joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428bd4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov edx, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x4ea418]
xor ecx, ebp
mov dword [esp + 0x10], ecx
mov ecx, 0x1b3
movsd xmm0, qword [eax]
movsd qword [esp + 8], xmm0
mov eax, dword [edx]
mov dword [esp + 4], edx
mov edi, dword [edx + 4]
xor ebx, ebx
movzx esi, byte [esp + ebx + 8]
xor esi, eax
mov eax, esi
mul ecx
imul edi, ecx
add edi, edx
mov edx, 0x100
imul esi, edx
add edi, esi
inc ebx
cmp ebx, 8
jne 0x428c0b
mov edx, dword [esp + 4]
mov dword [edx], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx]
mov dl, byte [ebx]
test dl, dl
je 0x428c68
inc ebx
movzx esi, dl
xor esi, eax
mov eax, esi
mul ecx
imul edi, ecx
add edi, edx
mov edx, 0x100
imul esi, edx
add edi, esi
mov edx, dword [esp + 4]
mov dword [edx], eax
mov dword [edx + 4], edi
mov dl, byte [ebx]
inc ebx
test dl, dl
jne 0x428c40
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.004961ed
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x431480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4416b0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov edi, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [edi + 4], 1
jne 0x4314ef
movzx eax, byte [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [0x4e4884]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push dword [ebp - 0x2c]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x431614
lea esi, [ebp - 0x28]
mov ecx, edi
push esi
call fcn.0042a05a
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x4f22a4
call fcn.0043c886
mov esi, eax
mov edi, dword [ebp - 0x28]
cmp edi, 0x4f21b4
mov ebx, dword [ebp + 0xc]
je 0x431544
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x431544
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, ebx
call dword [0x4e4884]
mov ecx, edi
call ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
dec eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [esi]
mov dl, byte [ebp + 0x18]
xor dl, 1
movzx edx, dl
mov edi, dword [ecx + edx*4 + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, edi
call dword [0x4e4884]
mov ecx, esi
lea esi, [ebp - 0x28]
push esi
call edi
mov edi, esi
mov al, byte [ebp - 0x1d]
test al, al
jns 0x43157e
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
test al, al
js 0x431593
movzx eax, al
add eax, ebp
add eax, 0xffffffd8
cmp edi, eax
jne 0x43159f
jmp 0x4315fa
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
add ecx, eax
cmp edi, ecx
je 0x4315fe
test ebx, ebx
je 0x4315b7
mov al, byte [edi]
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x1c]
je 0x4315bb
lea edx, [ecx + 1]
mov dword [ebx + 0x18], edx
mov byte [ecx], al
jmp 0x4315f4
xor ebx, ebx
jmp 0x4315f4
mov dword [ebp - 0x2c], edi
movzx edi, al
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [0x4e4884]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x30], ebx
mov ecx, ebx
push edi
call esi
xor ebx, ebx
cmp eax, 0xffffffff
je 0x4315ee
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x2c]
inc edi
mov al, byte [ebp - 0x1d]
jmp 0x431581
mov dword [esi], ebx
jmp 0x431609
mov dword [esi], ebx
push eax
call fcn.00494236
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x432400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4416d0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov edi, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [edi + 4], 1
jne 0x43246f
movzx eax, byte [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [0x4e4884]
movzx eax, word [ebp + 0x14]
mov ecx, esi
push dword [ebp - 0x2c]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x4325a3
lea esi, [ebp - 0x28]
mov ecx, edi
push esi
call fcn.0042a05a
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x4f22ac
call fcn.0043c886
mov esi, eax
mov edi, dword [ebp - 0x28]
cmp edi, 0x4f21b4
mov ebx, dword [ebp + 0xc]
je 0x4324c4
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x4324c4
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, ebx
call dword [0x4e4884]
mov ecx, edi
call ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
dec eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [esi]
mov dl, byte [ebp + 0x18]
xor dl, 1
movzx edx, dl
mov edi, dword [ecx + edx*4 + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, edi
call dword [0x4e4884]
mov ecx, esi
lea esi, [ebp - 0x28]
push esi
call edi
mov edi, esi
mov al, byte [ebp - 0x1d]
test al, al
jns 0x43256e
mov edi, dword [ebp - 0x28]
jmp 0x43256e
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
lea edx, [ecx + edx*2]
cmp edi, edx
je 0x432589
test ebx, ebx
je 0x432527
movzx esi, word [edi]
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x1c]
je 0x43252b
lea ecx, [eax + 2]
mov dword [ebx + 0x18], ecx
mov word [eax], si
jmp 0x43255c
xor ecx, ecx
jmp 0x432569
mov dword [ebp - 0x30], edi
mov eax, dword [ebx]
mov edi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [0x4e4884]
mov dword [ebp - 0x10], 1
movzx eax, si
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
push eax
call edi
mov esi, eax
mov ebx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
xor ecx, ecx
cmp si, 0xffff
je 0x432566
mov ecx, ebx
mov al, byte [ebp - 0x1d]
add edi, 2
mov ebx, ecx
test al, al
js 0x432500
movzx ecx, al
lea ecx, [ecx*2 - 0x28]
add ecx, ebp
cmp edi, ecx
jne 0x43250d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x432599
mov esi, dword [ebp + 8]
mov dword [esi], ebx
push ecx
call fcn.00494236
mov eax, esi
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x436824
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004411c4
mov edx, eax
test ebx, ebx
je 0x43684b
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 0x10]
je 0x436856
movzx eax, word [eax]
jmp 0x43686d
xor ecx, ecx
test dl, dl
je 0x436880
jmp 0x436914
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
mov byte [ebp - 0x10], dl
call dword [0x4e4884]
mov ecx, ebx
call edi
mov dl, byte [ebp - 0x10]
xor edi, edi
cmp ax, 0xffff
sete al
je 0x43687a
mov edi, ebx
mov ecx, edi
cmp dl, al
je 0x4368fa
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov dword [ebp - 0x10], ecx
je 0x436892
movzx edi, word [eax]
jmp 0x4368a5
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x4e4884]
mov ecx, edi
call esi
mov edi, eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4e4884]
movzx eax, di
mov ecx, ebx
push eax
push 8
call esi
test al, al
je 0x4368f4
mov esi, dword [ebp + 8]
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov ebx, dword [ebp - 0x10]
je 0x4368de
add eax, 2
mov dword [edi + 0xc], eax
jmp 0x436831
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x4e4884]
mov ecx, edi
call esi
jmp 0x43682e
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004411c4
mov ebx, eax
test edi, edi
je 0x43691d
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
je 0x436923
movzx eax, word [eax]
jmp 0x436934
mov ecx, esi
call fcn.004411c4
mov ebx, eax
test bl, bl
jne 0x43693f
jmp 0x436945
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x4e4884]
mov ecx, edi
call esi
cmp ax, 0xffff
sete al
xor bl, al
jne 0x436945
mov eax, dword [ebp + 0x10]
or byte [eax], 2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x444830
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f2ac4]
mov ecx, dword [0x4ed65c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44487f
movzx eax, word [0x4f2aa0]
cmp eax, 0xc
ja case.0x44485c.1
jmp dword [eax*4 + 0x4d8c08]
mov eax, 2
pop ebp
ret
mov eax, 1
pop ebp
ret
mov eax, 3
pop ebp
ret
mov eax, 4
pop ebp
ret
push 0x4f2ac4
call fcn.004942a7
add esp, 4
cmp dword [0x4f2ac4], 0xffffffff
jne 0x444850
xorps xmm0, xmm0
movups xmmword [0x4f2ab0], xmm0
movups xmmword [0x4f2aa0], xmm0
mov dword [0x4f2ac0], 0
push 0x4f2aa0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x4f2ac4
call fcn.0049431d
add esp, 4
jmp 0x444850
Function at 0x4467f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x446840
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x44682a
call fcn.0045a4c0
push dword [esi]
call fcn.00445180
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x446839
mov dword [esi], ebx
call fcn.0045a4c0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x446857
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3

Function at 0x446860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x446886
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x446888
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4468aa
mov bl, 1
cmp byte [ebp + 0xc], 0
je 0x446908
cmp byte [esi + 4], 0
je 0x4468e9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4468eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x4468be
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4468c0
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4468d4
xor ebx, ebx
jmp 0x446908
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x4468f9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4468fb
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x446908
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x448260
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov edi, dword [ebp + 0xc]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esp + 0x98], eax
mov dword [esp + 0x10], 0xa
mov eax, dword [0x4dc8c4]
movzx eax, byte [eax + 0xa]
test al, al
jne 0x448496
mov dword [esp + 0x88], 0xffffffff
mov dword [esp + 0x8c], 0xffffffff
mov dword [esp + 0x90], 0xffffffff
lea eax, [esp + 0x40]
mov ecx, edi
push eax
call fcn.0045ca90
cmp byte [esp + 0x4b], 0
js 0x4482e9
mov eax, dword [esp + 0x48]
mov dword [esp + 0x90], eax
movq xmm0, qword [esp + 0x40]
movq qword [esp + 0x88], xmm0
jmp 0x4482fd
lea ecx, [esp + 0x88]
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.00442a00
lea esi, [esp + 0x40]
mov ecx, esi
call fcn.0045a7b0
mov dword [esp + 0x7c], 0xffffffff
mov dword [esp + 0x80], 0xffffffff
mov dword [esp + 0x84], 0xffffffff
lea ebx, [esp + 0x7c]
mov ecx, edi
push ebx
call fcn.0045e3e0
pxor xmm0, xmm0
movq qword [esp + 0x74], xmm0
pxor xmm0, xmm0
movdqu xmmword [esp + 0x64], xmm0
mov dword [esp + 0x40], 0x3c
mov dword [esp + 0x44], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], str.runas
cmp byte [esp + 0x93], 0
jns 0x44837b
mov ecx, dword [esp + 0x88]
jmp 0x448382
lea ecx, [esp + 0x88]
movzx eax, byte [ebp + 0x10]
mov dword [esp + 0x50], ecx
cmp byte [esp + 0x87], 0
jns 0x448398
mov ebx, dword [esp + 0x7c]
mov edi, dword [ebp + 8]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], 0
xor al, 1
movzx eax, al
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x448424
cmp byte [ebp + 0x14], 0
je 0x44841e
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov esi, esp
push 0x201
push str....._baseprocesslaunch_win.cc
push str.LaunchElevatedProcess
push esi
call fcn.0045a490
add esp, 0x10
lea ebx, [esp + 0x10]
mov ecx, ebx
push 0
push esi
lea esi, [esp + 0x48]
call fcn.00465890
push 0xffffffffffffffff
push dword [esp + 0x7c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
call fcn.00465900
mov eax, dword [esp + 0x78]
jmp 0x448426
xor eax, eax
mov ecx, edi
push eax
call fcn.004467f0
cmp byte [esp + 0x87], 0
js 0x44846f
cmp byte [esp + 0x93], 0
js 0x448485
mov dword [esp + 0x10], 0xa
mov eax, dword [0x4dc8c4]
movzx eax, byte [eax + 0xa]
test al, al
jne 0x4484bb
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.004961ed
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [esp + 0x7c]
call fcn.00494236
add esp, 4
cmp byte [esp + 0x93], 0
jns 0x448442
push dword [esp + 0x88]
call fcn.00494236
add esp, 4
jmp 0x448442
movzx eax, al
mov dword [esp + 0x40], str.LaunchElevatedProcess
lea ecx, [esp + 0x40]
lea edx, [esp + 0x10]
push 1
push ecx
push edx
push eax
call fcn.00446920
add esp, 0x10
jmp 0x448299
movzx eax, al
mov dword [esp + 0x40], 0
lea ecx, [esp + 0x10]
push 2
push esi
push ecx
push eax
call fcn.004478b0
add esp, 0x10
jmp 0x448457
Function at 0x448d90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x20b
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.0045a490
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.00465890
cmp byte [edi + 0xb], 0
jns 0x448df0
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.00465900
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x448e20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x233
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.0045a490
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.00465890
cmp byte [edi + 0xb], 0
jns 0x448e80
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.00465900
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x448ec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.0049dcc0
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x448f43
push ebx
call fcn.004b8b3c
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.0045a6b0
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.0045b860
mov ecx, dword [ebp + 8]
push ebx
call fcn.0045a830
mov ecx, ebx
call fcn.0045a7b0
mov ecx, edi
call fcn.0045a7b0
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x448f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.0049dcc0
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x4d9090]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x448fd8
cmp word [ebp - 0x214], 0
je 0x448fd8
push edi
call fcn.004b8b3c
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0045a6b0
jmp 0x449031
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.0045a660
push edi
call fcn.00448ec0
add esp, 4
mov ecx, esi
test al, al
je 0x44901a
push edi
call fcn.0045a680
jmp 0x449026
push 3
push 0x4d90f2
call fcn.0045a6b0
lea ecx, [ebp - 0x220]
call fcn.0045a7b0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret

Function at 0x449050
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea ebx, [esp + 0x50]
push 0x444
push str....._base_files_file_util_win.cc
push 0x4d90fa
push ebx
call fcn.0045a490
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.00465890
lea eax, [esp + 0x52]
push 0x206
push 0xff
push eax
call fcn.0049dcc0
add esp, 0xc
mov word [esp + 0x50], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x449119
push ebx
call fcn.004b8b3c
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.0045a6b0
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.0045b860
mov ecx, dword [ebp + 8]
push ebx
call fcn.0045a830
mov ecx, ebx
call fcn.0045a7b0
mov ecx, edi
call fcn.0045a7b0
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.00465900
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x449220
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 0xc]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea edi, [esp + 0x10]
push 0x4d
push str....._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.0045a490
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.00465890
mov dword [esp + 0xc], 0xffffffff
cmp byte [esi + 0xb], 0
jns 0x449285
mov esi, dword [esi]
mov edi, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x44938c
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
js 0x4493c1
mov ebx, eax
push eax
call fcn.00494206
add esp, 4
mov edi, eax
mov dword [esp + 0x10], eax
add eax, ebx
mov dword [esp + 0x18], eax
xor ecx, ecx
nop word cs:[eax + eax]
mov edx, edi
add edx, ecx
je 0x4493b2
mov byte [edx], 0
inc ecx
cmp ebx, ecx
jne 0x4492e0
mov dword [esp + 0x14], eax
push edi
push ebx
push dword [esp + 0x14]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x449367
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0xffffffff
lea eax, [esp + 0x50]
lea ecx, [esp + 0x54]
push eax
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x449367
mov esi, dword [esp + 0x54]
test esi, esi
je 0x449367
push 0x1c
call fcn.00494206
add esp, 4
mov edi, eax
movzx eax, word [esi + 2]
movzx edx, word [esi]
mov ecx, edi
push eax
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004493e0
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x449374
jmp 0x449394
mov esi, dword [ebp + 8]
mov dword [esi], 0
test edi, edi
je 0x449394
mov eax, dword [esp + 0x14]
mov ecx, eax
sub ecx, edi
dec eax
cmp ecx, eax
ja 0x4493ca
push edi
call fcn.00494236
add esp, 4
jmp 0x449394
mov dword [edi], 0
mov esi, edi
lea ecx, [esp + 0x20]
call fcn.00465900
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
push 0x4d348e
call fcn.00424574
lea ecx, [esp + 0x10]
call fcn.00421de0
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
push 0x4d348e
call fcn.00424574
int3