joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447834
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4478d2
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x447896
cmp byte [ebx + 0x10], 0
jne 0x447896
cmp byte [ebx + 0x3c], 0
jne 0x447896
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4478b7
lea edx, [ebp - 4]
mov eax, dword [0x4ba698]
call fcn.0040a810
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x439958]
call fcn.004220f0
call fcn.004061b8
jmp 0x4478b7
lea edx, [ebp - 8]
mov eax, dword [0x4ba698]
call fcn.0040a810
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x439958]
call fcn.004220f0
call fcn.004061b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4478d9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x447bf0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x447c3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0044776c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447c57
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x447c60
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0044776c
dec esi
jne 0x447c82
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x44d588
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x44d624
push 0
mov eax, ebx
call fcn.00407984
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x44d5ff
mov ebx, esi
test ebx, ebx
je 0x44d5d1
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00407984
push eax
push 1
push 0
mov eax, edi
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x44d61a
mov ecx, dword [0x4ba4c8]
mov dl, 1
mov eax, dword [0x44b9f0]
call fcn.004221ac
call fcn.004061b8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x456ebc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x456f92
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x456f65
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x456f16
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00407a80
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041b9b8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004072e0
jmp 0x456f25
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040763c
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x456f36
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x456f58
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4b8e3c]
inc ecx
dec edx
jne 0x456f3f
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456f6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456f99
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406c00
lea eax, [ebp - 4]
call fcn.00406b64
ret

Function at 0x456fa4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4570c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x457097
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x45700f
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00407a80
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041b9b8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004072e0
jmp 0x45701e
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040763c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x457038
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x457081
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00408778
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4b9244]
mov eax, dword [eax*8 + 0x4b9240]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x457043
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4570a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4570cb
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406c00
lea eax, [ebp - 4]
call fcn.00406b64
ret
Function at 0x45a378
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406c24
mov eax, dword [ebp - 8]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45a48b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x4ba3cc]
cmp byte [eax], 0
je 0x45a3de
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a3cb
mov ebx, pe_nt_image_headers32
jmp 0x45a3de
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a3de
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x45a470
cmp dword [ebp - 8], 0
jne 0x45a439
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x45a461
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a492
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x45a4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00406c24
mov eax, dword [ebp - 8]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45a5e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x4ba3cc]
cmp byte [eax], 0
je 0x45a516
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a503
mov ebx, pe_nt_image_headers32
jmp 0x45a516
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a516
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x45a5c5
cmp dword [ebp - 8], 0
jne 0x45a547
xor ebx, ebx
jmp 0x45a551
mov eax, dword [ebp - 8]
call fcn.00407984
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45a5bc
mov eax, dword [ebp - 0x20]
call fcn.004044f0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45a5b4
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x45a5aa
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x45a5bc
mov eax, dword [ebp - 0x1c]
call fcn.0040450c
jmp 0x45a5bc
mov eax, dword [ebp - 0x1c]
call fcn.0040450c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a5e7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x45a8c8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x4ba3cc]
cmp byte [eax], 0
je 0x45a90d
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a8fa
mov ebx, pe_nt_image_headers32
jmp 0x45a90d
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a90d
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.00407984
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x45a957
mov eax, ebp
call fcn.00407984
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45a964
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x4ba3cc]
cmp byte [eax], 0
jne 0x45a996
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x45aa17
xor eax, eax
push ebp
push 0x45a9f9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4ba3cc]
cmp byte [eax], 0
je 0x45a9d8
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a9c5
mov ebx, pe_nt_image_headers32
jmp 0x45a9d8
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a9d8
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45aa17
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x45ab34
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45ad24
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x45ad40
call fcn.00407efc
test eax, eax
je 0x45ad01
cmp byte [ebp - 0x11], 0
je 0x45acf4
xor edx, edx
push ebp
push 0x45acea
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x4ba3cc]
cmp byte [eax], 0
je 0x45abc2
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45abaf
mov esi, pe_nt_image_headers32
jmp 0x45abc2
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45abc2
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.00407984
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x45acd9
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x45acb8
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x45acb8
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x45acb8
mov eax, dword [0x4b9aa8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00407b08
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004070f4
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x45acae
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00407b08
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00423210
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00407be0
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0045ab34
test al, al
jne 0x45acae
call fcn.004062ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45ad01
dec esi
cmp esi, 0xffffffff
jne 0x45ac32
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ace0
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407b08
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0045aa20
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad2b
lea eax, [ebp - 0x24]
call fcn.00406b40
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x45c398
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45c52c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x45c4ff
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0045b1f4
cmp al, 9
jb 0x45c477
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00407b08
xor edx, edx
push ebp
push 0x45c470
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x45c458
mov eax, dword [ebp - 4]
call fcn.00407984
mov edx, dword [ebp - 8]
call fcn.0041da14
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c42a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45c446
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00423210
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00406f20
call fcn.004062ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c509
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c477
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407b08
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4ba554]
mov eax, dword [eax]
mov ecx, 0x45c548
mov edx, 0x45c564
call fcn.0045a6dc
test al, al
je 0x45c4f5
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0045c144
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00406f20
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c4c3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45c4f5
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c4d8
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45c4f5
mov eax, dword [ebp - 8]
mov edx, 0x45c5f4
call fcn.00407b88
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c509
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c533
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 4]
call fcn.00406b40
ret
Function at 0x462348
Capabilities:
Delete file
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x462393
lea eax, [esp + 0x105]
push eax
push 0
push 0x4623c4
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x462393
lea eax, [esp + 0x105]
call fcn.00407044
cmp ebx, eax
setg al
jmp 0x462395
xor eax, eax
mov ebx, eax
test bl, bl
je 0x4623af
lea edx, [esp + 0x105]
mov eax, esi
call fcn.0041d718
push esi
call sub.kernel32.dll_DeleteFileA
movzx eax, bl
mov edx, dword [0x4ba420]
mov eax, dword [edx + eax*4]
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x462d90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x462d99
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x462f16
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
inc dword [ebx + 0x18]
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00462c10
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040763c
lea eax, [ebx + 0x22]
mov edx, dword [ebp - 4]
call fcn.0041d7f8
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 0x14]
mov eax, esi
call fcn.00462a70
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040763c
lea eax, [ebx + 0x122]
mov edx, dword [ebp - 4]
call fcn.0041d7f8
lea ecx, [ebp - 0x18]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00462b54
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040763c
lea eax, [ebx + 0x222]
mov edx, dword [ebp - 4]
call fcn.0041d7f8
cmp word [esi + 0x4a], 0
je 0x462e56
push edi
lea eax, [ebp - 9]
push eax
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x4c]
call dword [esi + 0x48]
cmp byte [ebp - 9], 0
jne 0x462ec7
lea eax, [ebp - 8]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00407a18
mov eax, dword [ebp - 8]
call fcn.0041cce0
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00407a18
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x122]
mov ecx, pe_nt_image_headers32
call fcn.00407a18
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 8]
mov edx, 1
call fcn.00461c30
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
mov dword [esi + 0x3ac], eax
xor eax, eax
mov dword [esi + 0x3b0], eax
movzx ebx, byte [ebp - 9]
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462f1d
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00406ba0
lea eax, [ebp - 8]
call fcn.00406b40
lea eax, [ebp - 4]
call fcn.00406b64
ret
Function at 0x46509c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
xor ebx, ebx
mov eax, dword [0x4ba814]
cmp dword [eax], 2
je 0x4650bd
lea eax, [esi + 4]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
mov bl, 1
jmp 0x465101
cmp edi, 0xffffffff
jne 0x4650cf
lea eax, [esi + 4]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
mov bl, 1
jmp 0x465101
call sub.kernel32.dll_GetTickCount_1
mov ebp, eax
lea eax, [esi + 4]
push eax
call sub.kernel32.dll_TryEnterCriticalSection
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x465101
push 0xa
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WaitForSingleObject
call sub.kernel32.dll_GetTickCount_1
sub eax, ebp
cmp edi, eax
jae 0x4650d6
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4653f4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406c24
xor eax, eax
push ebp
push 0x46563b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00406f20
mov byte [ebp - 0xd], 0
test ebx, ebx
je 0x465613
cmp dword [0x4b9b60], 0
jne 0x465459
call fcn.004664a0
cmp dword [0x4b9b60], 0
je 0x465613
xor eax, eax
push ebp
push 0x465609
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4655f8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x46565c
call fcn.00406f68
mov edx, dword [ebp - 4]
mov eax, 0x465674
call fcn.00407efc
mov esi, eax
test esi, esi
jle 0x4654b8
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407d50
lea eax, [ebp - 4]
mov ecx, esi
mov edx, 1
call fcn.00407d98
cmp dword [ebp - 4], 0
jne 0x4654d8
mov dl, 1
mov eax, ebx
call fcn.00456ebc
xor edx, edx
push edx
push eax
lea edx, [ebp - 4]
mov eax, 8
call fcn.0041c3f8
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x4b9b60]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0045dcd0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00406f20
mov eax, dword [0x4b9b60]
cmp byte [eax + 0x13], 0
je 0x465545
push 0x465684
push dword [ebp - 4]
push 0x4656a8
push ebx
push 0x4656a8
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00407c68
mov eax, dword [ebp - 0x1c]
call fcn.00407984
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x465592
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00406f20
mov eax, dword [0x4b9b60]
cmp byte [eax + 0x11], 0
je 0x46557c
push dword [ebp - 4]
push 0x4656bc
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00407c68
mov byte [ebp - 0xd], 0
call fcn.004062ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465613
mov byte [ebp - 0xd], 1
mov eax, dword [0x4b9b60]
cmp byte [eax + 0x11], 0
je 0x4655bb
push dword [ebp - 4]
push 0x4656cc
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00407c68
lea eax, [ebp - 8]
call fcn.00406b40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4655ff
mov eax, dword [0x4b9b60]
cmp dword [eax + 0x18], 0
je 0x4655f7
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ebx, dword [0x4b9b60]
call dword [ebx + 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00406f20
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465642
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406ba0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret