joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4426e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x465968]
cmp byte [eax + 0xc], 0
je 0x44284d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x442846
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46ac58], 0
jne 0x442734
push 0x442854
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44285c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac58], eax
cmp dword [0x464594], 0
jne 0x44282f
push 0x44286c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x464594], eax
cmp dword [0x464594], 0
je 0x44282f
push 0x442878
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac5c], eax
push 0x442888
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac60], eax
push 0x44289c
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac64], eax
push 0x4428b4
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac68], eax
push 0x4428cc
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac6c], eax
push 0x4428e0
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac70], eax
push 0x4428f8
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac74], eax
push 0x442910
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac78], eax
push 0x44292c
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac7c], eax
push 0x442938
mov eax, dword [0x464594]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x46ac80], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44284d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x447cf8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp + 1], cl
mov byte [esp], dl
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
mov eax, dword [0x46ac90]
cmp esi, dword [eax + 0x30]
jne 0x447d1f
or edi, 0x8000000
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x447d4e
mov eax, dword [0x46ac90]
cmp esi, dword [eax + 0x30]
jne 0x447d4a
mov eax, dword [0x46ac90]
cmp byte [eax + 0x5b], 0
jne 0x447d4e
xor eax, eax
jmp 0x447d50
mov al, 1
mov byte [esp + 2], al
movzx eax, byte [esp + 2]
or al, bl
je 0x447d65
push 0
push esi
call sub.user32.dll_ShowWindow
cmp byte [esp], 0
je 0x447d7c
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x447d8b
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
movzx eax, byte [esp + 1]
and al, byte [esp + 2]
jne 0x447d9a
test bl, bl
je 0x447db0
test bl, bl
je 0x447da8
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x447db0
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x448054
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x44807a
mov eax, esp
push eax
push 0x44801c
call sub.user32.dll_EnumWindows
jmp 0x44808d
mov eax, esp
push eax
push 0x447ffc
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x448118
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x44816c]
test si, 4
je 0x44812d
or bl, 1
test si, 8
je 0x448137
or bl, 4
test si, 1
je 0x448141
or bl, 8
test si, 2
je 0x44814b
or bl, 0x10
test si, 0x10
je 0x448155
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x448164
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x448170
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4481ac]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44818a
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x448199
or bl, 4
test esi, 0x20000000
je 0x4481a4
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x450078
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45008a
add esp, 0xfffffff0
call fcn.004043ec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b054
mov eax, dword [0x465530]
mov dword [eax + 4], ebx
mov dword [eax], 0x45041c
mov eax, dword [0x46553c]
mov dword [eax + 4], ebx
mov dword [eax], 0x450428
mov eax, ebx
call fcn.00450434
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412e04]
call fcn.004040b0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412e04]
call fcn.004040b0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412e04]
call fcn.004040b0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412e04]
call fcn.004040b0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412e04]
call fcn.004040b0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44bae4
push eax
push 0
push 0
mov eax, dword [0x4656f0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41ebdc]
call fcn.004200fc
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41ebdc]
call fcn.004200fc
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41ebdc]
call fcn.004200fc
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00450864
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x450734
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x450734
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x450734
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4501c7
call fcn.00404444
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x450518
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4506c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4506a4
mov dl, 1
mov eax, dword [0x413228]
call fcn.004040b0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404ef4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x450693
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00442a3c
test al, al
je 0x450686
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4506d4
lea eax, [ebp - 0x254]
call fcn.00409e90
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x450686
xor eax, eax
push ebp
push 0x45067f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45070c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x450668
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405164
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x450668
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405164
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450686
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x450589
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00416f00
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4506ca
lea eax, [ebp - 0x260]
call fcn.00404ef4
ret

Function at 0x45103c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x46ac90]
cmp byte [eax + 0xad], 0
jne 0x4510ad
cmp dword [0x46acac], 0
jne 0x45106e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x450ff8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x46acac], eax
cmp dword [0x46aca8], 0
jne 0x451089
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x46aca8], eax
cmp dword [0x46acb0], 0
jne 0x4510ad
push esp
push 0
push 0
push 0x450f9c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x46acb0], eax
pop edx
ret
Function at 0x451280
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x451297
add esp, 0xfffffff0
call fcn.004043ec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b054
mov eax, dword [0x4656d4]
cmp word [eax + 2], 0
jne 0x4512bf
mov eax, dword [0x4656d4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00452e80
mov eax, dword [0x4657b4]
cmp word [eax + 2], 0
jne 0x4512d9
mov eax, dword [0x4657b4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045308c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412e04]
call fcn.004040b0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412e04]
call fcn.004040b0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x412e04]
call fcn.004040b0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41f3b8]
call fcn.00425200
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x451490
mov eax, dword [0x4655bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004255d4
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x453750
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4655bc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040da20
test eax, eax
je 0x4513e0
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409498
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040da54
test eax, eax
je 0x4513f4
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00405164
mov byte [ebx + 0xd4], 0
push ebx
push 0x4529a8
call fcn.0041c1d0
mov dword [ebx + 0xc8], eax
mov eax, dword [0x465450]
cmp byte [eax], 0
jne 0x451445
mov eax, ebx
call fcn.004515d4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00453928
mov eax, ebx
call fcn.0045448c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x451485
call fcn.00404444
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451854
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4518f3
cmp dword [ebx + 0x94], 0
jne 0x4518ed
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4517dc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4518ed
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4518b3
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4518ed
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004151a8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4518c2
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x451b0c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x46ac90]
cmp dword [eax + 0x30], 0
je 0x451c69
test bl, bl
jne 0x451bba
cmp dword [esi + 0x9c], 0
jne 0x451baf
mov eax, esi
call fcn.00454308
push eax
push 0x451a38
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x451b80
mov eax, dword [0x46ac90]
call fcn.004548f8
test al, al
je 0x451b80
mov eax, dword [0x46acb4]
call fcn.00405db0
mov edi, eax
cmp edi, 0
jl 0x451b80
push 0
mov eax, dword [0x46acb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x451b6a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x451baf
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004151a8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x451b8f
inc dword [esi + 0x9c]
jmp 0x451c69
cmp dword [esi + 0x9c], 0
jle 0x451c69
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x451c69
cmp dword [esi + 0x44], 0
je 0x451c15
mov eax, dword [0x46ac90]
call fcn.004548f8
test al, al
je 0x451c15
mov eax, dword [0x46acb4]
call fcn.00405db0
mov edi, eax
cmp edi, 0
jl 0x451c15
push 5
mov eax, dword [0x46acb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x451bff
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x451c44
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004151a8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x451c24
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x46acb4
mov ecx, 1
mov edx, dword [0x451a18]
call fcn.00405f64
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4526fc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x452766
mov eax, ebx
call fcn.004548f8
test al, al
jne 0x452766
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404fe4
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x452753
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x452773
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404f48
jmp 0x452773
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404f48
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x453b0c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x453b7a
mov eax, esi
call fcn.0043d8fc
test al, al
je 0x453b7a
mov eax, dword [ebx + 0x84]
call fcn.0043d5f0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x453b7a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x453b6e
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d5f0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004357ac
jmp 0x453b7a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00453948
pop esi
pop ebx
ret
Function at 0x460dcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff15c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xea4], edx
mov dword [ebp - 0xe98], edx
mov dword [ebp - 0xe9c], edx
mov dword [ebp - 0xea0], edx
mov dword [ebp - 0xe8c], edx
mov dword [ebp - 0xe90], edx
mov dword [ebp - 0xe94], edx
mov dword [ebp - 0xe7c], edx
mov dword [ebp - 0xe80], edx
mov dword [ebp - 0xe84], edx
mov esi, eax
lea edi, [ebp - 0xe76]
mov ecx, 0x39b
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
push ebp
push 0x461064
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x46102c
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xe80]
mov eax, 1
call fcn.00461320
push dword [ebp - 0xe80]
push 0x46107c
lea eax, [ebp - 0xe84]
lea edx, [ebp - 0xdad]
mov ecx, 0xc9
call fcn.00405164
push dword [ebp - 0xe84]
lea eax, [ebp - 0xe7c]
mov edx, 3
call fcn.00405288
mov ebx, dword [ebp - 0xe7c]
mov dword [ebp - 0xe88], ebx
mov eax, dword [ebp - 0xe88]
call fcn.00405384
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea edx, [ebp - 0xe90]
mov eax, 1
call fcn.00461320
push dword [ebp - 0xe90]
push 0x46107c
lea eax, [ebp - 0xe94]
lea edx, [ebp - 0xdad]
mov ecx, 0xc9
call fcn.00405164
push dword [ebp - 0xe94]
lea eax, [ebp - 0xe8c]
mov edx, 3
call fcn.00405288
mov eax, dword [ebp - 0xe8c]
call fcn.00409254
test al, al
jne 0x461022
lea edx, [ebp - 0xe9c]
mov eax, 1
call fcn.00461320
push dword [ebp - 0xe9c]
push 0x46107c
lea eax, [ebp - 0xea0]
lea edx, [ebp - 0xdad]
mov ecx, 0xc9
call fcn.00405164
push dword [ebp - 0xea0]
lea eax, [ebp - 0xe98]
mov edx, 3
call fcn.00405288
mov ebx, dword [ebp - 0xe98]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov dword [ebp - 0xe88], ebx
mov eax, dword [ebp - 0xe88]
call fcn.00405384
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
lea edx, [ebp - 0xea4]
xor eax, eax
call fcn.00403288
mov eax, dword [ebp - 0xea4]
mov edx, 0x40
call fcn.00409148
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc1b]
inc eax
call fcn.00402e90
mov esi, eax
xor ecx, ecx
mov edx, dword [ebp - 0xc17]
mov eax, dword [ebp - 4]
call fcn.004091f8
mov edx, esi
mov ecx, dword [ebp - 0xc1b]
mov eax, dword [ebp - 4]
call fcn.004091a0
mov ebx, dword [ebp - 0xc1b]
dec ebx
test ebx, ebx
jb 0x460ff9
inc ebx
xor ecx, ecx
mov eax, ecx
mov edi, 0x3e8
xor edx, edx
div edi
movzx eax, byte [ebp + edx - 0xc13]
mov edx, esi
add edx, ecx
sub byte [edx], al
inc ecx
dec ebx
jne 0x460fdc
mov edx, esi
mov ecx, dword [ebp - 0xc1b]
mov eax, dword [ebp - 8]
call fcn.004091cc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
call fcn.00402eac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x461036
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46106b
lea eax, [ebp - 0xea4]
mov edx, 7
call fcn.00404f18
lea eax, [ebp - 0xe84]
mov edx, 3
call fcn.00404f18
ret
Function at 0x461080
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1d5
push 0
push 0
dec ecx
jne 0x461088
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xe76]
mov ecx, 0x39b
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
push ebp
push 0x461306
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4612ce
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xe80]
mov eax, 2
call fcn.00461320
push dword [ebp - 0xe80]
push 0x46131c
lea eax, [ebp - 0xe84]
lea edx, [ebp - 0xce4]
mov ecx, 0xc9
call fcn.00405164
push dword [ebp - 0xe84]
lea eax, [ebp - 0xe7c]
mov edx, 3
call fcn.00405288
mov ebx, dword [ebp - 0xe7c]
mov dword [ebp - 0xe88], ebx
mov eax, dword [ebp - 0xe88]
call fcn.00405384
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea edx, [ebp - 0xe90]
mov eax, 2
call fcn.00461320
push dword [ebp - 0xe90]
push 0x46131c
lea eax, [ebp - 0xe94]
lea edx, [ebp - 0xce4]
mov ecx, 0xc9
call fcn.00405164
push dword [ebp - 0xe94]
lea eax, [ebp - 0xe8c]
mov edx, 3
call fcn.00405288
mov eax, dword [ebp - 0xe8c]
call fcn.00409254
test al, al
jne 0x46129e
lea edx, [ebp - 0xe9c]
mov eax, 2
call fcn.00461320
push dword [ebp - 0xe9c]
push 0x46131c
lea eax, [ebp - 0xea0]
lea edx, [ebp - 0xce4]
mov ecx, 0xc9
call fcn.00405164
push dword [ebp - 0xea0]
lea eax, [ebp - 0xe98]
mov edx, 3
call fcn.00405288
mov ebx, dword [ebp - 0xe98]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov dword [ebp - 0xe88], ebx
mov eax, dword [ebp - 0xe88]
call fcn.00405384
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
lea edx, [ebp - 0xea4]
xor eax, eax
call fcn.00403288
mov eax, dword [ebp - 0xea4]
mov edx, 0x40
call fcn.00409148
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x812]
inc eax
call fcn.00402e90
mov esi, eax
xor ecx, ecx
mov edx, dword [ebp - 0x80e]
mov eax, dword [ebp - 4]
call fcn.004091f8
mov edx, esi
mov ecx, dword [ebp - 0x812]
mov eax, dword [ebp - 4]
call fcn.004091a0
mov ebx, dword [ebp - 0x812]
dec ebx
test ebx, ebx
jb 0x461275
inc ebx
xor ecx, ecx
mov eax, ecx
mov edi, 0x3e8
xor edx, edx
div edi
movzx eax, byte [ebp + edx - 0x80a]
mov edx, esi
add edx, ecx
sub byte [edx], al
inc ecx
dec ebx
jne 0x461258
mov edx, esi
mov ecx, dword [ebp - 0x812]
mov eax, dword [ebp - 8]
call fcn.004091cc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
call fcn.00402eac
lea eax, [ebp - 0xea8]
lea edx, [ebp - 0xce4]
mov ecx, 0xc9
call fcn.00405164
mov eax, dword [ebp - 0xea8]
mov edx, 2
call fcn.00409278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4612d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46130d
lea eax, [ebp - 0xea8]
mov edx, 8
call fcn.00404f18
lea eax, [ebp - 0xe84]
mov edx, 3
call fcn.00404f18
ret
Function at 0x461320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor ecx, ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4613c6
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 1
jne 0x461369
lea edx, [ebp - 0x104]
xor eax, eax
call fcn.00403288
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00409328
jmp 0x4613a8
cmp eax, 2
jne 0x46138e
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x100]
call fcn.00409684
jmp 0x4613a8
lea edx, [ebp - 0x108]
xor eax, eax
call fcn.00403288
mov eax, dword [ebp - 0x108]
mov edx, ebx
call fcn.00409328
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4613cd
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.00404f18
ret