joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451c10
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5633a6
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x5b53ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
test edi, edi
jne 0x451c4a
xor eax, eax
jmp 0x451de1
push 0x800
xorps xmm0, xmm0
mov dword [ebp - 0x81c], 0
lea eax, [ebp - 0x810]
movq qword [ebp - 0x824], xmm0
push 0
push eax
movups xmmword [ebp - 0x834], xmm0
mov word [ebp - 0x818], 0
call fcn.00526d00
lea edx, [ebp - 0x810]
mov dword [ebp - 0x830], 3
add esp, 0xc
mov ecx, edi
sub edx, edi
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x451ca0
lea eax, [ebp - 0x810]
mov dword [ebp - 0x82c], eax
mov eax, 0x614
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x451ddc
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
test eax, eax
jne 0x451ddc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x451ddc
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x451d1f
push edi
call esi
test eax, eax
jne 0x451ddc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x451d3e
test al, 0x10
je 0x451d3e
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x451ddc
lea ecx, [ebp - 0x814]
mov dword [ebp - 0x814], 0
call fcn.00428080
push edi
lea ecx, [ebp - 0x838]
mov dword [ebp - 4], 0
call fcn.00427fb0
lea edx, [ebp - 0x814]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x838]
call fcn.00451e00
mov edx, dword [ebp - 0x838]
mov esi, eax
add edx, 0xfffffff0
mov byte [ebp - 4], 2
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x451d9f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 4
test esi, esi
mov esi, dword [ebp - 0x814]
push 0
je 0x451db0
push esi
jmp 0x451db1
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
add esi, 0xfffffff0
mov dword [ebp - 4], 4
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x451dd8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
jmp 0x451de1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
Function at 0x4522f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563418
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5b53ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], eax
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x14], 0
jb 0x45233f
mov ecx, dword [eax]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x452349
mov eax, dword [edi]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ebp - 0x30]
push 0
push 0
push 2
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x45237b
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x452452
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
shr eax, 1
push eax
call fcn.004283d0
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
cmovae ecx, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 8
jb 0x4523b7
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
jb 0x4523bf
mov edi, dword [edi]
lea edx, [ebp - 0x14]
push edx
push ecx
push 0
push 2
push eax
push edi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x452422
mov edx, dword [ebp - 0x18]
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
cmp edx, 8
jb 0x452452
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x452416
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45246f
push edx
push ecx
call fcn.004ea2a1
add esp, 8
jmp 0x452452
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
shr eax, 1
push 0
dec eax
push eax
call fcn.004283d0
movups xmm0, xmmword [ebp - 0x2c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
call fcn.0052e99b
int3
Function at 0x452480
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5b53ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x210
lea eax, [ebp - 0x218]
mov esi, ecx
push 0
push eax
call fcn.00526d00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x108
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0x10
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
mov edx, esi
lea ecx, [ebp - 0x218]
push eax
call fcn.004588c0
test eax, eax
jne 0x452501
push str._n_Adjustprivilege:_CreateProcess_fail.__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret

Function at 0x452520
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [0x5b53ec]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
xorps xmm0, xmm0
push edi
movlpd qword [esp + 8], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x28
lea ecx, [esp + 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x45255f
mov esi, dword [esp + 0x60]
xor edi, edi
jmp 0x452567
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, edi
mov ecx, esi
call fcn.004eaeb0
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
movsd qword [esp + 8], xmm0
call fcn.004eaeb0
movsd xmm1, qword [esp + 8]
divsd xmm1, xmm0
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
xor ecx, esp
cvtpd2ps xmm0, xmm1
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
Function at 0x4527d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5634ad
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x5b53ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x438], ebx
