dword [esi + 0x1030], edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x24]
mov dword [esi + 0x1038], ecx
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x103c], edx
call fcn.00467cc0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x1018]
call fcn.00467cc0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0x1020]
call fcn.00467cc0
test dword [esp + 0x10], 0x400
je 0x444d74
cmp dword [esp + 0x34], 0xa0000003
jne 0x444d74
lea eax, [ebx + 1]
jmp 0x444d76
xor eax, eax
mov byte [esi + 0x100e], al
mov dword [esi + 0x1040], ebx
mov ecx, dword [esp + 0x1260]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x1254
ret 0xc
Function at 0x4490a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd4]
push 0x4000
push 0
push eax
call fcn.004e01d0
add esp, 0xc
cmp byte [esp + 8], 0
je 0x449191
cmp byte [esi + 0x6135], 0
jne 0x449191
mov ecx, dword [esi + 0xe8]
mov eax, dword [esi + 0x6130]
shr ecx, 2
cmp eax, ecx
ja 0x449191
xor edx, edx
test eax, eax
jbe 0x4491d3
push ebx
push edi
jmp 0x449100
mov eax, dword [esi + 0xd0]
movzx edi, byte [eax + edx + 1]
lea ecx, [eax + edx]
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 2]
imul eax, eax, 0x2773
xor eax, edi
mov edi, dword [esi + 0xd8]
imul eax, eax, 0x2773
xor eax, ecx
mov ecx, eax
imul eax, eax, 0x2773
and ecx, 0x3ffff
xor ebx, ebx
mov word [edi + ecx*2], bx
mov ecx, dword [esi + 0xd0]
movzx ecx, byte [ecx + edx + 3]
mov edi, dword [esi + 0xdc]
xor ecx, eax
mov eax, ecx
imul ecx, ecx, 0x2773
and eax, 0x3ffff
mov dword [edi + eax*4], ebx
mov eax, dword [esi + 0xd0]
movzx eax, byte [eax + edx + 4]
xor eax, ecx
and eax, dword [esi + 0xec]
mov ecx, dword [esi + 0xe0]
inc edx
mov dword [ecx + eax*4], ebx
cmp edx, dword [esi + 0x6130]
jb 0x449100
pop edi
pop ebx
pop esi
ret 4
mov edx, dword [esi + 0xd8]
push 0x80000
push 0
push edx
call fcn.004e01d0
mov eax, dword [esi + 0xdc]
push 0x100000
push 0
push eax
call fcn.004e01d0
mov ecx, dword [esi + 0xe8]
mov edx, dword [esi + 0xe0]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call fcn.004e01d0
add esp, 0x24
pop esi
ret 4
Function at 0x44b950
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xc0]
push ebp
xor edx, edx
push esi
add ebx, 0xffffff88
push edi
add eax, 2
lea edi, [esp + 0x20]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov edi, edi
cmp edx, ebx
jge 0x44bab3
lea eax, [esp + 0x48]
sub eax, 2
lea ecx, [eax + 3]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x48]
sub ecx, eax
add ecx, 0xfffffffd
mov dword [esp + 0x3c], ecx
mov ecx, eax
neg ecx
lea esi, [esp + ecx + 0x48]
mov dword [esp + 0x44], esi
lea esi, [esp + ecx + 0x49]
mov dword [esp + 0x30], esi
lea esi, [esp + 0x48]
sub esi, eax
lea eax, [esp + ecx + 0x4a]
mov ecx, dword [esp + 0x14]
sub ebx, edx
mov dword [esp + 0x40], eax
dec ebx
mov eax, 0x88888889
mul ebx
dec esi
mov ebp, edx
shr ebp, 0xa
mov dword [esp + 0x2c], esi
mov esi, dword [edi]
mov dword [esp + 0x10], ecx
inc ebp
mov eax, dword [esp + 0x10]
xor edi, edi
lea ebx, [ebx]
movzx edx, byte [eax - 2]
mov cl, byte [eax - 1]
sub dl, cl
mov byte [esp + edi + 0x48], dl
movzx edx, byte [eax]
sub dl, cl
mov byte [esp + edi + 0x49], cl
mov byte [esp + edi + 0x4a], dl
add edi, 3
add eax, 3
cmp edi, 0x78
jl 0x44ba10
mov ecx, dword [esp + 0x34]
mov edi, 0x27
mov edi, edi
mov eax, dword [esp + 0x40]
movzx edx, byte [eax + ecx]
mov eax, dword [esp + 0x2c]
sub dl, byte [eax + ecx]
add ecx, 3
