joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432980
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4aa117
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x4b6344
mov dword [edi + 0x58], 0x4b625c
lea esi, [edi + 8]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.004312d0
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.004313e0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x4d45a4]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x43e540
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4a4728
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
xor esi, esi
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00406430
push 0x5c
push 0x2f
lea edi, [esp + 0x14]
mov dword [esp + 0x3c], esi
call fcn.00401c00
mov eax, dword [esp + 0x18]
mov edi, 8
add esp, 8
cmp dword [esp + 0x24], edi
jae 0x43e5ba
lea eax, [esp + 0x10]
push esi
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esp + 0x24], edi
mov esi, eax
jb 0x43e5d8
mov eax, dword [esp + 0x10]
push eax
call fcn.004692b1
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00483bf3
add esp, 0x2c
ret

Function at 0x43f6c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a3f4c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CAUDiffDistribute.0
mov dword [esp + 0x14], 3
cmp dword [esi + 0x30], 8
jb 0x43f708
mov eax, dword [esi + 0x1c]
push eax
call fcn.004692b1
add esp, 4
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], 0
mov word [esi + 0x1c], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x43f72b
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov byte [esp + 0x14], 2
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x43f73f
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov byte [esp + 0x14], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x43f753
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov byte [esp + 0x14], 0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f767
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x43f77e
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4407a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4d4590]
sub esp, 0x50
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x4407b9
push 1
push 0x7ee
call eax
mov edi, dword [esp + 0x64]
push str.DiffUpdater.exe
mov dword [0x4d4234], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4408e4
push 0x2c
lea eax, [esp + 0x38]
push 0
push eax
call fcn.0048a580
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x30
mov dword [esp + 0x3c], 0x440a40
mov dword [esp + 0x48], esi
mov dword [esp + 0x5c], str.Canon.IC.AutoUpdate.StartDiffUpdater
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x440826
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x582
jne 0x4408e4
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0
push 0
push 0
push 0x11
call esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10
call esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0
push 0
push str.Canon.IC.AutoUpdate.StartDiffUpdater
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x4408e4
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
cmp byte [edi + 0x5b], 0
jne 0x4408d4
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
call edi
test eax, eax
je 0x4408ca
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call esi
cmp eax, 0xffffffff
je 0x4408ca
lea ecx, [esp + 0x14]
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
call ebp
mov eax, dword [esp + 0x64]
cmp byte [eax + 0x5b], 0
je 0x440897
mov ecx, dword [esp + 0x44]
push ecx
push str.Canon.IC.AutoUpdate.StartDiffUpdater
call dword [sym.imp.USER32.dll_UnregisterClassW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x4408f0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4d4590]
sub esp, 0x50
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x440909
push 1
push 0x7ee
call eax
mov edi, dword [esp + 0x64]
push str.DiffUpdater.exe
mov dword [0x4d4234], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x440a34
push 0x2c
lea eax, [esp + 0x38]
push 0
push eax
call fcn.0048a580
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x30
mov dword [esp + 0x3c], 0x440d10
mov dword [esp + 0x48], esi
mov dword [esp + 0x5c], str.Canon.IC.AutoUpdate.StartDiffUpdater
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x440976
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x582
jne 0x440a34
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0
push 0
push 0
push 0x11
call esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10
call esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0
push 0
push str.Canon.IC.AutoUpdate.StartDiffUpdater
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x440a34
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
cmp byte [edi + 0x5b], 0
jne 0x440a24
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
call edi
test eax, eax
je 0x440a1a
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call esi
cmp eax, 0xffffffff
je 0x440a1a
lea ecx, [esp + 0x14]
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
call ebp
mov eax, dword [esp + 0x64]
cmp byte [eax + 0x5b], 0
je 0x4409e7
mov ecx, dword [esp + 0x44]
push ecx
push str.Canon.IC.AutoUpdate.StartDiffUpdater
call dword [sym.imp.USER32.dll_UnregisterClassW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret

Function at 0x441c00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x23
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x441c46
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00483bf3
add esp, 0x20c
ret
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441c50
sub eax, edx
push edi
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00406d50
push 0x2f
push str.Canon_Inc_ICAutoUpdateCanonAutoUpdateLog.dat
mov ecx, esi
call fcn.00408260
push 0x2f
push 0x5c
mov edi, esi
call fcn.00401c00
mov ecx, dword [esp + 0x218]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00483bf3
add esp, 0x20c
ret
Function at 0x441ca0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x10], 0
call fcn.0048a580
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 8]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], 0
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441d00
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0xc]
push edx
call fcn.00406d50
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00483bf3
add esp, 0x210
ret
Function at 0x441d40
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x4a723c
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x294]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2a4]
xor ebx, ebx
mov edi, 7
mov dword [esp + 0x80], edi
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], bx
lea eax, [esp + 0x84]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov dword [esp + 0x2b0], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
je 0x441dd5
cmp dword [esp + 0x80], 8
jb 0x441dce
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.004692b1
add esp, 4
xor al, al
jmp 0x441f46
lea eax, [esp + 0x84]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x441de0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x88]
push edx
mov esi, ebp
call fcn.00406d50
mov ecx, dword [0x4d4424]
cmp ecx, ebx
jne 0x441e29
push 4
call fcn.00469281
add esp, 4
cmp eax, ebx
je 0x441e1f
mov dword [eax], vtable.CWinAUSystemUtil.0
jmp 0x441e21
xor eax, eax
mov ecx, eax
mov dword [0x4d4424], ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
test al, al
jne 0x441f1f
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
lea edi, [esp + 0x30]
mov byte [esp + 0x29c], 1
call fcn.00405f60
mov ecx, edi
call fcn.0044d710
cmp eax, 1
jne 0x441f04
lea esi, [esp + 0x4c]
call fcn.0043e600
mov byte [esp + 0x29c], 2
mov esi, dword [esp + 0x64]
cmp esi, 8
mov edi, dword [esp + 0x50]
mov eax, edi
jae 0x441e8a
lea eax, [esp + 0x50]
cmp dword [esp + 0x48], 8
mov ecx, dword [esp + 0x34]
jae 0x441e99
lea ecx, [esp + 0x34]
call fcn.00445230
test eax, eax
je 0x441ef6
cmp esi, 8
mov eax, edi
jae 0x441ead
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x60]
push ecx
push eax
mov eax, ebp
call fcn.004420b0
cmp eax, 0xffffffff
je 0x441ef6
lea edx, [esp + 0x4c]
push edx
push ebp
lea ecx, [esp + 0x38]
lea edi, [esp + 0x1c]
call fcn.00444ae0
add esp, 8
push 0xffffffffffffffff
push ebx
mov ecx, ebp
mov byte [esp + 0x2a4], 3
call fcn.00406430
mov ecx, edi
call fcn.00401a00
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x50]
cmp esi, 8
jb 0x441f04
push edi
call fcn.004692b1
add esp, 4
mov byte [esp + 0x29c], bl
cmp dword [esp + 0x48], 8
jb 0x441f1f
mov eax, dword [esp + 0x34]
push eax
call fcn.004692b1
add esp, 4
push 0x2f
push 0x5c
mov edi, ebp
call fcn.00401c00
add esp, 8
cmp dword [esp + 0x80], 8
jb 0x441f44
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.004692b1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x294]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.00483bf3
add esp, 0x28c
ret
Function at 0x441f70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x2b
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x441fb6
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00483bf3
add esp, 0x20c
ret
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441fc0
sub eax, edx
push edi
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00406d50
push 0x28
push str.Canon_Inc_ICUniversalInstallerInstall
mov ecx, esi
call fcn.00408260
push 0x2f
push 0x5c
mov edi, esi
call fcn.00401c00
mov ecx, dword [esp + 0x218]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00483bf3
add esp, 0x20c
ret

Function at 0x442010
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x2b
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x442056
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00483bf3
add esp, 0x20c
ret
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x442060
sub eax, edx
push edi
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00406d50
push 0x36
push str.Canon_Inc_ICUniversalInstallerUninstallUnInstaller
mov ecx, esi
call fcn.00408260
push 0x2f
push 0x5c
mov edi, esi
call fcn.00401c00
mov ecx, dword [esp + 0x218]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00483bf3
add esp, 0x20c
ret

Function at 0x442550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a8308
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], eax
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea eax, [esp + 8]
push eax
call fcn.00441d40
mov ecx, dword [esp + 0x10]
add esp, 4
cmp dword [esp + 0x20], 8
jae 0x4425b1
lea ecx, [esp + 0xc]
push esi
mov edx, str.Canon_Inc_IC_ServiceLog_AutoUpdateService
call fcn.0043df40
add esp, 4
cmp dword [esp + 0x20], 8
jb 0x4425d3
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004692b1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00483bf3
add esp, 0x30
ret
Function at 0x447670
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4ab7a3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebp, ebp
mov esi, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x40], ebp
cmp dword [esi + 0x14], ebp
je 0x447781
cmp dword [esi + 0x18], 8
jb 0x4476c1
mov edi, dword [esi + 4]
jmp 0x4476c4
lea edi, [esi + 4]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x447781
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
test al, al
jne 0x447781
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], 0
lea eax, [esp + 0x18]
push eax
push esi
mov byte [esp + 0x48], 1
call fcn.0044fc50
add esp, 8
test al, al
je 0x44776d
push 0x18
call fcn.00469281
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov byte [esp + 0x40], 2
je 0x447737
mov esi, eax
call fcn.00446120
mov edi, eax
jmp 0x447739
xor edi, edi
mov esi, edi
mov dword [esp + 0x10], esi
push edi
lea eax, [esp + 0x1c]
mov byte [esp + 0x44], 3
call fcn.004464f0
test eax, eax
jne 0x44775a
mov ebp, edi
xor esi, esi
mov dword [esp + 0x14], ebp
test esi, esi
mov byte [esp + 0x40], 1
je 0x44776d
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp dword [esp + 0x30], 8
jb 0x447781
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004692b1
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00483bf3
add esp, 0x34
ret

Function at 0x4477b0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a8a5b
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp + 0x20]
push eax
call fcn.00446460
mov esi, eax
test esi, esi
je 0x447814
cmp dword [esi + 0xd4], 8
jb 0x4477f8
mov edi, dword [esi + 0xc0]
jmp 0x4477fe
lea edi, [esi + 0xc0]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x447812
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
jmp 0x447814
xor esi, esi
push 0x128
call fcn.00469281
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x44784f
push ebp
push eax
mov ecx, esi
call fcn.004425f0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
Function at 0x448a60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a80f1
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi], vtable.CAUActionListXML.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esp + 0x14], eax
mov ecx, 7
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x28], eax
mov word [esi + 0x18], ax
lea edi, [esi + 0x30]
mov dword [edi + 0x18], ecx
mov dword [edi + 0x14], eax
mov word [edi + 4], ax
mov byte [esp + 0x14], 2
call fcn.00405f60
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x449250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a6f39
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x38]
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov edi, edx
mov dword [esp + 0x30], ecx
mov ebx, dword [edi + 8]
add edi, 4
cmp ebx, dword [edi + 8]
mov dword [esp + 0x18], 1
jbe 0x4492a8
call fcn.00484029
mov ebp, edi
lea ebx, [ebx]
mov esi, dword [edi + 8]
cmp dword [edi + 4], esi
jbe 0x4492bd
call fcn.00484029
test ebp, ebp
je 0x4492c5
cmp ebp, edi
je 0x4492ca
call fcn.00484029
cmp ebx, esi
je 0x4493af
test ebp, ebp
jne 0x4492db
call fcn.00484029
cmp ebx, dword [ebp + 8]
jb 0x4492e5
call fcn.00484029
mov edi, dword [ebx + 4]
test edi, edi
je 0x4493aa
mov esi, dword [ebx + 8]
mov ecx, esi
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x4493aa
cmp edi, esi
jbe 0x44931c
call fcn.00484029
lea esi, [edi + 0x1c]
cmp esi, dword [ebx + 8]
mov dword [esp + 0x24], edi
ja 0x44932d
cmp esi, dword [ebx + 4]
jae 0x449332
call fcn.00484029
cmp esi, dword [ebx + 8]
jb 0x44933c
call fcn.00484029
mov eax, dword [esp + 0x3c]
cmp dword [eax + 0x18], 8
mov edi, dword [eax + 0x14]
jb 0x44934e
mov eax, dword [eax + 4]
jmp 0x449351
add eax, 4
push eax
mov eax, dword [esi + 0x14]
mov ecx, esi
call fcn.00406a90
test eax, eax
jne 0x449396
cmp ebx, dword [ebp + 8]
jb 0x44936a
call fcn.00484029
push 2
mov eax, ebx
call fcn.00449410
cmp dword [eax + 0x14], 0
je 0x449396
cmp ebx, dword [ebp + 8]
jb 0x449383
call fcn.00484029
push 0
mov eax, ebx
call fcn.00449410
mov esi, dword [esp + 0x38]
push eax
call fcn.004062b0
cmp ebx, dword [ebp + 8]
jb 0x4493a0
call fcn.00484029
add ebx, 0x10
mov edi, ebp
jmp 0x4492b0
call fcn.0042fbb0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x449530
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x23
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x449576
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00483bf3
add esp, 0x20c
ret
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449580
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 8]
push ecx
call fcn.00406d50
push 0x37
push str.Canon_Inc_ICAutoUpdateCanonAutoUpdateLog_v_2_0_0.dat
mov ecx, esi
call fcn.00408260
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
mov al, 1
call fcn.00483bf3
add esp, 0x20c
ret

Function at 0x4497c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a6ef0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4cc850]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push esi
mov eax, dword [0x4cc850]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x5c]
xor ebx, ebx
cmp esi, ebx
je 0x4498bb
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x449803
sub eax, edx
sar eax, 1
je 0x4498bb
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44983b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
cmp al, 1
sete bl
mov al, bl
jmp 0x4498bd
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x58], ebx
call fcn.0043ddf0
mov eax, dword [esp + 0x34]
add esp, 4
cmp dword [esp + 0x44], 8
jae 0x44986e
lea eax, [esp + 0x30]
push eax
call fcn.004497c0
add esp, 4
cmp al, 1
jne 0x4498a3
mov edx, esi
lea eax, [esp + 0x10]
call fcn.00405e60
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x58], 1
call fcn.004495c0
add esp, 4
lea ecx, [esp + 0x10]
mov bl, al
call fcn.00401a00
cmp dword [esp + 0x44], 8
jb 0x4498b7
mov edx, dword [esp + 0x30]
push edx
call fcn.004692b1
add esp, 4
mov al, bl
jmp 0x4498bd
xor al, al
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00483bf3
add esp, 0x4c
ret