joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00406b40
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.00407984
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x44d70c
xor eax, eax
push ebp
push 0x44d705
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407b08
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00407984
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x44d6e7
mov edx, dword [ebp - 8]
shr edx, 1
dec edx
mov eax, ebx
call fcn.00407b08
jmp 0x44d6ee
mov eax, ebx
call fcn.00406b40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d70c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x450b54
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x450ba6
test eax, edx
je 0x450ba9
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x450b69
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x450b8f
add ecx, 4
js 0x450b7f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x450b8c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x450bb5
test edx, edx
jne 0x450b5c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x456ecc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x456fa2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x456f75
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x456f26
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00407a80
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041b9c8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004072e0
jmp 0x456f35
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040763c
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x456f46
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x456f68
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4b7e3c]
inc ecx
dec edx
jne 0x456f4f
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456f7f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456fa9
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406c00
lea eax, [ebp - 4]
call fcn.00406b64
ret

Function at 0x456fb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4570d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x4570a7
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x45701f
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00407a80
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041b9c8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004072e0
jmp 0x45702e
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040763c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x457048
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x457091
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00408778
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4b8244]
mov eax, dword [eax*8 + 0x4b8240]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x457053
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4570b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4570db
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406c00
lea eax, [ebp - 4]
call fcn.00406b64
ret
Function at 0x45a388
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406c24
mov eax, dword [ebp - 8]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45a49b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45a3ee
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a3db
mov ebx, pe_nt_image_headers32
jmp 0x45a3ee
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a3ee
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x45a480
cmp dword [ebp - 8], 0
jne 0x45a449
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x45a471
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a4a2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x45a4b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00406c24
mov eax, dword [ebp - 8]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45a5f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45a526
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a513
mov ebx, pe_nt_image_headers32
jmp 0x45a526
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a526
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x45a5d5
cmp dword [ebp - 8], 0
jne 0x45a557
xor ebx, ebx
jmp 0x45a561
mov eax, dword [ebp - 8]
call fcn.00407984
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45a5cc
mov eax, dword [ebp - 0x20]
call fcn.004044f0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45a5c4
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x45a5ba
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x45a5cc
mov eax, dword [ebp - 0x1c]
call fcn.0040450c
jmp 0x45a5cc
mov eax, dword [ebp - 0x1c]
call fcn.0040450c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a5f7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x45a8d8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45a91d
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a90a
mov ebx, pe_nt_image_headers32
jmp 0x45a91d
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a91d
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.00407984
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x45a967
mov eax, ebp
call fcn.00407984
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45a974
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
jne 0x45a9a6
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x45aa27
xor eax, eax
push ebp
push 0x45aa09
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45a9e8
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a9d5
mov ebx, pe_nt_image_headers32
jmp 0x45a9e8
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a9e8
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45aa27
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x45ab44
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45ad34
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x45ad50
call fcn.00407efc
test eax, eax
je 0x45ad11
cmp byte [ebp - 0x11], 0
je 0x45ad04
xor edx, edx
push ebp
push 0x45acfa
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45abd2
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45abbf
mov esi, pe_nt_image_headers32
jmp 0x45abd2
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45abd2
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.00407984
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x45ace9
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x45acc8
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x45acc8
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x45acc8
mov eax, dword [0x4b8aa8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00407b08
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004070f4
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x45acbe
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00407b08
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00423220
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00407be0
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0045ab44
test al, al
jne 0x45acbe
call fcn.004062ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45ad11
dec esi
cmp esi, 0xffffffff
jne 0x45ac42
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45acf0
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407b08
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0045aa30
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad3b
lea eax, [ebp - 0x24]
call fcn.00406b40
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x45b084
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov byte [ebp - 1], 6
xor edx, edx
push ebp
push 0x45b167
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x45b122
mov byte [ebp - 1], 4
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x45b0fe
mov byte [ebp - 1], 9
cmp byte [ebp - 6], 1
jne 0x45b0eb
cmp dword [ebp - 0x118], 1
jb 0x45b15d
mov byte [ebp - 1], 0xc
jmp 0x45b15d
mov byte [ebp - 1], 0xa
cmp dword [ebp - 0x118], 1
jb 0x45b15d
mov byte [ebp - 1], 0xb
jmp 0x45b15d
cmp eax, 5
jb 0x45b15d
mov byte [ebp - 1], 5
cmp dword [ebp - 0x118], 1
jb 0x45b15d
cmp byte [ebp - 6], 1
jne 0x45b11c
mov byte [ebp - 1], 6
jmp 0x45b15d
mov byte [ebp - 1], 8
jmp 0x45b15d
cmp eax, 1
jne 0x45b159
mov byte [ebp - 1], 0
cmp dword [ebp - 0x11c], 4
jne 0x45b141
cmp dword [ebp - 0x118], 0xa
jne 0x45b141
mov byte [ebp - 1], 1
cmp dword [ebp - 0x11c], 4
jne 0x45b15d
cmp dword [ebp - 0x118], 0x5a
jne 0x45b15d
mov byte [ebp - 1], 2
jmp 0x45b15d
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45b171
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bad4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45bc33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b40
mov edx, dword [ebp - 4]
mov eax, 0x45bc50
call fcn.00407efc
test eax, eax
jne 0x45bba3
lea eax, [ebp - 8]
mov edx, 1
call fcn.00407b08
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
mov edi, eax
push edi
push 0
call sub.kernel32.dll_SearchPathW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00407b08
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
push ebx
push 0
push edi
push 0
call sub.kernel32.dll_SearchPathW
test eax, eax
je 0x45bb97
mov eax, dword [ebp - 8]
call fcn.00407984
call fcn.00407058
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00407b08
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f20
jmp 0x45bc18
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f20
jmp 0x45bc18
lea eax, [ebp - 8]
mov edx, 1
call fcn.00407b08
push 0
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
call fcn.00407984
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00407b08
push ebx
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x45bc0e
mov eax, dword [ebp - 8]
call fcn.00407984
call fcn.00407058
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00407b08
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f20
jmp 0x45bc18
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc3a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x45c11c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45c1eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b40
xor edx, edx
push ebp
push 0x45c1c8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x45c1be
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004079dc
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x45c18e
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45c1a4
mov eax, ebx
mov edx, 0x45c208
call fcn.00407b88
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0045c0cc
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c1d2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c1f2
lea eax, [ebp - 0x208]
call fcn.00406b40
ret
Function at 0x45c20c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45c300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b40
xor edx, edx
push ebp
push 0x45c2d8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x45c2ce
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004079dc
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.0045d3dc
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00406f20
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0045c0cc
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f20
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x45c2b8
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45c2ce
mov eax, ebx
mov edx, 0x45c31c
call fcn.00407b88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c2e2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c307
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x45c320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45c4b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x45c487
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0045b17c
cmp al, 9
jb 0x45c3ff
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00407b08
xor edx, edx
push ebp
push 0x45c3f8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x45c3e0
mov eax, dword [ebp - 4]
call fcn.00407984
mov edx, dword [ebp - 8]
call fcn.0041da24
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c3b2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45c3ce
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00423220
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00406f20
call fcn.004062ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c491
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c3ff
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407b08
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4b9530]
mov eax, dword [eax]
mov ecx, 0x45c4d0
mov edx, 0x45c4ec
call fcn.0045a6ec
test al, al
je 0x45c47d
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0045c0cc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00406f20
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c44b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45c47d
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c460
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45c47d
mov eax, dword [ebp - 8]
mov edx, 0x45c57c
call fcn.00407b88
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c491
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c4bb
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 4]
call fcn.00406b40
ret