movsx eax, dl
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, dword [esp + 0x44]
mov al, byte [edx + ecx - 3]
mov edx, dword [esp + 0x3c]
sub al, byte [edx + ecx - 3]
movsx eax, al
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + ecx - 3]
sub dl, byte [ecx - 3]
movsx eax, dl
cdq
xor eax, edx
sub eax, edx
add eax, esi
sub edi, 1
lea esi, [eax + ebx]
jne 0x44ba40
add dword [esp + 0x10], 0x780
sub ebp, 1
jne 0x44ba04
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [edi], esi
inc dword [esp + 0x14]
inc edx
add edi, 4
cmp edx, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
jle 0x44b9a0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, ecx
ja 0x44bafd
cmp eax, edx
ja 0x44bafd
xor eax, eax
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.004df2c4
add esp, 0xb4
ret 8
cmp edx, ecx
mov ecx, dword [esp + 0xb0]
sbb eax, eax
neg eax
xor ecx, esp
inc eax
call fcn.004df2c4
add esp, 0xb4
ret 8
Function at 0x451250
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea edx, [esp + 4]
push edx
xor ecx, ecx
push 0x1a
push ecx
mov word [esi], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4512c4
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4512c4
cmp word [esi], 0
je 0x4512c4
push edi
push esi
call fcn.00450a60
push edi
push 0x4fafa0
push esi
call fcn.004669b0
push esi
call fcn.004432f0
test al, al
jne 0x4512f1
cmp byte [esp + 0x10], al
je 0x4512c0
push 0
push 0
push esi
call fcn.00443620
test eax, eax
sete al
test al, al
jne 0x4512f1
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.00450f20
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x4512ec
cmp word [esi + 2], 0x3a
jne 0x4512e9
add esi, 8
cmp eax, esi
jb 0x4512ec
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4

Function at 0x451310
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x10]
push ecx
push 1
xor eax, eax
push eax
push str.SoftwareWinRARPaths
push SysReAllocString
mov word [esi], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x451368
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.AppData
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x451378
push esi
call fcn.004432f0
test al, al
jne 0x451384
mov eax, dword [esp + 0x18]
push eax
mov eax, esi
call fcn.00451250
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x451950
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [esp + 0x1010]
movzx eax, word [edi]
test ax, ax
jne 0x451987
xor al, al
jmp 0x451b85
push eax
call fcn.004665d0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451992
push ebx
sub eax, edx
sar eax, 1
push edi
mov ebx, eax
call fcn.00451840
test al, al
je 0x451a7c
movzx eax, word [edi]
push eax
call fcn.004665d0
movzx eax, ax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x451a0b
cmp word [edi + 2], 0x3a
jne 0x451a0b
add ebx, 4
cmp dword [esp + 0x101c], ebx
jbe 0x451b82
push 4
push 0x4fb020
push esi
call fcn.004e2e28
add esp, 0xc
sub esi, edi
mov eax, edi
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4519f5
mov al, 1
jmp 0x451b84
cmp word [edi], 0x5c
jne 0x451b82
add edi, 2
cmp word [edi], 0x5c
jne 0x451b82
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x451b82
push 4
push 0x4fb020
push esi
call fcn.004e2e28
mov eax, 0x4fb018
mov ecx, esi
add esp, 0xc
sub ecx, eax
lea edx, [ecx + 8]
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x451a50
sub esi, edi
mov eax, edi
lea edx, [esi + 0xe]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x451a66
