joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cc09
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
push 0x22
pop eax
cmp word [edi], ax
jne 0x45cc26
add edi, 2
push eax
lea eax, [edi + 2]
push eax
jmp 0x45cc29
push 0x20
push edi
call fcn.0062c757
mov esi, eax
xor ebx, ebx
mov ebp, ebx
pop ecx
pop ecx
test esi, esi
je 0x45cc45
movzx ebp, word [esi]
xor ecx, ecx
mov word [esi], cx
add esi, 2
push edi
call fcn.00455ae5
test al, al
jne 0x45cc57
push 2
pop eax
jmp 0x45cce6
push 0x3c
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0062e010
add esp, 0xc
mov dword [esp + 0x20], edi
xor edi, edi
mov dword [esp + 0x10], 0x3c
lea eax, [esp + 0x10]
mov dword [esp + 0x24], esi
inc edi
mov dword [esp + 0x14], 0x540
push eax
mov dword [esp + 0x30], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
jne 0x45ccdc
cmp dword [esp + 0x48], ebx
je 0x45ccdc
push 0x493e0
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x45ccc7
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x45ccd2
mov ebx, dword [esp + 0x50]
jmp 0x45ccd2
mov ecx, 0x102
cmp eax, ecx
jne 0x45ccd2
mov ebx, ecx
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x45cce4
mov word [esi - 2], bp
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4

Function at 0x45d180
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x45d18e
sub edi, ecx
sar edi, 1
lea eax, [edi + 1]
test eax, eax
js 0x45d1b4
lea eax, [edi*2 + 2]
call fcn.00629c40
mov esi, esp
jmp 0x45d1c5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [0x77114c], eax
mov dword [0], esi
lea eax, [edi*2 + 2]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
push esi
call fcn.0062bfc0
add esp, 0xc
push 0x5c
pop edx
cmp word [esi], dx
jne 0x45d1fa
cmp word [esi + 2], dx
jne 0x45d1fa
cmp word [esi + 4], 0x3f
jne 0x45d25f
cmp word [esi + 6], dx
jne 0x45d25f
add esi, 8
cmp edi, 3
jl 0x45d209
cmp word [esi + 2], 0x3a
jne 0x45d209
add esi, 6
push edx
push esi
call fcn.00476c1f
mov esi, eax
test esi, esi
je 0x45d252
mov edi, dword [ebp - 4]
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x45d234
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x45d27a
push 0x5c
xor ecx, ecx
pop eax
mov word [esi - 2], ax
cmp word [esi], cx
je 0x45d252
push eax
lea eax, [esi + 2]
push eax
call fcn.00476c1f
mov esi, eax
test esi, esi
jne 0x45d219
mov al, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 2
pop ecx
add esi, 4
movzx eax, word [esi]
add esi, 2
cmp ax, dx
jne 0x45d275
sub ecx, 1
je 0x45d209
test ax, ax
jne 0x45d265
xor al, al
jmp 0x45d254
Function at 0x45d8f8
Capabilities:
Get common file path

Disassembly:
mov eax, 0x67f2c1
call fcn.0062921c
push ecx
xor edx, edx
mov dword [ebp - 0x10], edx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], edx
jb 0x45d921
mov eax, dword [esi]
jmp 0x45d923
mov eax, esi
xor ecx, ecx
push ebx
mov word [eax], cx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push edx
push edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 1
call ebx
mov edi, eax
test edi, edi
je 0x45d9a0
push 0
push edi
mov ecx, esi
call fcn.0043b1ae
cmp dword [esi + 0x14], 8
jb 0x45d957
mov eax, dword [esi]
jmp 0x45d959
mov eax, esi
push eax
push edi
call ebx
test eax, eax
jne 0x45d977
and dword [esi + 0x10], eax
cmp dword [esi + 0x14], 8
jb 0x45d96e
mov eax, dword [esi]
jmp 0x45d970
mov eax, esi
xor ecx, ecx
mov word [eax], cx
jmp 0x45d9a0
cmp dword [esi + 0x14], 8
jb 0x45d981
mov ecx, dword [esi]
jmp 0x45d983
mov ecx, esi
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x45d988
sub ecx, edx
sar ecx, 1
push ebx
push ecx
mov ecx, esi
call fcn.0043b1ae
xor eax, eax
pop ebx
cmp dword [esi + 0x10], eax
jne 0x45d9bd
mov edi, 0x699c50
push edi
call fcn.00423ad9
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004340c0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x45de26
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push ebx
push esi
push edi
mov ebx, 0x104
or esi, 0xffffffff
push ebx
push eax
push dword [ebp + 8]
mov edi, SysReAllocString
call fcn.0046c431
test al, al
je 0x45dece
push ebx
xor ebx, ebx
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x45dece
push str.FATE
lea eax, [ebp - 0x208]
push eax
call fcn.00478730
test al, al
jne 0x45dece
push str.FAT32
lea eax, [ebp - 0x208]
push eax
call fcn.00478730
test al, al
jne 0x45decc
push 0x69a53c
lea eax, [ebp - 0x208]
push eax
call fcn.00478730
test al, al
jne 0x45dec7
push str.FAT16
lea eax, [ebp - 0x208]
push eax
call fcn.00478730
test al, al
je 0x45dece
mov esi, 0x7ffa8000
mov edi, ebx
push dword [ebp + 8]
push edi
push esi
push str.GetMaxFileSize___returning__Ld_for___s_
call fcn.00409944
add esp, 0x10
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45e2c2
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
lea eax, [ebp - 0x438]
push ebx
push esi
push 0x21c
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov esi, eax
call fcn.00470daf
xor ebx, ebx
test al, al
je 0x45e32e
mov ecx, str.Sysnative..explorer.exe
lea eax, [esi + esi]
sub eax, ecx
lea edx, [ebp - 0x438]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x45e2fe
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
test ecx, ecx
je 0x45e36c
mov ecx, 0x69a68c
lea eax, [esi + esi]
sub eax, ecx
lea edx, [ebp - 0x438]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x45e340
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
xor ecx, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45e58b
Capabilities:
Get disk information

Disassembly:
mov eax, 0x67225d
call fcn.0062921c
sub esp, 0x2c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push 0x104
push 0
push eax
call fcn.0043be56
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x45e5bb
lea eax, [ebp - 0x38]
push ebx
push 0xa
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.0046c431
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 2
lea ecx, [ebp - 0x38]
push 0
push 1
sete bl
call fcn.0042386b
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x45e66c
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
push str.ReplaceFileW
xor ebx, ebx
push 0x68e74c
mov esi, ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x45e72b
push dword [0x76d730]
call fcn.0063ccee
call fcn.0063cccd
push eax
push dword [ebp + 0xc]
mov esi, 0x104
lea eax, [ebp - 0x208]
push str._s._u.tmp
push esi
push eax
call fcn.0045fc27
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push str._s.new
push esi
push eax
call fcn.0045fc27
add esp, 0x28
lea eax, [ebp - 0x410]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push ebx
push ebx
push 2
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 0xc]
call edi
mov esi, eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x45e72b
push 4
push ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
pop edi
test esi, esi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45e9f0
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push dword [esp + 0x220]
xor ebx, ebx
mov esi, ebx
call fcn.00455ae5
movzx ebp, al
test al, al
mov eax, 0x68eb70
je 0x45ea1a
mov eax, str..new
push eax
push dword [esp + 0x224]
lea eax, [esp + 0x1c]
push 0x68f8c4
push 0x104
push eax
call fcn.0045fc27
add esp, 0x14
lea eax, [esp + 0x14]
push 0x80
push 7
push eax
call fcn.0045c90d
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x45ea57
xor al, al
jmp 0x45eac8
push dword [esp + 0x228]
push dword [esp + 0x228]
push eax
call fcn.0045cd94
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
call fcn.0045c89d
test ebp, ebp
je 0x45eab5
push dword [esp + 0x220]
lea eax, [esp + 0x18]
push eax
call fcn.0045e66c
movzx esi, al
test al, al
jne 0x45eab5
push ebx
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x228]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov esi, eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [esp + 0x10], ebx
jne 0x45eac6
test esi, esi
jne 0x45eac3
test ebp, ebp
jne 0x45eac6
xor ebx, ebx
inc ebx
mov al, bl
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc

Function at 0x45eb6d
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x45eb7d
xor al, al
jmp 0x45ebd9
mov eax, dword [esp + 8]
push ebx
push esi
push edi
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push dword [esp + 0x14]
xor ecx, ecx
push eax
mov word [esi + eax], cx
call fcn.0062bfc0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov al, bl
pop ebx
ret 8

Function at 0x45f04b
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0x10
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
test eax, eax
jne 0x45f08c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_get_computer_name____d__d
call fcn.004771df
add esp, 0xc
push 0x69a6c8
jmp 0x45f090
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00424ff1
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x45f5f0
Capabilities:
Check http status code

Disassembly:
mov eax, 0x6722fe
call fcn.0062921c
sub esp, 0x44
push ebx
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov esi, ecx
push eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 0x20000013
push dword [esi]
mov dword [ebp - 0x18], ebx
call dword [0x76b928]
test eax, eax
je 0x45f66a
cmp dword [ebp - 0x14], 0xc8
je 0x45f66a
push dword [ebp - 0x14]
lea eax, [ebp - 0x50]
push str.HTTP_Reply__d
push eax
call fcn.004607f4
add esp, 0xc
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x45f652
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.0045f5bb
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.0042386b
jmp 0x45f72b
push edi
xor eax, eax
mov byte [ebp - 0x38], bl
lea edi, [ebp - 0x37]
mov dword [ebp - 0x10], 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x1d
push dword [esi]
call dword [0x76b928]
test eax, eax
je 0x45f6b3
lea eax, [ebp - 0x38]
push str.gzip
push eax
call fcn.0063cd3b
pop ecx
pop ecx
test eax, eax
jne 0x45f6b3
or byte [esi + 0x25], 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x20
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
push eax
lea eax, [esi + 5]
push eax
push 1
push dword [esi]
call dword [0x76b928]
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push eax
lea eax, [ebp - 0x24]
push eax
push 0x20000005
push dword [esi]
call dword [0x76b928]
test eax, eax
je 0x45f6fd
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ebx
push 0xa
pop ecx
xor eax, eax
lea edi, [esi + 0x2c]
rep stosd dword es:[edi], eax
mov edi, 0x2000
mov dword [esi + 0x2c], 0x28
push edi
call fcn.0045b411
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edi
mov byte [esi + 4], 1
call fcn.0045f77e
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x465d9d
Capabilities:
Create thread

Disassembly:
mov eax, 0x672808
call fcn.0062921c
sub esp, 0x14
and dword [ebp - 0x10], 0
push esi
push edi
mov edi, dword [ebp + 0x20]
test edi, edi
jne 0x465dba
lea edi, [ebp - 0x10]
push edi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [edi]
mov esi, eax
mov edi, 0x76ba30
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x1c], 1
call fcn.00465e86
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push 0x76ba68
call fcn.004653fd
push edi
call fcn.00465f79
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x467580
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [0x74832c]
cmp esi, 0x270
jl 0x467645
xor esi, esi
push ebx
mov edx, esi
mov ebx, SysReAllocString
mov ecx, dword [edx*4 + 0x76bbec]
xor ecx, dword [edx*4 + 0x76bbe8]
and ecx, ebx
xor ecx, dword [edx*4 + 0x76bbe8]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x748530]
xor ecx, dword [edx*4 + 0x76c21c]
mov dword [edx*4 + 0x76bbe8], ecx
inc edx
cmp edx, 0xe3
jl 0x46759d
cmp edx, 0x26f
jge 0x467616
push edi
lea edi, [edx*4 + 0x76bbe8]
mov ecx, dword [edi]
xor ecx, dword [edi + 4]
and ecx, ebx
xor ecx, dword [edi]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x748530]
xor eax, dword [edi - 0x38c]
xor eax, ecx
mov dword [edi], eax
add edi, 4
cmp edi, 0x76c5a4
jl 0x4675e9
pop edi
mov ecx, dword [0x76bbe8]
xor ecx, dword [0x76c5a4]
and ecx, ebx
xor ecx, dword [0x76c5a4]
mov eax, ecx
shr ecx, 1
and eax, 1
pop ebx
xor ecx, dword [eax*4 + 0x748530]
xor ecx, dword [0x76c218]
mov dword [0x76c5a4], ecx
mov ecx, dword [esi*4 + 0x76bbe8]
mov eax, ecx
shr eax, 0xb
inc esi
xor ecx, eax
mov dword [0x74832c], esi
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret

Function at 0x4677dc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
mov dword [0x76bbe8], eax
inc edx
mov ecx, 0x76bbe8
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x76c5a4
jl 0x4677ed
mov dword [0x74832c], edx
ret 4

Function at 0x468836
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x46886c
xor eax, eax
cmp dword [ebp + 0x14], eax
setne al
cmp dword [ebp + 0x18], 0
je 0x46885a
or eax, 2
test ecx, eax
je 0x46886c
not eax
and eax, ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
pop ebp
ret 0x14
Function at 0x468b5b
Capabilities:
Copy file

Disassembly:
push ebp
sub esp, 0x54
mov eax, 0x679fa1
call fcn.0062921c
sub esp, 0x74
push ebx
push esi
mov esi, dword [ebp + 0x64]
push edi
push dword [ebp + 0x6c]
mov edi, dword [ebp + 0x68]
push esi
push dword [ebp + 0x60]
and dword [edi], 0
call fcn.0045e379
mov ebx, eax
test ebx, ebx
jne 0x468ba5
push dword [ebp + 0x60]
call fcn.00455ae5
xor ecx, ecx
test al, al
setne cl
add ecx, 2
xor eax, eax
mov dword [edi], ecx
jmp 0x468cd7
cmp byte [ebx], 0x64
jne 0x468cd5
cmp dword [esi], 0x39
jb 0x468cd5
push 0x11
push str.d10:.fileguard40:
push ebx
call fcn.0062c887
add esp, 0xc
test eax, eax
je 0x468be3
push 0x11
push str.d10:file_guard40:
push ebx
call fcn.0062c887
add esp, 0xc
test eax, eax
jne 0x468cd5
push 0xa
pop ecx
push 1
push 0x28
lea eax, [ebp]
push eax
lea eax, [ebp + 0x2c]
lea esi, [ebx + 0x11]
lea edi, [ebp]
rep movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp + 0x28], 0
call fcn.0046bb89
test al, al
jne 0x468c0e
mov eax, str.malformed_guard
jmp 0x468c85
mov esi, dword [ebp + 0x64]
add dword [esi], 0xffffffc8
mov eax, dword [esi]
dec eax
push eax
lea eax, [ebx + 0x39]
push eax
lea eax, [ebx + 1]
push eax
call fcn.0062b600
mov eax, dword [esi]
lea ecx, [ebp - 0x80]
add esp, 0xc
mov byte [ebx + eax], 0
call fcn.004651cd
push dword [esi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x80]
push ebx
call fcn.00465169
mov edx, eax
lea esi, [ebp + 0x2c]
xor ecx, ecx
mov eax, dword [esi + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x468c74
inc ecx
cmp ecx, 5
jne 0x468c4c
push dword [ebp + 0x60]
push str.File_passed_integrity_check:__s
call fcn.00409944
add esp, 8
lea ecx, [ebp - 0x80]
call fcn.00409944
jmp 0x468cd5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00409944
mov eax, str.hash_doesnt_match
push dword [ebp + 0x60]
push eax
push str.Warning:_file_integrity_check_failed___s_:__s
call fcn.00477256
push str.Ignore_this_warning_if_you_switched_to_1.6.1_or_older_and_back
call fcn.00477256
add esp, 0x10
lea eax, [ebp + 0x40]
push 0x69c258
push dword [ebp + 0x60]
push eax
call fcn.00468ecb
cmp dword [ebp + 0x54], 8
mov eax, dword [ebp + 0x40]
jae 0x468cbd
lea eax, [ebp + 0x40]
push 0
push eax
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push 0
push 1
lea ecx, [ebp + 0x40]
call fcn.0042386b
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x58]
pop ebp
ret 0x10

Function at 0x46aa80
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x46aac0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x46aac0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x46d874
Capabilities:
Delete file

Disassembly:
mov eax, 0x672c22
call fcn.0062921c
sub esp, 0x28
push ebx
push esi
push dword [0x74cdd0]
xor ebx, ebx
mov byte [ebp - 0xd], bl
call fcn.0047d674
mov esi, eax
test esi, esi
jne 0x46d8a5
push ebx
mov byte [ebp - 0xd], 1
call fcn.0047d674
mov esi, eax
mov eax, fcn.0047cd45
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
test esi, esi
je 0x46d94d
push str.campaigncode.txt
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], ebx
push eax
call fcn.004785a1
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 1
jb 0x46d8d8
mov eax, dword [eax]
push edi
lea ecx, [ebp - 0x14]
push ecx
push eax
push esi
call fcn.0047d089
push ebx
push 1
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.0042386b
test edi, edi
je 0x46d91e
cmp dword [ebp - 0x14], 0
je 0x46d91e
push edi
call fcn.00639b32
pop ecx
mov ecx, 0x76c820
mov ebx, eax
call fcn.0046db11
test eax, eax
jne 0x46d918
mov dword [0x76d6b8], ebx
mov dword [0x76d6b4], ebx
cmp byte [ebp - 0xd], 0
je 0x46d937
cmp dword [esi + 0x14], 8
jb 0x46d92e
mov eax, dword [esi]
jmp 0x46d930
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov byte [ebp - 4], 2
test edi, edi
je 0x46d947
push 1
push edi
call fcn.0045b404
mov eax, fcn.0047cd45
pop edi
mov dword [ebp - 4], 3
test eax, eax
je 0x46d962
test esi, esi
je 0x46d962
push esi
call fcn.0047cd45
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x46da7e
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x672c34
call fcn.0062921c
sub esp, 0xc
push esi
push edi
xor edx, edx
lea edi, [ecx + 0xebc]
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x14], edx
jb 0x46daa2
mov eax, dword [edi]
jmp 0x46daa4
mov eax, edi
push edx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
xor ecx, ecx
mov dword [ebp - 0x10], eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.006298d5
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
jb 0x46dad6
mov edi, dword [edi]
push dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov ecx, dword [ebp + 8]
push esi
call fcn.00424ff1
test esi, esi
je 0x46daf5
push esi
call fcn.00629331
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x46f208
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x672e42
call fcn.0062921c
sub esp, 0x44
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push edi
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], 1
call fcn.00472fb7
mov edi, dword [ebp + 8]
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], ebx
jb 0x46f245
mov eax, dword [edi]
jmp 0x46f247
mov eax, edi
mov byte [eax], bl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
call fcn.00470a3d
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
sar ecx, 2
test ecx, ecx
je 0x46f37e
push esi
call fcn.00470a3d
mov eax, dword [eax]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 8]
jmp 0x46f354
mov edi, dword [edx + 4]
movzx edx, word [edx + 8]
add edi, dword [eax]
test dl, 0xe0
je 0x46f34b
and edx, 0xf
jmp dword [edx*4 + 0x46f650]
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
add edx, 0x1c
mov ebx, dword [edx]
mov dword [ebp - 0x18], edx
test ebx, ebx
jne 0x46f27a
mov ebx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x1c], ebx
call fcn.00470a3d
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
sar ecx, 2
cmp ebx, ecx
jb 0x46f265
pop esi
mov dword [ebp - 4], 5
call fcn.00472ff8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4