mov esi, ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x454], esi
mov dword [ebp - 0x434], 0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0043e6d0
mov dword [esi], eax
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x434], 1
nop word [eax + eax]
push 0x412
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.00526d00
add esp, 0xc
mov dword [ebp - 0x428], 0x208
lea eax, [ebp - 0x42c]
push 0
push 0
push eax
push 0
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x424]
push eax
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x452983
mov dword [ebp - 0x440], eax
inc edi
mov word [ebp - 0x450], ax
lea eax, [ebp - 0x424]
mov dword [ebp - 0x43c], 7
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4528d0
sub eax, edx
lea ecx, [ebp - 0x450]
sar eax, 1
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.0042a390
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x450]
mov ebx, dword [esi]
push ecx
mov ecx, esi
mov eax, dword [ebx + 4]
push eax
push ebx
mov dword [ebp - 0x430], eax
call fcn.0045abb0
mov edx, dword [esi + 4]
mov ecx, 0x7fffffe
sub ecx, edx
cmp ecx, 1
jb 0x4529a6
lea ecx, [edx + 1]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x43c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x430]
mov dword [ebx + 4], eax
mov dword [ecx], eax
cmp edx, 8
jb 0x452978
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45296e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4529a1
push edx
push ecx
call fcn.004ea2a1
add esp, 8
mov ebx, dword [ebp - 0x438]
jmp 0x452860
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
call fcn.0052e99b
push str.list_T__too_long
call fcn.0046817f
int3
Function at 0x4529c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563502
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5b53ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x234], edi
mov esi, ecx
mov dword [ebp - 0x22c], esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x230], 0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0043e6d0
mov dword [esi], eax
mov dword [ebp - 4], 0
xor ebx, ebx
mov dword [ebp - 0x230], 1
nop word [eax + eax]
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00526d00
add esp, 0xc
mov dword [ebp - 0x220], 0x104
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x452adf
mov edi, dword [esi]
lea eax, [ebp - 0x21c]
inc ebx
mov ecx, esi
push eax
mov dword [ebp - 0x22c], ebx
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.00459c50
mov edx, dword [esi + 4]
mov ecx, 0x7fffffe
sub ecx, edx
cmp ecx, 1
jb 0x452afd
lea ecx, [edx + 1]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov edi, dword [ebp - 0x234]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x22c]
jmp 0x452a50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.0046817f
int3
Function at 0x452f90
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5635d0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5b53ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor bl, bl
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x452fc9
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 4
je 0x452fdb
mov bl, 1
jmp 0x45312f
mov eax, dword [0x5bff44]
test al, 1
jne 0x452ff6
or eax, 1
mov dword [0x5bff64], 0
mov dword [0x5bff44], eax
xorps xmm0, xmm0
mov byte [ebp - 0x51], 0
movlpd qword [ebp - 0x18], xmm0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
call fcn.00467725
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x51]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0x459d00
push 0x5bff64
call fcn.00467a0e
add esp, 0x10
test eax, eax
je 0x45314d
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 2
push eax
call fcn.0046775f
sub esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov edx, esp
mov ecx, 0x5bfa50
xor eax, eax
mov dword [edx + 0x10], 0
lea edi, [ecx + 2]
mov dword [edx + 0x14], 7
mov word [edx], ax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x453080
sub ecx, edi
sar ecx, 1
push ecx
push 0x5bfa50
mov ecx, edx
call fcn.0042a390
lea ecx, [ebp - 0x50]
call fcn.00453800
add esp, 0x18
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x3c], 8
mov eax, esi
cmovae ecx, dword [ebp - 0x50]
cmp dword [esi + 0x14], 8
jb 0x4530c3
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4530d3
mov bl, 1
jmp 0x453127
mov edx, esi
lea ecx, [ebp - 0x38]
call fcn.00454c30
cmp dword [ebp - 0x28], 0
je 0x45311f
mov esi, dword [0x5bea0c]
mov edi, dword [0x5bea10]
cmp esi, edi
je 0x45311f
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4530fd
mov ecx, dword [esi]
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push ecx
cmovae eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x45311d
add esi, 0x18
cmp esi, edi
jne 0x4530f3
jmp 0x45311f
mov bl, 1
lea ecx, [ebp - 0x38]
call fcn.00414120
lea ecx, [ebp - 0x50]
call fcn.00414120
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
call fcn.00467780
add esp, 4
mov byte [ebp - 4], 1
test al, al
jne 0x45316a