mov al, 1
jmp 0x451b84
lea edx, [esp + 0xc]
push edx
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x451b82
cmp eax, 0x7ff
ja 0x451b82
movzx eax, word [edi]
push eax
call fcn.00450a30
test al, al
je 0x451af9
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x451b82
push 4
push 0x4fb020
push esi
call fcn.004e2e28
push 2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esi + 8]
push edx
call fcn.004e2e28
add esp, 0x18
sub esi, edi
mov eax, edi
lea edx, [esi + 0xc]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x451ae3
mov al, 1
jmp 0x451b84
push 0x800
lea eax, [esp + 0x10]
push eax
call fcn.00450a60
lea eax, [esp + 0xc]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451b10
sub eax, edx
sar eax, 1
lea ecx, [eax + ebx + 4]
mov ebx, dword [esp + 0x101c]
cmp ebx, ecx
jbe 0x451b82
push 4
push 0x4fb020
push esi
call fcn.004e2e28
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
sub edx, ecx
add esp, 0xc
add edx, 8
jmp 0x451b50
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x451b50
cmp word [edi], 0x2e
jne 0x451b76
movzx edx, word [edi + 2]
push edx
call fcn.00450a30
test al, al
je 0x451b76
add edi, 4
push ebx
push edi
push esi
call fcn.004669b0
mov al, 1
jmp 0x451b84
xor al, al
pop ebx
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004df2c4
add esp, 0x1004
ret 0xc
Function at 0x455b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
mov dword [esi + 4], 0
mov dword [esi], 0
mov eax, ebp
cmp ebp, 0x8000
jb 0x455b85
mov eax, 0x8000
mov edi, dword [esp + 0x10]
push ebx
push eax
mov eax, dword [esi + 0xc]
push edi
push eax
call fcn.004dfe60
mov eax, 1
add esp, 0xc
xor bl, bl
cmp ebp, eax
jbe 0x455bab
xor bl, byte [eax + edi]
inc eax
cmp eax, ebp
jb 0x455ba3
push 8
mov ecx, esi
call fcn.00445750
mov esi, dword [esp + 0x1c]
mov dword [esi + 0x14], 0
cmp bl, byte [edi]
pop ebx
jne 0x455bec
push ebp
push edi
push 0xffffffffffffffff
call fcn.00438b40
xor edx, edx
not eax
xor ecx, ecx
cmp dword [ecx + 0x50e2f4], eax
jne 0x455be3
cmp dword [ecx + 0x50e2f0], ebp
je 0x455c5b
add ecx, 0xc
inc edx
cmp ecx, 0x48
jb 0x455bd3
push 1
mov ecx, esi
call fcn.00455ad0
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
mov dword [esi + 0x14], ecx
lea edx, [eax + eax*4]
mov eax, dword [esi]
lea eax, [eax + edx*8]
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
mov ecx, 3
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
lea edx, [eax + 0x1c]
xor ecx, ecx
mov dword [eax], 0x16
mov dword [eax + 0x24], edx
cmp dword [esi + 0x14], ecx
jle 0x455c55
xor edx, edx
lea esp, [esp]
mov eax, dword [esi]
add eax, edx
cmp dword [eax + 0x14], 0
jne 0x455c40
lea edi, [eax + 0xc]
mov dword [eax + 0x14], edi
cmp dword [eax + 0x24], 0
jne 0x455c4c
lea edi, [eax + 0x1c]
mov dword [eax + 0x24], edi
inc ecx
add edx, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x455c30
pop edi
pop esi
pop ebp
ret 0xc
lea ecx, [edx + edx*2]
mov edi, dword [ecx*4 + 0x50e2f8]
test edi, edi
je 0x455bec
push 1
mov ecx, esi
call fcn.00455ad0
mov eax, dword [esi + 0x14]
mov ecx, dword [esi]
lea edx, [eax + 1]
mov dword [esi + 0x14], edx
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
lea ecx, [eax + 0xc]
mov dword [ecx], edi
pop edi
mov dword [eax + 0x14], ecx
mov ecx, 3
lea edx, [eax + 0x1c]
pop esi
mov dword [eax], 0x28
mov dword [eax + 0x24], edx
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
pop ebp
ret 0xc