joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440754
Capabilities:
Read file on windows

Disassembly:
push esi
lea edx, [esp]
push 1
push edx
push dword [eax]
call fcn.004709ae
movsx eax, byte [esp + 0xc]
add esp, 0x10
ret
Function at 0x44b39c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor edx, edx
mov dword [esp], edx
mov dword [esp + 4], 1
mov byte [ebx], dl
lea eax, [esp]
push eax
push 0xf003f
push edx
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x44b3df
mov eax, 0xffffffff
add esp, 8
pop ebx
pop ebp
ret
lea edx, [esp + 4]
lea eax, [esp + 0x24]
push eax
push ebx
push edx
push 0
push ebp
push dword [esp + 0x14]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x44b406
mov eax, 0xffffffff
add esp, 8
pop ebx
pop ebp
ret
push dword [esp]
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
add esp, 8
pop ebx
pop ebp
ret
Function at 0x44da4c
Capabilities:
Create directory

Disassembly:
push edi
push esi
sub esp, 0x20c
mov ecx, eax
lea esi, [esp]
mov edi, 0x660d40
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x44da5e
lea edi, [esp]
mov edx, ecx
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x44da77
lea eax, [esp]
push 0
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
add esp, 0x20c
pop esi
pop edi
ret
Function at 0x45124c
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 8
mov dword [esp], eax
xor ecx, ecx
xor ecx, edx
cmp edx, 4
jl 0x451285
imul ebp, dword [eax], 0x5bd1e995
mov ebx, ebp
shr ebx, 0x18
xor ebp, ebx
imul esi, ebp, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 4
jge 0x45125f
cmp edx, 3
je 0x451296
cmp edx, 2
je 0x45129f
cmp edx, 1
je 0x4512a8
jmp 0x4512b3
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov edx, ecx
shr edx, 0xd
xor ecx, edx
imul edx, ecx, 0x5bd1e995
mov eax, edx
shr eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x18
mov eax, dword [ecx*4 + 0x7d1c00]
mov ecx, dword [0x8727cc]
mov dword [esp + 4], ecx
cmp eax, ecx
jge 0x45132a
mov ecx, dword [0x8727d0]
mov ebx, eax
mov ebp, edx
mov esi, dword [ecx + ebx*4]
cmp ebp, dword [esi + 4]
jne 0x451321
mov edi, dword [esi]
mov esi, dword [esp]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x451318
or dl, dl
je 0x451314
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x451318
add edi, 2
add esi, 2
or dl, dl
jne 0x4512f8
xor eax, eax
jmp 0x45131d
sbb eax, eax
or eax, 1
test eax, eax
je 0x451337
inc ebx
mov esi, dword [esp + 4]
cmp ebx, esi
jl 0x4512eb
mov eax, 0xffffffff
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, ebx
add esp, 8
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x458660
Capabilities:
Encode data using xor

Disassembly:
push edi
push ebp
sub esp, 0x48
mov edi, edx
mov ebp, eax
mov byte [esp + 0xc], 1
lea eax, [esp + 0x10]
mov edx, edi
mov ecx, 1
call fcn.0040bc29
test eax, eax
jne 0x458784
mov ebp, dword [ebp + 0x44]
mov eax, ebp
call fcn.0043b060
push 0x24
call fcn.00403564
pop ecx
mov edx, eax
mov dword [ebp + 0x108], edx
test edx, edx
je 0x458770
mov eax, dword [esp + 0x14]
mov dword [edx + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov ebp, dword [eax + 0xc]
mov dword [edx + 4], ebp
mov edi, dword [eax + 0x10]
mov dword [edx + 8], edi
mov ebp, dword [eax + 0x14]
mov dword [edx + 0xc], ebp
mov ebp, dword [eax + 0x18]
mov dword [edx + 0x10], ebp
lea ebp, [eax + 0x20]
mov dword [edx + 0x18], ebp
lea ebp, [ecx + ecx]
add ebp, ebp
lea ebp, [eax + ebp + 0x20]
mov dword [edx + 0x1c], ebp
lea ebp, [ecx + ecx]
add ebp, ebp
add ebp, ebp
lea ebp, [eax + ebp + 0x20]
mov dword [edx + 0x20], ebp
test ecx, ecx
jle 0x458768
xor eax, eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], esi
mov ecx, dword [edx + 0x1c]
lea ebx, [eax + eax]
mov ecx, dword [ecx + eax*4]
test ecx, ecx
jle 0x458728
xor ebp, ebp
mov esi, dword [edx + 0x14]
mov edi, dword [edx + 0x18]
add esi, dword [edi + ebx*2]
mov ecx, ebp
and ecx, 0xf
add ecx, 0x10
xor byte [esi + ebp], cl
mov ecx, dword [edx + 0x1c]
mov ecx, dword [ecx + ebx*2]
inc ebp
cmp ebp, ecx
jl 0x458709
mov ebp, dword [edx + 0x20]
cmp dword [ebp + ebx*2], 0
jle 0x45875b
xor ebp, ebp
jmp 0x45873c
mov ecx, dword [edx + 0x1c]
mov ecx, dword [ecx + ebx*2]
mov esi, dword [edx + 0x14]
mov edi, dword [edx + 0x18]
add esi, dword [edi + ebx*2]
add esi, ecx
mov ecx, ebp
and ecx, 0xf
add ecx, 0x10
xor byte [esi + ebp], cl
mov ecx, dword [edx + 0x20]
inc ebp
cmp ebp, dword [ecx + ebx*2]
jl 0x458736
inc eax
cmp eax, dword [edx]
jl 0x4586fa
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
xor eax, eax
add esp, 0x48
pop ebp
pop edi
ret
push 1
push 0x186aa
call fcn.0046be5c
xor eax, eax
add esp, 0x50
pop ebp
pop edi
ret
push edi
push 1
push 0x1964a
call fcn.0046bdd0
mov eax, 0xffffffff
add esp, 0x54
pop ebp
pop edi
ret
Function at 0x45a61d
Capabilities:
Enumerate files on windows

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x5c8
mov ebp, edx
mov ebx, eax
movsx ecx, cl
test ecx, ecx
je 0x45a67e
lea esi, [esp + 8]
mov edi, 0x660d40
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x45a63b
lea edi, [esp + 8]
mov edx, ebx
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x45a655
lea edi, [esp + 8]
mov edx, 0x879e74
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x45a672
jmp 0x45a6ab
lea esi, [esp + 8]
mov edi, ebx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x45a684
lea edi, [esp + 8]
mov edx, 0x879e74
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x45a6a1
lea esi, [esp + 0x408]
mov edi, 0x879448
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x45a6b7
lea edi, [esp + 0x408]
mov edx, ebp
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x45a6d4
lea ecx, [esp + 8]
lea eax, [esp + 0x488]
push eax
push ecx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x45a822
cmp byte [esp + 0x4b4], 0x2e
je 0x45a848
mov ecx, dword [esp + 0x488]
and ecx, 0x10
cmp ecx, 0x10
mov ebx, 0
sete bl
test ebx, ebx
jne 0x45a74a
movsx ecx, byte [ebp]
test ecx, ecx
je 0x45a75e
lea eax, [esp + 0x4b4]
lea edx, [esp + 0x408]
call fcn.004409e8
movsx ecx, al
test ecx, ecx
jne 0x45a75e
jmp 0x45a804
mov ecx, dword [esp + 0x5e4]
or ecx, dword [esp + 0x5e8]
je 0x45a804
lea edi, [esp + 0x4b4]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x45a777
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x45a76f
mov edi, eax
lea ecx, [edi + 2]
push ecx
call fcn.0046ed7c
mov edx, eax
mov eax, dword [0x8721d4]
mov ecx, dword [0x8721d0]
mov dword [ecx + eax*4], edx
mov edx, dword [0x8721d4]
mov eax, dword [0x8721d0]
lea ecx, [esp + 0x4b8]
push edi
push ecx
push dword [eax + edx*4]
call dword [0x5b856c]
add esp, 0x10
mov eax, dword [0x8721d4]
mov ecx, dword [0x8721d0]
mov ecx, dword [ecx + eax*4]
mov byte [edi + ecx], 0
test ebx, ebx
je 0x45a7ef
mov ebx, dword [0x8721d4]
mov ecx, dword [0x8721d0]
mov ecx, dword [ecx + ebx*4]
mov byte [edi + ecx], 0x2f
mov ebx, dword [0x8721d4]
mov ecx, dword [0x8721d0]
mov ecx, dword [ecx + ebx*4]
mov byte [edi + ecx + 1], 0
mov ecx, dword [0x8721d4]
inc ecx
mov dword [0x8721d4], ecx
cmp ecx, 0x2000
je 0x45a82f
lea ecx, [esp + 0x488]
push ecx
push esi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x45a6fc
push esi
call dword [sym.imp.kernel32.dll_FindClose]
xor eax, eax
add esp, 0x5c8
pop ebx
pop ebp
pop esi
pop edi
ret
push 0x2000
push 0x878bc4
push 0x8782b0
call fcn.00409070
add esp, 0xc
jmp 0x45a81b
movsx ecx, byte [esp + 0x4b5]
test ecx, ecx
je 0x45a804
cmp ecx, 0x2e
jne 0x45a70a
movsx ecx, byte [esp + 0x4b6]
test ecx, ecx
je 0x45a804
jmp 0x45a70a
Function at 0x45bf24
Capabilities:
Read file on windows

Disassembly:
push esi
lea edx, [esp]
push 4
push edx
push dword [eax]
call fcn.004709ae
mov eax, dword [esp + 0xc]
add esp, 0x10
ret

Function at 0x45bfe0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push esi
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
lea ecx, [esp]
push ecx
push 0xf003f
push eax
push ebx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x45c00f
mov eax, 0xffffffff
pop ecx
pop ebx
pop esi
ret
push esi
push dword [esp + 4]
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
test eax, eax
je 0x45c030
push dword [esp]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 0xffffffff
pop ecx
pop ebx
pop esi
ret
push ebx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
test eax, eax
je 0x45c052
push dword [esp]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 0xffffffff
pop ecx
pop ebx
pop esi
ret
push dword [esp]
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
pop ecx
pop ebx
pop esi
ret

Function at 0x45c068
Capabilities:
Get disk size

Disassembly:
sub esp, 0x18
xor edx, edx
mov dword [esp], edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
lea edx, [esp + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x18
ret

Function at 0x45c0b0
Capabilities:
Delete registry value

Disassembly:
push ebp
push esi
mov ebp, edx
mov edx, eax
xor eax, eax
mov dword [esp], eax
lea ecx, [esp]
push ecx
push 0xf003f
push eax
push edx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x45c0dd
mov eax, 0xffffffff
pop ecx
pop ebp
ret
push ebp
push dword [esp + 4]
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
test eax, eax
je 0x45c0fd
push dword [esp]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 0xffffffff
pop ecx
pop ebp
ret
push dword [esp]
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
pop ecx
pop ebp
ret
Function at 0x45c3d8
Capabilities:
Get common file path

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x28
mov edi, ecx
mov ebp, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov byte [esi], bl
lea ebx, [esp + 0x24]
push ebx
call dword [sym.imp.shell32.dll_SHGetMalloc]
test eax, eax
jl 0x45c4c5
mov ebx, dword [esp + 0x24]
mov eax, dword [ebx]
push 0x209
push ebx
call dword [eax + 0xc]
mov ebx, eax
test ebx, ebx
je 0x45c4c5
lea eax, [esp + 0x20]
push eax
push 0
push edi
call dword [sym.imp.shell32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x45c4ba
mov dword [esp], edi
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x4592e4
mov dword [esp + 0x18], ebp
lea edx, [esp]
push edx
call dword [sym.imp.shell32.dll_SHBrowseForFolderA]
mov ebp, eax
test ebp, ebp
je 0x45c48d
push ebx
push ebp
call dword [sym.imp.shell32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x45c482
mov edi, ebx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x45c478
mov edx, dword [esp + 0x24]
mov ecx, dword [edx]
push ebp
push edx
call dword [ecx + 0x14]
mov edx, dword [esp + 0x24]
mov ecx, dword [edx]
push dword [esp + 0x20]
push edx
call dword [ecx + 0x14]
mov edx, dword [esp + 0x24]
mov ecx, dword [edx]
push ebx
push edx
call dword [ecx + 0x14]
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
push eax
call dword [edx + 8]
xor eax, eax
add esp, 0x28
pop ebx
pop ebp
pop esi
pop edi
ret
mov edx, dword [esp + 0x24]
mov ecx, dword [edx]
push ebx
push edx
call dword [ecx + 0x14]
mov eax, 1
add esp, 0x28
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x45cdb0
Capabilities:
Get file attributes

Disassembly:
push esi
push ebp
push ebx
push esi
mov ebp, eax
cmp dword [0x8726ec], 0
je 0x45cdca
push 0x668020
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp dword [0x8722e8], 0
jbe 0x45cdff
xor ebx, ebx
mov edx, dword [0x8722ec]
mov eax, dword [edx + ebx*4]
test eax, eax
je 0x45cdef
push eax
call fcn.0046f30e
pop ecx
mov edx, dword [0x8722ec]
mov dword [edx + ebx*4], 0
inc ebx
cmp ebx, dword [0x8722e8]
jb 0x45cdd5
mov edx, dword [0x8722ec]
test edx, edx
je 0x45ce10
push edx
call fcn.0046f30e
pop ecx
xor edx, edx
mov dword [0x8722ec], edx
push edx
push edx
push 0xffffffffffffffff
push ebp
call dword [sym.imp.shell32.dll_DragQueryFileA]
mov ebx, eax
mov edx, 0x10000
cmp ebx, 0x10000
jbe 0x45ce34
mov ebx, edx
mov dword [0x8722e8], ebx
lea ecx, [ebx + ebx]
add ecx, ecx
push ecx
call fcn.0046ed7c
pop ecx
mov dword [0x8722ec], eax
test ebx, ebx
jbe 0x45ce76
xor edx, edx
mov ebx, eax
mov esi, edx
jmp 0x45ce5d
mov ebx, dword [0x8722ec]
push 0x209
call fcn.0046ed7c
pop ecx
mov dword [ebx + esi*4], eax
mov ebx, dword [0x8722e8]
inc esi
cmp esi, ebx
jb 0x45ce57
test ebx, ebx
jbe 0x45ced7
xor ebx, ebx
mov dword [esp], edi
mov eax, dword [0x8722ec]
push 0x209
push dword [eax + ebx*4]
push ebx
push ebp
call dword [sym.imp.shell32.dll_DragQueryFileA]
mov eax, dword [0x8722ec]
push dword [eax + ebx*4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
and eax, 0x10
cmp eax, 0x10
jne 0x45cecb
mov eax, dword [0x8722ec]
mov edi, dword [eax + ebx*4]
mov edx, 0x878338
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x45cec1
inc ebx
cmp ebx, dword [0x8722e8]
jb 0x45ce7f
mov edi, dword [esp]
push ebp
call dword [sym.imp.shell32.dll_DragFinish]
cmp dword [0x8726ec], 0
je 0x45cef2
push 0x668020
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop ecx
pop ebx
pop ebp
pop esi
ret
Function at 0x4644f0
Capabilities:
Read file on windows

Disassembly:
push edi
push ebx
sub esp, 0x24
mov edi, eax
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x464509
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x464501
mov ebx, eax
inc ebx
push ebx
call fcn.0046ed7c
pop ecx
mov ecx, dword [0x87253c]
mov edx, dword [0x872538]
mov dword [edx + ecx*4], eax
mov edx, dword [0x872538]
mov ecx, dword [0x87253c]
mov edx, dword [edx + ecx*4]
test edx, edx
je 0x464665
push ebx
push edi
push edx
call dword [0x5b856c]
add esp, 0xc
mov ebx, dword [0x87253c]
mov ecx, dword [0x872538]
lea eax, [esp + 8]
mov edx, dword [ecx + ebx*4]
call fcn.004646d8
movsx eax, byte [esp + 0x10]
test eax, eax
je 0x464640
lea eax, [esp + 0x20]
push 4
push eax
push dword [esp + 0x10]
call fcn.004709ae
add esp, 0xc
lea eax, [esp + 8]
call fcn.0045bf24
mov edi, eax
lea eax, [esp + 8]
call fcn.0045bf24
mov ebx, eax
lea eax, [esp + 8]
call fcn.00464768
mov edx, dword [esp + 0x20]
cmp edx, 0x465059
jne 0x4645de
cmp edi, 0x22b
je 0x4645b8
cmp edi, 0xea
jl 0x46461b
mov edx, dword [0x872540]
add edx, ebx
mov dword [0x872540], edx
cmp edx, 0x30d40
jge 0x4645ff
mov eax, dword [0x87253c]
inc eax
mov dword [0x87253c], eax
cmp eax, 0x64
jge 0x4645e6
xor eax, eax
add esp, 0x24
pop ebx
pop edi
ret
push 0x64
push 1
push 0x196c2
call fcn.0046be00
mov eax, 0xffffffff
add esp, 0x30
pop ebx
pop edi
ret
push 0x30d40
push 1
push 0x196cc
call fcn.0046be00
mov eax, 0xffffffff
add esp, 0x30
pop ebx
pop edi
ret
mov edx, dword [0x87253c]
mov eax, dword [0x872538]
push dword [eax + edx*4]
push 1
push 0x196b8
call fcn.0046be00
mov eax, 0xffffffff
add esp, 0x30
pop ebx
pop edi
ret
mov edx, dword [0x87253c]
mov eax, dword [0x872538]
push dword [eax + edx*4]
push 1
push 0xdbfb0
call fcn.0046be00
mov eax, 0xfffffffe
add esp, 0x30
pop ebx
pop edi
ret
push 1
push 0x186aa
call fcn.0046be5c
mov eax, 0xffffffff
add esp, 0x2c
pop ebx
pop edi
ret

Function at 0x464754
Capabilities:
Read file on windows

Disassembly:
push ecx
push edx
push dword [eax]
call fcn.004709ae
add esp, 0xc
ret
Function at 0x464de8
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0
push 0x878cfc
push 0x660d40
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
jne 0x464e18
mov byte [0x872270], 1
xor eax, eax
add esp, 0x20c
ret
lea eax, [esp]
push 0x80
push 0x8301
push eax
call fcn.0046f504
add esp, 0xc
cmp eax, 0xffffffff
je 0x464e4c
push eax
call fcn.0046f9da
lea eax, [esp + 4]
push eax
call fcn.0046f4da
xor eax, eax
add esp, 0x214
ret
mov byte [0x872270], 1
xor eax, eax
add esp, 0x20c
ret

Function at 0x464e65
Capabilities:
Check mutex on windows

Disassembly:
push ebx
mov ebx, eax
xor ecx, ecx
push edx
push ecx
push ecx
call dword [sym.imp.kernel32.dll_CreateMutexA]
movzx ebx, bl
mov dword [ebx*4 + 0x872958], eax
test eax, eax
je 0x464ea6
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x464ea2
push dword [ebx*4 + 0x872958]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
mov eax, 0xffffffff
pop ebx
ret

Function at 0x464eb0
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push 0x41c4a0
call fcn.00471ea6
add esp, 0xc
test eax, eax
je 0x464ed6
movsx edx, byte [0x59b734]
dec edx
push edx
push eax
call dword [sym.imp.kernel32.dll_SetThreadIdealProcessor]
ret
push 0x878dc0
push 0
call fcn.00409070
add esp, 8
ret

Function at 0x4651dd
Capabilities:
Create process on windows

Disassembly:
push esi
push ebx
sub esp, 0x3c
mov ebx, ecx
movsx esi, byte [eax]
test esi, esi
je 0x4652c4
mov esi, dword [0x579e88]
mov dword [esp + 0xc], esi
mov esi, dword [0x579e94]
mov dword [esp + 0x18], esi
mov esi, dword [0x579e9c]
mov dword [esp + 0x20], esi
mov esi, dword [0x579ea0]
mov dword [esp + 0x24], esi
mov esi, dword [0x579ea4]
mov dword [esp + 0x28], esi
mov esi, dword [0x579ea8]
mov dword [esp + 0x2c], esi
mov esi, dword [0x579eac]
mov dword [esp + 0x30], esi
mov esi, dword [0x579eb0]
mov dword [esp + 0x34], esi
mov esi, dword [0x579eb4]
mov dword [esp + 0x38], esi
mov dword [esp], 0x3c
mov dword [esp + 8], 0
mov ecx, dword [0x872728]
test ecx, ecx
je 0x465282
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 4], esi
mov esi, dword [ecx + 0x2a4]
test esi, esi
je 0x465282
mov dword [esp + 8], esi
mov dword [esp + 0x1c], 1
mov dword [esp + 4], 0x40
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lea eax, [esp]
push eax
call dword [sym.imp.shell32.dll_ShellExecuteExA]
test eax, eax
je 0x4652c4
mov eax, dword [esp + 0x20]
cmp eax, 0x20
jle 0x4652c4
movsx eax, bl
test eax, eax
je 0x4652c4
push 0xffffffffffffffff
push dword [esp + 0x3c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, 0xffffffff
add esp, 0x3c
pop ebx
pop esi
ret
Function at 0x4688f0
Capabilities:
Get system information on windows

Disassembly:
push edi
sub esp, 0x24
call fcn.00462e0c
mov byte [0x8722b8], al
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
movsx eax, byte [esp + 0x14]
mov byte [0x59b734], al
movsx edi, byte [0x59b72c]
cmp edi, eax
jg 0x46891f
mov edi, eax
movsx edx, byte [0x59b728]
cmp edx, edi
jl 0x46892c
mov edx, edi
mov byte [0x59b730], dl
push 0
call dword [sym.imp.user32.dll_GetDC]
mov edi, eax
push 8
push edi
call dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [0x872328], eax
push 0xa
push edi
call dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [0x87232c], eax
push 0xc
push edi
call dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [0x872330], eax
push 0x74
push edi
call dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [0x872334], eax
push edi
push 0
call dword [sym.imp.user32.dll_ReleaseDC]
mov eax, dword [0x872334]
cmp eax, 0x3c
jae 0x468991
mov dword [0x872334], 0xffffffff
xor eax, eax
add esp, 0x24
pop edi
ret

Function at 0x469464
Capabilities:
Delete file

Disassembly:
cmp dword [0x8726ec], 0
je 0x469478
push 0x668020
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
push 0x879cb4
push 0x660c20
push 0x879cc4
push 0x5ce240
call fcn.0046f488
add esp, 0x10
push 0x5ce240
call dword [sym.imp.kernel32.dll_DeleteFileA]
cmp dword [0x8726ec], 0
je 0x4694b3
push 0x668020
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
ret

Function at 0x46a30c
Capabilities:
Create thread

Disassembly:
movsx eax, byte [0x8722a0]
test eax, eax
je 0x46a328
xor eax, eax
push eax
push eax
push 0x420a04
call fcn.00471ea6
add esp, 0xc
ret
Function at 0x46a32c
Capabilities:
Create thread

Disassembly:
push edi
push esi
push ebx
push esi
movsx edx, byte [0x59b730]
test edx, edx
jle 0x46a3c7
xor eax, eax
xor ecx, ecx
xor edx, edx
mov edi, eax
mov ebx, edx
mov esi, ecx
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [esi*4 + 0x7db620], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [ebx + 0x7db720], eax
xor eax, eax
push eax
push 1
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [ebx + 0x7db820], eax
cmp dword [esi*4 + 0x7db620], 0
je 0x46a48d
cmp dword [esi*4 + 0x7db720], 0
je 0x46a47d
cmp dword [esi*4 + 0x7db820], 0
je 0x46a46d
add ebx, 4
inc esi
movsx edx, byte [0x59b730]
cmp esi, edx
jl 0x46a34b
mov eax, edi
cmp eax, 1
je 0x46a455
test edx, edx
jle 0x46a451
xor eax, eax
xor ecx, ecx
xor edx, edx
mov ebx, eax
mov esi, edx
mov edi, ecx
mov dword [esi + 0x7d9d20], edi
xor ecx, ecx
lea edx, [esi + 0x7d9d20]
lea eax, [esp]
push eax
push ecx
push edx
push 0x41f55c
push ecx
push ecx
call fcn.00472145
add esp, 0x18
mov dword [edi*4 + 0x7d9c20], eax
push edi
push eax
call dword [sym.imp.kernel32.dll_SetThreadIdealProcessor]
cmp dword [edi*4 + 0x7d9c20], 0
jne 0x46a41c
mov ebx, 1
add esi, 0x64
inc edi
movsx eax, byte [0x59b730]
cmp edi, eax
jl 0x46a3db
mov eax, ebx
cmp eax, 1
je 0x46a439
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
ret
push 0x8792a4
push 0
call fcn.00409070
mov eax, 0xffffffff
add esp, 0xc
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x46a42d
push 0x879278
push 0
call fcn.00409070
mov eax, 0xffffffff
add esp, 0xc
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, 1
jmp 0x46a3ad
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, 1
jmp 0x46a39f
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, 1
jmp 0x46a391

Function at 0x46b798
Capabilities:
Create thread

Disassembly:
push esi
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [0x8727b8], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [0x8727bc], eax
xor eax, eax
push eax
push 1
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [0x8727c0], eax
xor edx, edx
lea eax, [esp]
push eax
push edx
push 0x7d17e0
push 0x41b69c
push edx
push edx
call fcn.00472145
add esp, 0x18
mov dword [0x8727b4], eax
pop ecx
ret

Function at 0x46b808
Capabilities:
Create thread

Disassembly:
push esi
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [0x872780], eax
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [0x872784], eax
xor edx, edx
mov eax, 1
push edx
push eax
push eax
push edx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [0x872788], eax
xor edx, edx
lea eax, [esp]
push eax
push edx
push 0x7ce0e0
push 0x4186e4
push edx
push edx
call fcn.00472145
add esp, 0x18
mov dword [0x87277c], eax
pop ecx
ret