call fcn.00467a26
sub esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.00412350
call fcn.00412410
int3
Function at 0x453dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5b53ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x5c], 0x6e0075
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x5c]
mov eax, 0x5bf798
mov dword [ebp - 0x58], 0x620061
push edi
mov dword [ebp - 0x54], 0x65006c
mov edx, 0x2b
mov dword [ebp - 0x50], 0x740020
sub esi, eax
mov dword [ebp - 0x4c], 0x20006f
mov dword [ebp - 0x48], 0x720063
mov dword [ebp - 0x44], 0x610065
mov dword [ebp - 0x40], 0x650074
mov dword [ebp - 0x3c], 0x490020
mov dword [ebp - 0x38], 0x6e004b
mov dword [ebp - 0x34], 0x77006f
mov dword [ebp - 0x30], 0x46006e
mov dword [ebp - 0x2c], 0x6c006f
mov dword [ebp - 0x28], 0x650064
mov dword [ebp - 0x24], 0x4d0072
mov dword [ebp - 0x20], 0x6e0061
mov dword [ebp - 0x1c], 0x670061
mov dword [ebp - 0x18], 0x720065
mov dword [ebp - 0x14], 0x20002e
mov dword [ebp - 0x10], 0x720068
mov dword [ebp - 0xc], 0x20003a
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffd3]
test ecx, ecx
je 0x453eae
movzx ecx, word [esi + eax]
test cx, cx
je 0x453eae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x453e90
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
Function at 0x453f20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563778
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5b53ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
cmp dword [edi + 0x10], eax
je 0x454017
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x14], eax
mov eax, edi
jb 0x453f81
mov eax, dword [edi]
push 1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x454017
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov dword [ebp - 0x38], ecx
call fcn.004ea2af
add esp, 4
mov dword [ebp - 0x30], eax
test eax, eax
je 0x453fd5
push dword [ebp - 0x38]
push 0
push eax
call fcn.00526d00
mov eax, dword [ebp - 0x30]
add esp, 0xc
xor ecx, ecx
mov word [eax], cx
jmp 0x453fda
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [edi + 0x14], 8
jb 0x453fe2
mov edi, dword [edi]
push dword [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, dword [ebp - 0x30]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x453ff5
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x2c]
call fcn.0042a390
push edi
call fcn.004ea2db
add esp, 4
movups xmm0, xmmword [ebp - 0x2c]
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [esi + 0x10], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
Function at 0x455470
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563a69
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5b53ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edx
mov dword [ebp - 0x18], 1
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x455570
mov edx, dword [ebp - 0x14]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x455500
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.0042a390
lea eax, [ebp - 0x30]
cmp esi, eax
je 0x45553a
mov ecx, esi
call fcn.00414120
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [esi + 0x10], xmm0
jmp 0x455570
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x455570
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x455566
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45559b
push edx
push ecx
call fcn.004ea2a1
add esp, 8
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x45557e
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9cdc
mov esp, ebp
pop ebp
ret
call fcn.0052e99b
int3
Function at 0x4568b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x45699b
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x45698a
jg 0x4568f0
test edx, edx
je 0x45698a
nop dword [eax]
call fcn.0042a7c0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x456947
jg 0x456907
test esi, esi
je 0x456947
cmp ebx, eax
jg 0x456917
jl 0x456911
cmp edi, esi
jae 0x456917
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.00526780
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x45696c
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x456984
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x4568f0
jl 0x456984
test edi, edi
jne 0x4568f0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4569bd
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x4569bf
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x456a75
jg 0x4569da
test esi, esi
je 0x456a75
test eax, eax
jl 0x456a23
jg 0x4569e4
test ebx, ebx
je 0x456a23
cmp edi, eax
jg 0x4569f4
jl 0x4569ee
cmp esi, ebx
jae 0x4569f4
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.00526780
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x456a2a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x456a75
jg 0x456a34
test esi, esi
je 0x456a75
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x456a75
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x456a60
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.00531e1d
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc