joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ec93
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x566ac4
call fcn.0052a208
push ecx
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44ed5b
xor edi, edi
mov esi, 0x3e8
push dword [ebp + 0xc]
call fcn.0041ce52
cmp eax, 0xffffffff
pop ecx
jne 0x44ed5b
push dword [ebp + 0x10]
push esi
call fcn.00422423
pop ecx
test eax, eax
pop ecx
jne 0x44ece3
add edi, esi
cmp edi, 0x1388
jl 0x44ecb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x44ed30
push str.If_you_are_previewing_the_downloading_video_audio__please_stop_previewing__then_click_OK_button.
lea ecx, [ebp - 0x10]
call fcn.005469dc
push 0x31
push 0x5b2b1c
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x44ed24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00546968
push 1
pop eax
jmp 0x44ed62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00546968
xor edi, edi
push dword [ebp + 0xc]
call fcn.0041ce52
cmp eax, 0xffffffff
pop ecx
jne 0x44ed5b
push dword [ebp + 0x10]
push esi
call fcn.00422423
pop ecx
test eax, eax
pop ecx
jne 0x44ed5f
add edi, esi
cmp edi, 0x2710
jge 0x44ed5f
jmp 0x44ed32
xor eax, eax
jmp 0x44ed62
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44ed70
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x566ad8
call fcn.0052a208
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x44ed92
push 0xfffffffffffffffe
jmp 0x44ee35
push dword [ebp + 0x10]
call esi
test eax, eax
je 0x44edbe
cmp dword [ebp + 0x14], 0
je 0x44ee7a
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0044ec93
add esp, 0xc
test eax, eax
jl 0x44ee7a
xor ebx, ebx
mov esi, 0x3e8
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041ce76
add esp, 0xc
cmp eax, 0xffffffff
jne 0x44ee76
push dword [ebp + 0x18]
push esi
call fcn.00422423
pop ecx
test eax, eax
pop ecx
jne 0x44edf7
add ebx, esi
cmp ebx, 0x1388
jl 0x44edc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x44ee44
push str.If_you_are_previewing_the_downloading_video_audio__please_stop_previewing__then_click_OK_button.
lea ecx, [ebp + 0x14]
call fcn.005469dc
push 0x31
push 0x5b2b1c
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x44ee38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00546968
push 1
pop eax
jmp 0x44ee7d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00546968
xor ebx, ebx
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041ce76
add esp, 0xc
cmp eax, 0xffffffff
jne 0x44ee76
push dword [ebp + 0x18]
push esi
call fcn.00422423
pop ecx
test eax, eax
pop ecx
jne 0x44ee7a
add ebx, esi
cmp ebx, 0x2710
jge 0x44ee7a
jmp 0x44ee46
xor eax, eax
jmp 0x44ee7d
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45228c
Capabilities:
Resume thread

Disassembly:
mov eax, 0x5670a9
call fcn.0052a208
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
push edi
and dword [ebx + 0x84], 0
and dword [ebp - 0x10], 0
lea edi, [ebx + 0x7c]
push 0x7c
call fcn.00546f57
pop ecx
mov dword [ebp - 0x14], eax
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], esi
je 0x4522cc
push dword [ebp - 0x10]
mov ecx, eax
push ebx
call fcn.004529fa
mov esi, eax
or eax, 0xffffffff
test esi, esi
mov dword [ebp - 4], eax
je 0x45230b
push 0
push 0
push 4
mov ecx, esi
call fcn.0054b66d
test eax, eax
je 0x45231a
push 0
mov dword [edi], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [ebp - 0x10]
add edi, 4
cmp dword [ebp - 0x10], 2
jl 0x4522ab
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
test esi, esi
je 0x452327
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x45230b

Function at 0x4535e7
Capabilities:
Resume thread

Disassembly:
mov eax, 0x567255
call fcn.0052a208
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
push edi
and dword [ebx + 0x94], 0
and dword [ebp - 0x10], 0
lea edi, [ebx + 0x8c]
push 0x7c
call fcn.00546f57
pop ecx
mov dword [ebp - 0x14], eax
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], esi
je 0x45362a
push dword [ebp - 0x10]
mov ecx, eax
push ebx
call fcn.00453e5a
mov esi, eax
or eax, 0xffffffff
test esi, esi
mov dword [ebp - 4], eax
je 0x453669
push 0
push 0
push 4
mov ecx, esi
call fcn.0054b66d
test eax, eax
je 0x453678
push 0
mov dword [edi], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [ebp - 0x10]
add edi, 4
cmp dword [ebp - 0x10], 2
jl 0x453609
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
test esi, esi
je 0x453685
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x453669

Function at 0x4549e3
Capabilities:
Resume thread

Disassembly:
mov eax, 0x5673b5
call fcn.0052a208
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
push edi
and dword [ebx + 0x84], 0
and dword [ebp - 0x10], 0
lea edi, [ebx + 0x7c]
push 0x7c
call fcn.00546f57
pop ecx
mov dword [ebp - 0x14], eax
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], esi
je 0x454a23
push dword [ebp - 0x10]
mov ecx, eax
push ebx
call fcn.00455144
mov esi, eax
or eax, 0xffffffff
test esi, esi
mov dword [ebp - 4], eax
je 0x454a62
push 0
push 0
push 4
mov ecx, esi
call fcn.0054b66d
test eax, eax
je 0x454a71
push 0
mov dword [edi], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [ebp - 0x10]
add edi, 4
cmp dword [ebp - 0x10], 2
jl 0x454a02
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
test esi, esi
je 0x454a7e
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x454a62
Function at 0x458a25
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5677b2
call fcn.0052a208
sub esp, 0x240
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004275be
pop ecx
mov eax, dword [eax]
push 1
xor esi, esi
push 1
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.0041ca59
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00546968
lea ecx, [ebp - 0x84]
call fcn.00458844
push dword [ebp + 0x2c]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.0045843c
cmp eax, esi
je 0x458aa1
mov byte [ebp - 4], 4
mov esi, eax
jmp 0x458b8a
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x458aba
mov byte [ebp - 4], 5
or esi, 0xffffffff
jmp 0x458b8a
push esi
lea ecx, [ebp - 0x24c]
call fcn.004c9640
push 3
lea ecx, [ebp - 0x24c]
push dword [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.004ca7b0
test al, al
jne 0x458b08
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 3
mov dword [ebp - 0x24c], 0x57b500
call fcn.004c9710
lea ecx, [ebp - 0x24c]
call fcn.004c9660
mov byte [ebp - 4], 7
jmp 0x458ab2
cmp dword [ebp + 0x24], esi
jle 0x458b52
cmp dword [ebp + 0x20], esi
jle 0x458b52
push edi
lea ecx, [ebp - 0x24c]
call fcn.004c7710
lea ecx, [ebp - 0x24c]
mov edi, eax
call fcn.004c7700
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
lea eax, [ebp + 0x18]
push edi
push eax
call fcn.0045969b
push dword [ebp + 0x1c]
lea eax, [ebp - 0x24c]
push dword [ebp + 0x18]
push eax
call fcn.00420c4e
add esp, 0x20
pop edi
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x24c]
push esi
push eax
call fcn.004c9c60
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 3
mov dword [ebp - 0x24c], 0x57b500
call fcn.004c9710
lea ecx, [ebp - 0x24c]
call fcn.004c9660
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x74]
call fcn.00546968
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x84], 0x57f718
call fcn.0041cac6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4596fe
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5678ac
call fcn.0052a208
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, 0x64801c
push str._sMediaProbe.exe
push edi
call fcn.00543d21
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [0x64801c]
call esi
test eax, eax
jne 0x459742
push str.MediaProbe.exe
mov ecx, edi
call fcn.00546aff
push ebx
mov edi, 0x648020
push str._sMediaEncode.exe
push edi
call fcn.00543d21
add esp, 0xc
push dword [0x648020]
call esi
test eax, eax
jne 0x45976e
push str.MediaEncode.exe
mov ecx, edi
call fcn.00546aff
push dword [0x648020]
lea eax, [ebp - 0x14]
push eax
call fcn.0041da07
pop ecx
pop ecx
and dword [ebp - 4], 0
push 0x5c32d8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00546c0d
push eax
mov ecx, 0x648024
mov byte [ebp - 4], 1
call fcn.00546aaf
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00546968
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00546968
push ebx
mov edi, 0x648028
push str._sMediaPlay.exe
push edi
call fcn.00543d21
add esp, 0xc
push dword [0x648028]
call esi
test eax, eax
jne 0x4597e5
push str.MediaPlay.exe
mov ecx, edi
call fcn.00546aff
cmp dword [0x64802c], 0
jne 0x4598e9
mov eax, dword [0x643788]
mov dword [ebp + 8], eax
push 2
lea eax, [ebp + 8]
pop edi
push ebx
push str._s_avcodec_60.dll
push eax
mov dword [ebp - 4], edi
call fcn.00543d21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x459825
mov dword [0x64802c], 6
cmp dword [0x64802c], 0
jne 0x4598dd
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_59.dll
push eax
call fcn.00543d21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x459857
mov dword [0x64802c], 5
cmp dword [0x64802c], 0
jne 0x4598dd
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_58.dll
push eax
call fcn.00543d21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x459885
mov dword [0x64802c], 4
cmp dword [0x64802c], 0
jne 0x4598dd
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_57.dll
push eax
call fcn.00543d21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x4598b3
mov dword [0x64802c], 3
cmp dword [0x64802c], 0
jne 0x4598dd
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_56.dll
push eax
call fcn.00543d21
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x4598dd
mov dword [0x64802c], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00546968
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x648030], 1
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x459904
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [0x648028]
call esi
test eax, eax
je 0x459924
xor eax, eax
push eax
push eax
push eax
push dword [0x648028]
jmp 0x459954
push dword [0x648020]
call esi
test eax, eax
je 0x45993d
xor eax, eax
push eax
push eax
push eax
push dword [0x648020]
jmp 0x459954
push dword [0x64801c]
call esi
test eax, eax
je 0x45995c
xor eax, eax
push eax
push eax
push eax
push dword [0x64801c]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop esi
ret

Function at 0x459bc3
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x567908
call fcn.0052a208
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x459c01
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041da07
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.00546968
lea eax, [ebp - 0x14]
push eax
call fcn.004275be
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.0041ca59
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00546968
push dword [ebp + 8]
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.00546aff
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 8]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.00459981
test eax, eax
je 0x459c58
mov esi, eax
jmp 0x459c8d
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x20]
test eax, eax
je 0x459c72
or esi, 0xffffffff
jmp 0x459c8d
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x24]
or esi, 0xffffffff
cmp eax, esi
je 0x459c8d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041cac6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x45ed47
Capabilities:
Resume thread

Disassembly:
mov eax, 0x568571
call fcn.0052a208
push ecx
push esi
mov esi, ecx
push 0x74
call fcn.00546f57
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x45ed6c
push dword [ebp + 8]
push esi
call fcn.00460005
mov esi, eax
jmp 0x45ed6e
xor esi, esi
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x45ed90
push 0
push 0
push 4
mov ecx, esi
call fcn.0054b66d
test eax, eax
jne 0x45ed94
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
xor eax, eax
jmp 0x45edaa
push 0
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x46290d
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x648004
mov dword [edi], esi
call fcn.00546aff
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
push 1
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4629ee
cmp dword [ebp + 8], esi
je 0x4629ee
push ebx
push 4
pop eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push str.ProxyEnable
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x46298d
cmp dword [ebp - 0xc], esi
setne al
mov dword [edi], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x80a]
mov word [ebp - 0x80c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 4]
push eax
push esi
push str.ProxyServer
mov dword [ebp - 8], 0x400
push dword [ebp + 8]
call ebx
test eax, eax
pop ebx
jne 0x4629e1
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x80c]
push eax
call fcn.00546aff
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4629f1
or eax, 0xffffffff
pop edi
pop esi
leave
ret 8
Function at 0x4644a6
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x568910
call fcn.0052a208
push ecx
mov eax, dword [0x643788]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push str._sNIO_curl.exe
push eax
call fcn.00543d21
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4644f1
lea eax, [ebp - 0x10]
lea ecx, [esi + 8]
push eax
call fcn.00546aaf
cmp dword [esi + 4], 0
push 2
pop ebx
jne 0x464509
push dword [esi + 8]
call edi
neg eax
sbb eax, eax
and eax, ebx
dec eax
mov dword [esi + 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._sNIO_wget.exe
push eax
call fcn.00543d21
add esp, 0xc
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x464532
lea eax, [ebp - 0x10]
lea ecx, [esi + 0x10]
push eax
call fcn.00546aaf
cmp dword [esi + 0xc], 0
jne 0x464547
push dword [esi + 0x10]
call edi
neg eax
sbb eax, eax
and eax, ebx
dec eax
mov dword [esi + 0xc], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._sNIO_msdl.exe
push eax
call fcn.00543d21
add esp, 0xc
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x464570
lea eax, [ebp - 0x10]
lea ecx, [esi + 0x18]
push eax
call fcn.00546aaf
cmp dword [esi + 0x14], 0
jne 0x464585
push dword [esi + 0x18]
call edi
neg eax
sbb eax, eax
and eax, ebx
dec eax
mov dword [esi + 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._sNIO_rtmp.exe
push eax
call fcn.00543d21
add esp, 0xc
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4645ae
lea eax, [ebp - 0x10]
lea ecx, [esi + 0x20]
push eax
call fcn.00546aaf
cmp dword [esi + 0x1c], 0
jne 0x4645c3
push dword [esi + 0x20]
call edi
neg eax
sbb eax, eax
and eax, ebx
dec eax
mov dword [esi + 0x1c], eax
push str.ca_bundle.crt
mov ebx, 0x5b20ac
push dword [ebp + 8]
add esi, 0x24
push ebx
push esi
call fcn.00543d21
add esp, 0x10
push dword [esi]
call edi
test eax, eax
jne 0x4645f7
push str.ca_bundle.trust.crt
push dword [ebp + 8]
push ebx
push esi
call fcn.00543d21
add esp, 0x10
push dword [esi]
call edi
test eax, eax
jne 0x464611
push 0x5cbe58
push dword [ebp + 8]
push ebx
push esi
call fcn.00543d21
add esp, 0x10
push dword [esi]
call edi
test eax, eax
jne 0x46462b
push str.ca_bundle.crt
push dword [ebp + 8]
push ebx
push esi
call fcn.00543d21
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00546968
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x465e49
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x98]
test edi, edi
mov dword [ebp - 4], edi
je 0x465f2d
push dword [esi + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x465e73
push eax
jmp 0x465ebe
push 1
pop ebx
cmp edi, ebx
jle 0x465e8b
cmp dword [esi + 0x38], ebx
jne 0x465e8b
push ebx
lea ecx, [esi + 0x90]
call fcn.00465e07
test edi, edi
jle 0x465e99
cmp dword [esi + 0x3c], 0
jle 0x465f20
push dword [esi + 0xc]
call fcn.0041dbc5
pop ecx
xor ecx, ecx
cmp edx, ecx
jg 0x465eae
jl 0x465ebd
cmp eax, ecx
jbe 0x465ebd
test byte [esi + 0x68], bl
je 0x465ecf
cmp eax, dword [esi + 0x40]
jne 0x465ebd
cmp edx, dword [esi + 0x44]
je 0x465ee1
push ecx
lea ecx, [esi + 0x90]
call fcn.00465e07
and dword [esi + 0x68], 0xfffffffe
jmp 0x465f2d
cmp edi, ebx
jne 0x465ee1
mov ebx, dword [esi + 0x94]
mov ebx, dword [ebx]
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], edx
xor ebx, ebx
xor edx, edx
test edi, edi
jle 0x465f20
mov eax, dword [esi + 0x94]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x465f17
xor edi, edi
cmp dword [eax + 0x3c], edi
jg 0x465f0a
jl 0x465f04
cmp dword [eax + 0x38], edi
jae 0x465f0a
mov dword [eax + 0x38], edi
mov dword [eax + 0x3c], edi
mov edi, dword [eax + 0x38]
mov eax, dword [eax + 0x3c]
add ecx, edi
mov edi, dword [ebp - 4]
adc ebx, eax
inc edx
cmp edx, edi
jl 0x465ee9
or ecx, ebx
jne 0x465f2d
push 0
lea ecx, [esi + 0x90]
call fcn.00465e07
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4669d7
Capabilities:
Resume thread

Disassembly:
mov eax, 0x568c89
call fcn.0052a208
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 0x120
call fcn.00546f57
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x466a15
push dword [edi + 0x34]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push esi
push edi
call fcn.0046522a
jmp 0x466a17
xor eax, eax
or dword [ebp - 4], 0xffffffff
push ebx
push ebx
push 4
mov ecx, eax
mov dword [esi + 0x58], eax
call fcn.0054b66d
test eax, eax
jne 0x466a4b
mov ecx, dword [esi + 0x58]
cmp ecx, ebx
je 0x466a3b
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x58], ebx
mov eax, dword [edi]
push 0xfffffffffffffffe
mov ecx, edi
call dword [eax + 0x14]
push 0xfffffffffffffffe
jmp 0x466a91
mov eax, dword [esi + 0x58]
push ebx
mov eax, dword [eax + 0x28]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x58]
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebp + 0x14], ebx
je 0x466a94
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x466a78
cmp dword [eax], ebx
jne 0x466a8f
push 0x64
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x466a98
cmp dword [esi + 0x24], 0x14
jge 0x466a94
jmp 0x466a6d
push 1
pop eax
jmp 0x466abe
xor eax, eax
jmp 0x466abe
mov ecx, dword [esi + 0x58]
push 0x14
call fcn.00465abd
mov ecx, dword [esi + 0x58]
call fcn.00465ad5
mov ecx, dword [esi + 0x58]
cmp ecx, ebx
je 0x466ab8
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x58], ebx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x466d1f
Capabilities:
Resume thread

Disassembly:
mov eax, 0x568c9d
call fcn.0052a208
push ecx
push esi
mov esi, ecx
push 0x6c
call fcn.00546f57
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x466d4c
push esi
call fcn.0046801e
mov esi, eax
jmp 0x466d4e
xor esi, esi
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x466d70
push 0
push 0
push 4
mov ecx, esi
call fcn.0054b66d
test eax, eax
jne 0x466d74
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
xor eax, eax
jmp 0x466d8a
push 0
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x486ed5
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x56b00a
call fcn.0052a208
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004866ba
mov eax, dword [0x643788]
lea ecx, [esi + 0x14]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ecx], eax
mov eax, dword [0x643788]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0x580e30
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [0x643788]
mov dword [esi + 0x3c], eax
mov eax, dword [0x643788]
mov dword [esi + 0x40], eax
mov eax, dword [0x643788]
mov dword [esi + 0x44], eax
mov edi, 0x648004
mov byte [ebp - 4], 6
push edi
mov dword [esi], 0x580e24
call fcn.00546aff
push edi
lea ecx, [esi + 0x18]
call fcn.00546aff
push edi
lea ecx, [esi + 0x3c]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.00546aff
push edi
lea ecx, [esi + 0x40]
call fcn.00546aff
push edi
lea ecx, [esi + 0x44]
call fcn.00546aff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret