joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446a20
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1048
call fcn.004573a0
mov eax, dword [0x480250]
xor eax, esp
mov dword [esp + 0x1044], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWARENokiaFuse
push reloc.WS2_32.dll_bind
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x446a8c
push str.SOFTWARENokiaFuse
push eax
lea ecx, [esp + 0x10]
push str.RegOpenKeyEx_failed_with_error__i_on__s
push ecx
mov ecx, str...commonconfigurationfile.cpp_32_
call fcn.00446410
add esp, 0x10
push 0x477dac
lea edx, [esp + 0xc]
push edx
call fcn.00451e1b
mov edx, dword [esp + 4]
push edi
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push str.InstPath
push edx
mov dword [esp + 0x1c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x446ad2
push eax
push str.RegCloseKey_failed_with_error__i
call fcn.004167d0
add esp, 8
test edi, edi
je 0x446b02
push str.SOFTWARENokiaFuse
push edi
lea ecx, [esp + 0x14]
push str.RegOpenKeyEx_failed_with_error__i_on__s
push ecx
mov ecx, str...commonconfigurationfile.cpp_47_
call fcn.00446410
add esp, 0x10
push 0x477dac
lea edx, [esp + 0x10]
push edx
call fcn.00451e1b
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.FuseService.cfg
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x48]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x446b36
sub eax, edx
push eax
lea edx, [esp + 0x4c]
push edx
mov ecx, esi
call fcn.004028a0
mov ecx, dword [esp + 0x1048]
pop edi
xor ecx, esp
mov eax, esi
call fcn.0044e7cc
add esp, 0x1048
ret
Function at 0x446d40
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x463c8b
mov eax, dword fs:[0]
push eax
push ebp
push edi
mov eax, dword [0x480250]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x446d87
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0xc
ret 4
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x446d90
sub eax, edx
push eax
push esi
mov ecx, ebp
call fcn.004028a0
cmp dword [ebp + 0x1c], 0
jne 0x446dd9
push 0xc
call fcn.0044e628
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x446dcc
push eax
call fcn.00448a90
jmp 0x446dce
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [ebp + 0x1c], eax
sub esp, 0x1c
mov ecx, esp
mov eax, esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
mov dword [esp + 0x38], esp
mov byte [ecx + 4], 0
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x446e00
sub eax, edi
push eax
push esi
call fcn.004028a0
mov ecx, dword [ebp + 0x1c]
call fcn.00448c20
test eax, eax
setge al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0xc
ret 4

Function at 0x446e40
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x3c
push ebp
mov ebp, dword [esp + 0x44]
cmp dword [ebp + 0x1c], 0
push esi
push edi
jne 0x446e85
cmp dword [ebp + 0x18], 0x10
jb 0x446e5b
mov ebp, dword [ebp + 4]
jmp 0x446e5e
add ebp, 4
push ebp
lea eax, [esp + 0x10]
push str.Configuration_object_not_created___s_
push eax
mov ecx, str...commonconfigurationfile.cpp_141_
call fcn.00446410
add esp, 0xc
push 0x477dac
lea ecx, [esp + 0x10]
push ecx
call fcn.00451e1b
cmp dword [ebp + 0x18], 0x10
lea esi, [ebp + 4]
jb 0x446e92
mov eax, dword [esi]
jmp 0x446e94
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x446eb0
cmp dword [ebp + 0x18], 0x10
jb 0x446ea9
mov edi, dword [esi]
jmp 0x446eab
mov edi, esi
call fcn.00448430
cmp dword [ebp + 0x18], 0x10
jb 0x446eb8
mov esi, dword [esi]
sub esp, 0x1c
mov ecx, esp
mov eax, esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
mov dword [esp + 0x68], esp
mov byte [ecx + 4], 0
lea edi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x446ed8
sub eax, edi
push eax
push esi
call fcn.004028a0
mov ecx, dword [ebp + 0x1c]
call fcn.00449530
pop edi
test eax, eax
pop esi
setge al
pop ebp
add esp, 0x3c
ret 4
Function at 0x448430
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push 0
lea eax, [esp + 0xc]
push eax
push 1
push str.D:_D_OICI_GA___AN__A_OICI_GRGWGXSD___AU__A_OICI_GRGWGXSD___BG__A_OICI_GA___BA_
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA]
test eax, eax
jne 0x44846c
push str.CreateEmptyConfigFileWithUserAccessRights:_Could_not_create_DACL
call fcn.004167d0
add esp, 4
add esp, 0x10
ret
push esi
push 0
push 0x80
push 2
lea ecx, [esp + 0x14]
push ecx
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x4484a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateEmptyConfigFileWithUserAccessRights:_Could_not_create_config_file:__s__error_code:__i
call fcn.004167d0
add esp, 0xc
pop esi
add esp, 0x10
ret
mov eax, str._configuration___configuration_
mov dword [esp + 4], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4484c0
push 0
sub eax, edx
lea edx, [esp + 8]
push edx
push eax
push str._configuration___configuration_
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4484fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateEmptyConfigFileWithUserAccessRights:_Could_not_write_to_config_file:__s__error_code:__i
call fcn.004167d0
add esp, 0xc
pop esi
add esp, 0x10
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x448522
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateEmptyConfigFileWithUserAccessRights:_Could_not_close_config_file:__s__error_code:__i
call fcn.004167d0
add esp, 0xc
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x448543
push str.CreateEmptyConfigFileWithUserAccessRights:_Error_releasing_DACL
call fcn.004167d0
add esp, 4
pop esi
add esp, 0x10
ret
push edi
push str.Config_file__s_created_with_user_account_rights
call fcn.004167d0
add esp, 8
pop esi
add esp, 0x10
ret
Function at 0x44b830
Capabilities:
Initialize winsock library

Disassembly:
push ebp
lea ebp, [esp - 0x24c]
sub esp, 0x24c
push 0xffffffffffffffff
push 0x466a03
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x480250]
xor eax, ebp
mov dword [ebp + 0x248], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp]
push eax
xor edi, edi
push 0x202
mov ebx, ecx
mov dword [ebp - 4], edi
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x44b89d
push 0x478054
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x30], 0x84240015
call fcn.00451e1b
mov esi, dword [sym.imp.ole32.dll_CoInitializeEx]
push edi
push edi
call esi
test eax, eax
jge 0x44b8c0
push edi
push edi
call esi
push 0x477f1c
lea edx, [ebp - 0x38]
push edx
mov dword [ebp - 0x38], eax
call fcn.00451e1b
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
push str.SOFTWARENokiaTSSDiagnostic_Log_2_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44b8f3
push 0x478054
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x842400ae
call fcn.00451e1b
mov dword [ebp + 0x1a8], 0xf
mov dword [ebp + 0x1a4], edi
mov byte [ebp + 0x194], 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.InstallationPath
mov byte [ebp - 4], 1
lea esi, [ebp + 0x190]
call fcn.004025b0
mov edx, dword [ebp - 0x18]
push edx
mov ecx, esi
call fcn.0044bec0
cmp eax, edi
jge 0x44b963
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.InstallationPath
call fcn.004025b0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0044bec0
push 0x477f1c
lea ecx, [ebp - 0x34]
push ecx
mov dword [ebp - 0x34], eax
call fcn.00451e1b
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x44b986
push 0x478054
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x842400ae
call fcn.00451e1b
lea ecx, [ebp + 0x190]
push ecx
lea ecx, [ebp + 0x1ac]
call fcn.004025f0
mov byte [ebp - 4], 2
mov edi, dword [ebp + 0x1c0]
add edi, 0xffffffff
lea eax, [ebp + 0x1ac]
call fcn.0044b740
cmp byte [eax], 0x5c
je 0x44b9c6
lea edx, [ebp + 0x1ac]
push edx
mov edx, 0x471ae0
call fcn.00413c50
lea eax, [ebp + 0x1ac]
push eax
mov edx, str.Dlog.dll
call fcn.00413c50
cmp dword [ebp + 0x1c4], 0x10
mov eax, dword [ebp + 0x1b0]
jae 0x44b9ec
lea eax, [ebp + 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebx], eax
jne 0x44ba0e
push 0x478054
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], 0x842400ba
call fcn.00451e1b
push str.DllGetClassObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp + 0x1ac]
mov dword [ebx + 4], eax
call fcn.00402620
lea ecx, [ebp + 0x190]
call fcn.00402620
xor eax, eax
jmp 0x44be92
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x248]
xor ecx, ebp
call fcn.0044e7cc
add ebp, 0x24c
mov esp, ebp
pop ebp
ret
Function at 0x44bec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x284]
sub esp, 0x284
push 0xffffffffffffffff
push 0x466886
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x480250]
xor eax, ebp
mov dword [ebp + 0x280], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x28c]
mov esi, ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x294]
mov edi, 0x10
cmp dword [ebp + 0x2a8], edi
mov dword [ebp - 0x24], 0x1ff
jae 0x44bf32
lea ecx, [ebp + 0x294]
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp]
push edx
lea edx, [ebp - 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44bf61
push 0x478054
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x842400ae
call fcn.00451e1b
lea eax, [ebp]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x44bf67
sub eax, edx
push eax
lea ecx, [ebp]
push ecx
mov ecx, esi
call fcn.004028a0
cmp dword [ebp + 0x2a8], edi
jb 0x44bf95
mov edx, dword [ebp + 0x294]
push edx
call fcn.0044e982
add esp, 4
xor eax, eax
jmp 0x44c3fc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x280]
xor ecx, ebp
call fcn.0044e7cc
add ebp, 0x284
mov esp, ebp
pop ebp
ret 0x20

Function at 0x44cee0
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x4816e8], 0
je 0x44cf1f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x482f54
push 0x475504
push 0x400
push 0x482f78
call fcn.0044e93c
add esp, 0x18
push 0x482f78
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x483384]
test eax, eax
je 0x44cf53
push esi
mov esi, dword [eax + 0x10]
test esi, esi
je 0x44cf52
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
push edi
push 0x482f54
push 0x20
push 3
push esi
call ecx
test eax, eax
jge 0x44cf52
push 0x4759b8
push esi
push eax
call fcn.00463090
pop esi
ret

Function at 0x44cf60
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x4816e8], 0
je 0x44cf9f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x482f54
push 0x47551c
push 0x400
push 0x482f78
call fcn.0044e93c
add esp, 0x18
push 0x482f78
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x483384]
test eax, eax
je 0x44cfd5
push esi
mov esi, dword [eax + 0x10]
test esi, esi
je 0x44cfd4
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
push edi
push 0
push 0x482f54
push 0x20
push 3
push esi
call ecx
test eax, eax
jge 0x44cfd4
push 0x4759b8
push esi
push eax
call fcn.00463090
pop esi
ret
Function at 0x44cfe0
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x4816e8], 0
je 0x44d01f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x482f54
push str.__8s____08X_______s_n
push 0x400
push 0x482f78
call fcn.0044e93c
add esp, 0x18
push 0x482f78
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x483384]
test eax, eax
je 0x44d055
push esi
mov esi, dword [eax + 0x10]
test esi, esi
je 0x44d054
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
push edi
push 1
push 0x482f54
push 0x20
push 3
push esi
call ecx
test eax, eax
jge 0x44d054
push 0x4759b8
push esi
push eax
call fcn.00463090
pop esi
ret
Function at 0x44d590
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
push str.DiagnosticLog2CrashLog
push 0
push 0x1f0003
call edi
mov esi, eax
test esi, esi
jne 0x44d5d2
push str.DiagnosticLog2CrashLog
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x44d5d2
push str.DiagnosticLog2CrashLog
push eax
push 0x1f0003
call edi
mov esi, eax
test esi, esi
je 0x44d5ee
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x44d5e7
pop edi
mov eax, esi
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret
Function at 0x44d890
Capabilities:
Copy file
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x480250]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x4c]
call fcn.0044daa0
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.0044db90
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x48]
mov edi, 0x10
cmp dword [ebp - 0x34], edi
jae 0x44d8e9
lea eax, [ebp - 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 4
push 0
push 1
push 1
push eax
call ebx
cmp dword [ebp - 0x18], edi
mov esi, eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], esi
jae 0x44d911
lea eax, [ebp - 0x2c]
push 0
push 0x80
push 2
push 0
push 1
push 2
push eax
call ebx
cmp esi, 0xffffffff
mov ebx, eax
mov dword [ebp - 0x54], ebx
je 0x44da44
cmp ebx, 0xffffffff
je 0x44da44
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x50], 0
push edi
mov byte [ebp - 4], 3
call fcn.0044e554
add esp, 4
test eax, eax
mov dword [ebp - 0x50], eax
je 0x44d96d
push 0
call fcn.0044e982
mov eax, dword [ebp - 0x50]
add esp, 4
push 0
lea ecx, [ebp - 0x5c]
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [ebp - 0x60]
mov eax, edi
shr eax, 1
test edi, edi
push edx
mov dword [ebp - 0x54], edi
fild dword [ebp - 0x54]
push eax
jge 0x44d997
fadd qword [0x475a58]
fmul qword [0x475a50]
sub esp, 8
fstp qword [esp]
call fcn.00451930
add esp, 8
call fcn.004639f0
mov edi, dword [ebp - 0x50]
add eax, edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 0x48]
mov esi, 0x10
cmp dword [ebp - 0x34], esi
jae 0x44d9d9
lea eax, [ebp - 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebx
cmp dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x48]
jae 0x44d9ed
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x2c]
jae 0x44d9f8
lea eax, [ebp - 0x2c]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x2c]
jae 0x44da0d
lea eax, [ebp - 0x2c]
push eax
call ebx
push edi
call fcn.0044e982
add esp, 4
mov edi, esi
jmp 0x44da44
cmp dword [ebp - 0x18], edi
jb 0x44da55
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0044e982
add esp, 4
cmp dword [ebp - 0x34], edi
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jb 0x44da78
mov edx, dword [ebp - 0x48]
push edx
call fcn.0044e982
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044e7cc
mov esp, ebp
pop ebp
ret
Function at 0x44daa0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x464e8b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x480250]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push edi
mov eax, dword [0x480250]
xor eax, esp
push eax
lea eax, [esp + 0x430]
mov dword fs:[0], eax
lea eax, [esp + 0x2c]
push eax
xor ebx, ebx
push 0x400
mov edi, ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x44db43
push 9
push 0x4759f4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.004028a0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x43c], ebx
call fcn.0044dc80
add esp, 4
cmp dword [esp + 0x24], 0x10
jb 0x44db5e
mov edx, dword [esp + 0x10]
push edx
call fcn.0044e982
add esp, 4
jmp 0x44db5e
push 8
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push str.dlog.err
mov ecx, edi
mov byte [edi + 4], bl
call fcn.004028a0
mov eax, edi
mov ecx, dword [esp + 0x430]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0044e7cc
add esp, 0x430
ret

Function at 0x44db90
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x464e8b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x480250]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push edi
mov eax, dword [0x480250]
xor eax, esp
push eax
lea eax, [esp + 0x430]
mov dword fs:[0], eax
lea eax, [esp + 0x2c]
push eax
xor ebx, ebx
push 0x400
mov edi, ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x44dc33
push 9
push 0x475a0c
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.004028a0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x43c], ebx
call fcn.0044dc80
add esp, 4
cmp dword [esp + 0x24], 0x10
jb 0x44dc4e
mov edx, dword [esp + 0x10]
push edx
call fcn.0044e982
add esp, 4
jmp 0x44dc4e
push 8
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push str.dlog.tmp
mov ecx, edi
mov byte [edi + 4], bl
call fcn.004028a0
mov eax, edi
mov ecx, dword [esp + 0x430]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0044e7cc
add esp, 0x430
ret

Function at 0x44e7cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x480250]
jne 0x44e7d6
repz ret
jmp fcn.00455036
Function at 0x456062
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4803d8]
je 0x45607d
inc edi
cmp edi, 0x17
jb 0x45606e
cmp edi, 0x17
jae 0x4561fd
push ebp
push 3
call fcn.0045ef60
cmp eax, 1
pop ecx
je 0x4561c9
push 3
call fcn.0045ef60
test eax, eax
pop ecx
jne 0x4560b1
cmp dword [0x480200], 1
je 0x4561c9
cmp ebx, 0xfc
je 0x4561fc
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x482790
push ebp
call fcn.0044fbc2
add esp, 0xc
test eax, eax
je 0x4560e7
push esi
push esi
push esi
push esi
push esi
call fcn.0044e69c
add esp, 0x14
push 0x104
mov esi, 0x4827a9
push esi
push 0
mov byte [0x4828ad], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x45612b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0044fbc2
add esp, 0xc
test eax, eax
je 0x45612b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0044e69c
add esp, 0x14
push esi
call fcn.00451d90
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x456170
push esi
call fcn.00451d90
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x482aa4
push 0x46a62c
sub ecx, eax
push ecx
push eax
call fcn.0044e987
add esp, 0x14
test eax, eax
je 0x456170
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0044e69c
add esp, 0x14
jmp 0x456172
xor esi, esi
push 0x46a628
push ebx
push ebp
call fcn.0044f6ff
add esp, 0xc
test eax, eax
je 0x456192
push esi
push esi
push esi
push esi
push esi
call fcn.0044e69c
add esp, 0x14
push dword [edi*8 + 0x4803dc]
push ebx
push ebp
call fcn.0044f6ff
add esp, 0xc
test eax, eax
je 0x4561b4
push esi
push esi
push esi
push esi
push esi
call fcn.0044e69c
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0045eda3
add esp, 0xc
jmp 0x4561fc
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4561fc
cmp ebp, 0xffffffff
je 0x4561fc
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4803dc]
push dword [esi]
call fcn.00451d90
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x45eda3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00454b54
xor ebx, ebx
cmp dword [0x482e94], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x45ee79
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x45ef59
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x45ef59
push eax
call fcn.00454ae6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x482e94], eax
call esi
push eax
call fcn.00454ae6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x482e98], eax
call esi
push eax
call fcn.00454ae6
mov dword [0x482e9c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0044f94f
test eax, eax
pop ecx
pop ecx
je 0x45ee47
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044e69c
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x45ee79
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00454ae6
cmp eax, ebx
pop ecx
mov dword [0x482ea4], eax
je 0x45ee79
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00454ae6
pop ecx
mov dword [0x482ea0], eax
mov eax, dword [0x482ea0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x45eefe
cmp dword [0x482ea4], ecx
je 0x45eefe
push eax
call fcn.00454b5d
push dword [0x482ea4]
mov esi, eax
call fcn.00454b5d
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x45eefe
cmp edi, ebx
je 0x45eefe
call esi
cmp eax, ebx
je 0x45eecb
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45eecb
test byte [ebp - 0x18], 1
jne 0x45eefe
lea eax, [ebp - 0x10]
push eax
call fcn.0044f986
test eax, eax
pop ecx
je 0x45eee6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0044e69c
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x45eef5
or dword [ebp + 0x10], 0x200000
jmp 0x45ef39
or dword [ebp + 0x10], 0x40000
jmp 0x45ef39
mov eax, dword [0x482e98]
cmp eax, dword [ebp - 8]
je 0x45ef39
push eax
call fcn.00454b5d
cmp eax, ebx
pop ecx
je 0x45ef39
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x45ef39
mov eax, dword [0x482e9c]
cmp eax, dword [ebp - 8]
je 0x45ef39
push eax
call fcn.00454b5d
cmp eax, ebx
pop ecx
je 0x45ef39
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x482e94]
call fcn.00454b5d
cmp eax, ebx
pop ecx
je 0x45ef59
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45ef5b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret