joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410c25
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46244e
mov eax, dword fs:[0]
push eax
mov eax, 0x1054
call fcn.0041d5e0
mov eax, dword [0x485094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0041095a
mov edi, 0x800
mov esi, eax
push edi
lea eax, [ebp - 0x1020]
push 0
push eax
call fcn.00436570
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x1058], eax
push edi
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.00436570
add esp, 0xc
lea ecx, [ebp - 0x1050]
mov edx, str.3eoB
call fcn.004110d7
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1038]
mov edx, eax
call fcn.00409c4e
push 0
push 1
lea ecx, [ebp - 0x1050]
mov byte [ebp - 4], 2
call fcn.00404892
cmp dword [ebp - 0x1024], 8
lea ecx, [ebp - 0x820]
mov edx, 0x400
lea eax, [ebp - 0x1038]
cmovae eax, dword [ebp - 0x1038]
push edx
push ecx
lea ecx, [ebp - 0x1058]
push ecx
lea ecx, [ebp - 0x105c]
push ecx
lea ecx, [ebp - 0x1054]
push ecx
push edx
lea ecx, [ebp - 0x1020]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1054]
lea edi, [ebp - 0x1b]
xor eax, eax
mov byte [ebp - 0x1c], 0
stosd dword es:[edi], eax
mov edx, esi
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push eax
call fcn.00410a54
pop ecx
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00411504
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1038]
call fcn.00401ca4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c30c
mov esp, ebp
pop ebp
ret
Function at 0x414dfb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x414e9a
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004347c0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x414e4f
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x414e76
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x414f55
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x414ec7
xor eax, eax
jmp 0x414f18
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x414ee4
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.004157a2
jmp 0x414efc
cmp eax, 2
jne 0x414f00
mov edx, dword [esi]
test edx, edx
jne 0x414ef3
xor eax, eax
jmp 0x414efd
push ecx
mov ecx, dword [esi + 0x30]
call fcn.004129ad
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.004347c0
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x414f40
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x414f55
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x414e0c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418664
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x14
push esi
call fcn.0040bbfc
push 0x14
pop esi
cmp eax, esi
jae 0x41867e
xor al, al
jmp 0x4186d9
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.0043ec34
push dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x10], si
inc eax
mov byte [ebp - 0xc], bl
push eax
mov word [ebp - 0xe], ax
mov edi, 0x58453144
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push esi
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0043d148
add esp, 0x1c
test eax, eax
je 0x4186c2
cmp dword [ebp - 0x14], edi
je 0x4186c6
xor al, al
jmp 0x4186d7
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4186d5
push 5
pop ecx
lea esi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov al, 1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x418dfc
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x485094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
test edi, edi
je 0x418e6e
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x418e22
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
cmp eax, 0x3fffffff
jg 0x418e6e
add eax, eax
call fcn.0041cdb0
mov esi, esp
test esi, esi
je 0x418e6b
mov ecx, dword [ebp - 0x1c]
push ebx
push ebx
mov byte [esi], bl
lea eax, [ecx + ecx]
push eax
push esi
push 0xffffffffffffffff
push edi
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, esi
mov esi, dword [ebp - 0x18]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push 0x7b
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_htons]
push ebx
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x418eae
push ebx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x418ed7
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
inc eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c30c
mov esp, ebp
pop ebp
ret 8
xor eax, eax
jmp 0x418ec1
Function at 0x418edb
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x485094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push esi
push edi
mov edi, 0x3e8
mov esi, dword [ebp + 8]
div edi
xor edi, edi
mov dword [ebp - 0x110], eax
inc edi
mov eax, dword [ecx]
xor ecx, ecx
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x110]
push eax
push ecx
push ecx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], edx
push eax
push ecx
mov dword [ebp - 0x108], edi
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x418f3e
xor eax, eax
jmp 0x418f49
xor ecx, ecx
test eax, eax
mov eax, edi
setne cl
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041c30c
mov esp, ebp
pop ebp
ret 8
Function at 0x41f07b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x448927
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044879d

Function at 0x44f11d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044ec70
Function at 0x456bf0
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push 0x98
mov eax, 0x4639a3
call fcn.0041ce47
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x88]
call fcn.00404bef
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
call fcn.0045831b
push eax
lea ecx, [ebp - 0x70]
call fcn.00406d1d
push 0x37
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 2
push eax
mov ecx, 0x489128
call fcn.00407df7
mov esi, eax
push 0x4794ec
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00402be1
push esi
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
call fcn.00402c59
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00406ccc
xor edi, edi
lea ecx, [ebp - 0x58]
push edi
push ebx
call fcn.00401ca4
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.00401ca4
push edi
push ebx
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.00401ca4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x479500
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0043cf4b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x456d43
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x58]
call fcn.00409b79
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
cmp dword [ebp - 0x44], 0x10
push esi
push dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x58]
push ebx
push ecx
call fcn.0043cba7
push esi
push ebx
push ebx
push 0x47954c
call fcn.0043cba7
add esp, 0x20
lea ecx, [ebp - 0x40]
mov edx, 0x4ad2d8
call fcn.00409b79
cmp dword [ebp - 0x30], edi
je 0x456d28
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push esi
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
push ebx
push eax
call fcn.0043cba7
add esp, 0x10
push esi
call fcn.0043c824
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.00404892
push edi
push ebx
lea ecx, [ebp - 0x58]
call fcn.00404892
push edi
push ebx
lea ecx, [ebp - 0x70]
call fcn.00401ca4
push 0
push ebx
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0
call fcn.00401ca4
call fcn.00458146
push 8
pop edi
cmp dword [0x4ad31c], edi
mov esi, 0x4ad308
push ecx
mov eax, esi
mov ecx, esp
cmovae eax, dword [0x4ad308]
push eax
call fcn.004061ac
mov ecx, dword [0x4ad590]
call fcn.0045a583
pop ecx
test eax, eax
je 0x456d9a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4ad31c], edi
cmovae esi, dword [0x4ad308]
push esi
call fcn.0043c785
cmp dword [ebp - 0x18], 0
pop ecx
je 0x456de0
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
call fcn.0040bb47
test al, al
je 0x456de0
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0043c785
pop ecx
xor edi, edi
lea ecx, [ebp - 0x28]
push edi
push ebx
call fcn.00401ca4
call fcn.0041cdf1
ret
Function at 0x457487
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push 0x464
mov eax, 0x463b29
call fcn.0041ce47
mov esi, ecx
mov ecx, dword [esi]
call fcn.0045a45b
mov edx, dword [esi]
lea ecx, [ebp - 0x448]
mov edi, eax
call fcn.0045a47b
lea eax, [ebp - 0x470]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x470], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x464], ebx
push 0x1c
lea eax, [ebp - 0x460]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x489128
call fcn.00407df7
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x4574fa
mov esi, dword [esi]
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x430], eax
xor eax, eax
mov dword [ebp - 0x418], 7
mov dword [ebp - 0x41c], ebx
mov word [ebp - 0x42c], ax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x414], eax
test esi, esi
je 0x457553
push esi
call fcn.00402f31
pop ecx
push eax
push esi
lea ecx, [ebp - 0x42c]
call fcn.00402eb8
lea eax, [ebp - 0x430]
push eax
push 0x41102f
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x468]
lea ecx, [ebp - 0x42c]
sub esi, dword [ebp - 0x46c]
push ebx
push 1
sar esi, 2
call fcn.00401ca4
push ebx
push 1
lea ecx, [ebp - 0x460]
call fcn.00401ca4
cmp esi, 1
jle 0x457634
push 0x400
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.00436570
mov esi, dword [ebp - 0x46c]
add esp, 0xc
cmp esi, dword [ebp - 0x468]
je 0x45764b
push 0x200
lea eax, [ebp - 0x410]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp - 0x434], 8
lea eax, [ebp - 0x448]
lea ecx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x448]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x457614
test dx, dx
je 0x457610
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x457614
add ecx, 4
add eax, 4
test dx, dx
jne 0x4575ee
mov eax, ebx
jmp 0x457619
sbb eax, eax
or eax, 1
test eax, eax
je 0x45762a
add esi, 4
cmp esi, dword [ebp - 0x468]
jne 0x4575c0
jmp 0x45762c
mov edi, dword [esi]
mov esi, dword [ebp - 0x46c]
jmp 0x45764b
mov eax, dword [ebp - 0x468]
mov esi, dword [ebp - 0x46c]
sub eax, esi
sar eax, 2
test eax, eax
je 0x45764b
mov edi, dword [esi]
test esi, esi
je 0x457678
mov eax, dword [ebp - 0x464]
sub eax, esi
push 4
sar eax, 2
push eax
push esi
call fcn.00401d05
add esp, 0xc
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x464], ebx
push ebx
push 1
lea ecx, [ebp - 0x448]
call fcn.00401ca4
mov eax, edi
call fcn.0041cdf1
ret
Function at 0x457cde
Capabilities:
Create thread

Disassembly:
push 0x5c
mov eax, 0x463c77
call fcn.0041ceb5
cmp byte [0x4ad64d], 0
jne 0x457e12
xor ebx, ebx
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x4ad290
push 0x401eed
push ebx
push ebx
mov dword [0x4ad5b8], ebx
mov dword [ebp - 0x48], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], ebx
call fcn.0045d090
or dword [ebp - 4], 0xffffffff
mov dword [0x4ad5b8], eax
jmp 0x457d38
cmp dword [ebp - 0x48], 0
je 0x457d56
push ebx
push ebx
push 0x502
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4ad5b8], 0
jne 0x457e12
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov dword [ebp - 4], 2
mov eax, dword [0x4ad398]
shr eax, 0xd
test al, 1
lea eax, [ebp - 0x44]
je 0x457dae
push 0x2b
push 0x13
push eax
call fcn.004571c1
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406d45
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.00404892
lea ecx, [ebp - 0x2c]
call fcn.0045cb34
jmp 0x457dcc
push 0x29
push 0x11
push eax
call fcn.004571c1
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406d45
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.00404892
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x58]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.00406276
mov esi, 0x473c88
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x58], esi
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x68]
call fcn.004062ad
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x68]
push 0x482100
push eax
mov dword [ebp - 0x68], esi
call fcn.00436f56
call fcn.0041ce02
ret

Function at 0x457e18
Capabilities:
Create thread

Disassembly:
push esi
call fcn.00438132
cmp byte [0x4ad64d], 0
mov esi, eax
jne 0x457e75
cmp dword [0x4ad5b4], 0
jne 0x457e75
cmp word [0x4ad662], 3
push edi
mov edi, 0x4ad658
jne 0x457e59
mov ecx, edi
call fcn.00406112
test al, 1
je 0x457e59
mov eax, dword [0x4ad398]
shr eax, 9
test al, 1
je 0x457e74
push 0x4ad5bc
xor eax, eax
push eax
push edi
push 0x404e5d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4ad5c0], eax
pop edi
mov eax, esi
pop esi
ret
Function at 0x457f5d
Capabilities:
Check mutex on windows

Disassembly:
push 0x5c
mov eax, 0x463cf9
call fcn.0041ce47
mov eax, dword [0x4ad398]
shr eax, 0xe
test al, 1
je 0x45808f
push 0x4ad2a8
lea ecx, [ebp - 0x58]
call fcn.00406d1d
xor ebx, ebx
lea ecx, [ebp - 0x40]
push 0x47951c
mov dword [ebp - 4], ebx
call fcn.00404bef
push 0x4794ec
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00404bef
mov byte [ebp - 4], 2
mov esi, ebx
push dword [ebp - 0x18]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x58]
push eax
call fcn.0040aa11
mov esi, eax
cmp esi, 0xffffffff
je 0x457fe6
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x58]
push esi
call fcn.00407400
add esi, dword [ebp - 0x30]
jmp 0x457faf
xor esi, esi
lea ecx, [ebp - 0x28]
push ebx
inc esi
push esi
call fcn.00401ca4
push ebx
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00401ca4
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4ad5c4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x458085
push 0x2e
push 0x29
lea eax, [ebp - 0x40]
push eax
call fcn.004571c1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0045cb34
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x68]
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.00406276
mov esi, 0x473c88
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x20]
call fcn.004062ad
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 0x482100
push eax
mov dword [ebp - 0x20], esi
call fcn.00436f56
push ebx
push esi
lea ecx, [ebp - 0x58]
call fcn.00401ca4
call fcn.0041cdf1
ret

Function at 0x4580b9
Capabilities:
Write file on windows

Disassembly:
push 0x1c
mov eax, 0x463d26
call fcn.0041ce47
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov bl, al
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
cmp byte [ebp + 8], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
mov eax, 0x401
lea ecx, [eax + 2]
cmovne eax, ecx
push eax
call fcn.004584f3
cmp dword [ebp - 0x18], 0xa
jbe 0x45812e
call fcn.00458565
mov esi, eax
test esi, esi
je 0x458130
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push ecx
call fcn.0043cba7
push esi
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.0043c824
add esp, 0x14
jmp 0x458130
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004060bd
mov al, bl
call fcn.0041cdf1
ret 4
Function at 0x458146
Capabilities:
Write file on windows

Disassembly:
push 0x1c
mov eax, 0x463d53
call fcn.0041ce47
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov bl, al
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push 0x3fa
call fcn.004584f3
call fcn.004581bc
mov esi, eax
test esi, esi
je 0x4581a8
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push ecx
call fcn.0043cba7
push esi
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
call fcn.0043c824
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004060bd
mov al, bl
call fcn.0041cdf1
ret

Function at 0x45823a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4ad398]
push esi
push edi
xor edi, edi
shr eax, 0x11
inc edi
mov dword [ebp - 4], edi
test al, 1
je 0x458269
cmp dword [0x4ad634], 0
je 0x458269
mov esi, 0x4ad624
push esi
call fcn.00458515
jmp 0x458293
and dword [0x4ad634], 0
mov esi, 0x4ad624
cmp dword [0x4ad638], 0x10
mov eax, esi
push esi
cmovae eax, dword [0x4ad624]
push 0x3fc
mov byte [eax], 0
call fcn.004584f3
call fcn.00458619
mov edx, eax
mov dword [ebp - 8], edx
test edx, edx
je 0x4582fb
cmp dword [0x4ad638], 0x10
mov eax, esi
cmovae eax, dword [0x4ad624]
mov eax, dword [eax]
cmp eax, dword [0x473d7f]
jne 0x4582ef
cmp dword [0x4ad638], 0x10
mov ecx, esi
mov eax, dword [0x4ad634]
cmovae ecx, dword [0x4ad624]
add eax, 0xfffffffc
push edx
push edi
push eax
lea eax, [ecx + 4]
push eax
call fcn.0043cba7
mov edx, dword [ebp - 8]
add esp, 0x10
dec eax
neg eax
sbb al, al
inc al
mov byte [ebp - 4], al
push edx
call fcn.0043c824
mov eax, dword [ebp - 4]
pop ecx
jmp 0x4582fd
xor al, al
and dword [0x4ad634], 0
cmp dword [0x4ad638], 0x10
pop edi
cmovae esi, dword [0x4ad624]
mov byte [esi], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45831b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x485094]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4ad2d0], 0
push edi
mov edi, 0x4ad2c0
jne 0x458466
push ebx
push esi
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x804]
push eax
call fcn.00402f31
pop ecx
push eax
lea eax, [ebp - 0x804]
mov ecx, edi
push eax
call fcn.00402eb8
cmp dword [0x4ad2d4], 8
mov eax, edi
cmovae eax, dword [0x4ad2c0]
xor ebx, ebx
push ebx
push eax
call fcn.0043c6af
pop ecx
pop ecx
test eax, eax
je 0x4583ac
mov esi, 0x472bc4
push esi
call fcn.00402f31
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00402eb8
mov ecx, edi
call fcn.0040bed9
cmp dword [0x4ad2d0], ebx
je 0x4583d1
cmp dword [0x4ad2d4], 8
mov eax, edi
push ebx
cmovae eax, dword [0x4ad2c0]
push eax
call fcn.0043c6af
pop ecx
pop ecx
test eax, eax
je 0x4583ee
push str.TEMP
call fcn.0043ce7f
mov esi, eax
push esi
call fcn.00402f31
pop ecx
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00402eb8
cmp dword [0x4ad2d0], ebx
je 0x458413
cmp dword [0x4ad2d4], 8
mov eax, edi
push ebx
cmovae eax, dword [0x4ad2c0]
push eax
call fcn.0043c6af
pop ecx
pop ecx
test eax, eax
je 0x458430
push 0x479514
call fcn.0043ce7f
mov esi, eax
push esi
call fcn.00402f31
pop ecx
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00402eb8
cmp dword [0x4ad2d0], ebx
je 0x458455
cmp dword [0x4ad2d4], 8
mov eax, edi
push ebx
cmovae eax, dword [0x4ad2c0]
push eax
call fcn.0043c6af
pop ecx
pop ecx
test eax, eax
je 0x458464
push 0xffffffffffffffff
push ebx
push 0x4ad290
mov ecx, edi
call fcn.00403198
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0041c30c
mov esp, ebp
pop ebp
ret