joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f020
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push edi
mov dword [ebp - 4], 0
push dword [esi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x44f076
mov ecx, dword [esi + 4]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], str.AGSService_in_OnStop
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push str.Thread_OnStop_...
push 0
push 4
push str.AGSService
push dword [0x5efb48]
mov dword [0x5efb50], 1
call fcn.004a7700
add esp, 0x14
push 0xffffffffffffffff
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
test eax, eax
jne 0x44f0b1
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 0x5d78e0
push eax
call fcn.0050fcb7
int3
Function at 0x44fe70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x44fec6
mov ecx, dword [edi + 4]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x44fed0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push eax
push str._s_failed_w_err_0x_08lx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044f6d0
add esp, 0x14
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x44ff64
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
mov dword [ebp - 0x214], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0050ad85
mov esp, ebp
pop ebp
ret 8
Function at 0x44ff80
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57763b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x44ffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5b54d0
call fcn.0044dda0
add esp, 8
jmp 0x45016c
xor eax, eax
lea ecx, [ebp - 0x230]
cmp word [0x5b461c], ax
setne al
push eax
push 0x5b461c
call fcn.0044d430
cmp word [ebp - 0x218], 0
jne 0x45002a
xor ecx, ecx
jmp 0x450042
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x450033
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00450370
xor eax, eax
lea ecx, [ebp - 0x230]
cmp word [0x5b461c], ax
setne al
push eax
push 0x5b461c
call fcn.00450370
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x45009d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.0044dda0
add esp, 8
jmp 0x45016c
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0
cmovae eax, dword [ebp - 0x230]
push 0
push 0x5b4948
push 0
push 0
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x5b4898
push 0x5b487c
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x450117
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.CreateService_failed_w_err_0x_08lx_n
call fcn.0044dda0
add esp, 8
call esi
push eax
push str.AGSSerice_Service_Install_Failed_...08lx
push edi
push 4
push str.AGSService
push dword [0x5efb48]
call fcn.004a7700
add esp, 0x18
jmp 0x45015c
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0x5b4898
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0x5b487c
push str._s_is_installed._n
call fcn.0044dda0
push str.AGSSerice_Service_Installed_...
push 0
push 4
push str.AGSService
push dword [0x5efb48]
call fcn.004a7700
add esp, 0x1c
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
test edi, edi
je 0x45016c
push edi
call esi
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x45018a
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.0044d810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x4501b0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0
push 0
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x450210
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.0044dda0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
push 0x10024
push 0x5b487c
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x450238
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed_w_err_0x_08lx_n
jmp 0x4502ee
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4502cb
push 0x5b487c
push str.Stopping__s.
call fcn.0044dda0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
je 0x4502a7
nop dword [eax]
mov eax, dword [ebp - 0x1c]
cmp eax, 3
jne 0x4502aa
push 0x5b5680
call fcn.0044dda0
add esp, 4
push 0x3e8
call edi
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
jne 0x450280
mov eax, dword [ebp - 0x1c]
push 0x5b487c
cmp eax, 1
jne 0x4502bb
push 0x5b5684
jmp 0x4502c0
push str._n_s_failed_to_stop._n
call fcn.0044dda0
mov ebx, dword [ebp - 0x24]
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4502e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5b56d8
jmp 0x4502ee
push 0x5b487c
push str._s_is_removed._n
call fcn.0044dda0
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
test esi, esi
je 0x450306
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050ad85
mov esp, ebp
pop ebp
ret

Function at 0x450ed0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
mov dword [ebp - 0xc], 0xc
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 1
push eax
lea eax, [esi + 8]
mov dword [ebp - 8], 0
push eax
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x450f2b
push str.Failed_to_create_pipe
push dword [0x5da028]
push 2
push str.AdobeGCClientNSLookup
push dword [esi]
call fcn.004a7700
add esp, 0x14
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x450f5f
push str.Failed_to_set_handle_information
push dword [0x5da028]
push 2
push str.AdobeGCClientNSLookup
push dword [esi]
call fcn.004a7700
add esp, 0x14
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x455380
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5783f0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x4553c5
mov eax, dword [esi]
jmp 0x4553c7
mov eax, esi
mov byte [eax], 0
cmp dword [ebp + 0x18], 0
jne 0x4553f1
push str.No_input_file_path_data
push 0
push 5
push str.AdobeGCVersionWrapper
push dword [0x5efb58]
call fcn.004a7700
add esp, 0x14
jmp 0x455574
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.0045af40
mov edi, eax
mov dword [ebp - 0x14], 7
add esp, 4
mov dword [ebp - 0x18], 0
test edi, edi
mov edx, 0x5b4948
cmovne edx, edi
xor eax, eax
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x45542e
xor ecx, ecx
jmp 0x455442
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x455433
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044d430
push edi
mov byte [ebp - 4], 1
call fcn.00524165
add esp, 4
cmp dword [ebp - 0x18], 0
jne 0x45546d
push str.Error_converting_ascii_path_to_wide_path
push 0
push 5
jmp 0x45554c
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x45555f
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0050ad9b
mov edi, eax
add esp, 4
test edi, edi
je 0x455543
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push edi
cmovae ecx, dword [ebp - 0x28]
push ebx
push dword [ebp - 0x30]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x455515
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0x5b5b4c
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x455538
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x455538
movzx eax, word [ecx + 0xc]
mov dx, word [ecx + 8]
push esi
push eax
movzx eax, word [ecx + 0xe]
mov cx, word [ecx + 0xa]
push eax
call fcn.004555b0
add esp, 0xc
push edi
call fcn.0050ad96
add esp, 4
jmp 0x45555f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_retrieving_version_for_file_:__d
push 0
push 2
push str.AdobeGCVersionWrapper
push dword [0x5efb58]
call fcn.004a7700
add esp, 0x18
push edi
call fcn.0050ad96
add esp, 4
jmp 0x45555f
push str.Error_creating_memory_for_version
push 0
push 2
push str.AdobeGCVersionWrapper
push dword [0x5efb58]
call fcn.004a7700
add esp, 0x14
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x455574
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0044d810
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x455589
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.0044ad40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x456560
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578842
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x314], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x318], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x31c], esi
mov dword [esi + 0x10], 0
jb 0x4565d1
mov eax, dword [esi]
jmp 0x4565d3
mov eax, esi
xor ecx, ecx
mov byte [eax], 0
cmp byte [str.unknown], cl
mov eax, 7
cmove eax, ecx
mov ecx, esi
push eax
push str.unknown
call fcn.0044d570
push 0x200
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x318], 1
call fcn.00510680
add esp, 0xc
mov dword [ebp - 0x314], 0x100
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x310]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x4566a8
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00510680
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push 0
push 0x100
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x110], 0
jne 0x456687
xor ecx, ecx
jmp 0x456699
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x456690
sub ecx, edx
push ecx
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.0044d570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x4566d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578842
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x314], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x318], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x31c], esi
mov dword [esi + 0x10], 0
jb 0x456741
mov eax, dword [esi]
jmp 0x456743
mov eax, esi
xor ecx, ecx
mov byte [eax], 0
cmp byte [str.unknown], cl
mov eax, 7
cmove eax, ecx
mov ecx, esi
push eax
push str.unknown
call fcn.0044d570
push 0x200
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x318], 1
call fcn.00510680
add esp, 0xc
mov dword [ebp - 0x314], 0x100
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x310]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x456818
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00510680
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push 0
push 0x100
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x110], 0
jne 0x4567f7
xor ecx, ecx
jmp 0x456809
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x456800
sub ecx, edx
push ecx
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.0044d570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x456f20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0xa30], edx
push ebx
xor ebx, ebx
mov dword [ebp - 0xa2c], eax
test eax, eax
je 0x4570aa
push 0x20a
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.00510680
add esp, 0xc
xor eax, eax
mov word [ebp - 0xa28], ax
lea eax, [ebp - 0xa28]
push eax
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
dec eax
cmp eax, 0x1fe
ja 0x4570aa
mov eax, dword [0x5b5c88]
push esi
mov dword [ebp - 0xc], eax
mov ax, word [0x5b5c8c]
push edi
mov word [ebp - 8], ax
lea edi, [ebp - 0xa28]
mov ax, word [edi]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x214]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x457090
lea esi, [ebp - 0x214]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x456fd0
sub esi, ecx
sar esi, 1
cmp esi, 0x104
jae 0x457090
push esi
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0xa2c]
call fcn.00524f3d
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0xa2c]
jne 0x457019
cmp word [eax + esi*2], 0x5c
jne 0x457019
mov ebx, 1
jmp 0x45701b
xor ebx, ebx
test ebx, ebx
je 0x457090
lea eax, [eax + esi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push str._s_s
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.004559d0
lea ecx, [ebp - 0x41c]
add esp, 0x14
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457050
sub ecx, edx
lea eax, [ebp - 0x41c]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x628]
push 0x105
push eax
call fcn.005251c3
mov ecx, dword [ebp - 0xa30]
lea eax, [ebp - 0x628]
add esp, 0x10
push eax
call fcn.0044d3e0
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x457090
test ebx, ebx
jne 0x4570a8
cmp word [edi], bx
jne 0x456fa2
pop edi
pop esi
mov ecx, dword [ebp - 4]
test ebx, ebx
pop ebx
setne al
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
Function at 0x45a240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578506
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5df3f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0050ada4
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0050caf7
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45b5e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x20c]
mov edi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x45b67d
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045afa0
mov esi, eax
add esp, 4
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45b623
sub ecx, edx
je 0x45b639
cmp byte [ecx + esi - 1], 0x5c
jne 0x45b639
mov byte [ecx + esi - 1], al
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x45b640
sub edx, ecx
or ecx, 0xffffffff
cmp edx, 0x104
cmovb ecx, edx
push ecx
push esi
push 0x104
push edi
call fcn.00525541
push esi
call fcn.00524165
add esp, 0x14
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0050ad85
mov esp, ebp
pop ebp
ret

Function at 0x45b710
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jle 0x45b774
push 2
push esi
call fcn.00524235
mov edi, eax
add esp, 8
test edi, edi
je 0x45b774
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x45b75d
mov word [edi], ax
push edi
call fcn.00525bf8
push edi
mov esi, eax
call fcn.00524165
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
ret
push 0x16
call fcn.005265b1
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
Function at 0x45b880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
dec edx
push edi
mov edi, ecx
cmp edx, 0xfe
ja case.0x45b8a7.2
movzx eax, byte [edx + 0x45b994]
jmp dword [eax*4 + 0x45b974]
mov esi, 0x2b
jmp 0x45b8dd
mov esi, 0x23
jmp 0x45b8dd
mov esi, 0x1a
jmp 0x45b8dd
mov esi, 0x1c
jmp 0x45b8dd
mov esi, 0x2a
jmp 0x45b8dd
mov esi, 0x26
jmp 0x45b8dd
mov esi, 0x2c
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
mov eax, esi
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x45b91b
cmp esi, 0x2c
jne 0x45b960
lea edx, [esi - 0x2b]
mov ecx, edi
call fcn.0045b880
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call fcn.0045afa0
mov esi, eax
add esp, 4
test esi, esi
je 0x45b960
push 0xffffffffffffffff
push esi
push 0x104
push edi
call fcn.00525541
xor ecx, ecx
test eax, eax
push esi
cmovne edi, ecx
call fcn.00524165
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0050ad85
mov esp, ebp
pop ebp
ret

Function at 0x45bc50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5df3f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x45bcc6
test edi, edi
je 0x45bcc6
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45bc75
sub ecx, edx
je 0x45bcc6
lea eax, [ebp - 0x38]
push eax
push edi
call fcn.0045b350
add esp, 8
test eax, eax
jne 0x45bcc6
mov eax, dword [ebp - 0x24]
inc eax
push 1
push eax
call fcn.00524235
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x45bcc6
push 0x5b4038
push edi
call fcn.0045b290
mov edi, eax
add esp, 8
test edi, edi
jne 0x45bcd9
push dword [esi]
call fcn.00524165
add esp, 4
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ad85
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x24]
push 1
push dword [esi]
call fcn.00521711
push edi
mov esi, eax
call fcn.00518f1e
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.0050ad85
mov esp, ebp
pop ebp
ret