joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467410
Capabilities:
Delete file
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x604e14]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x434], ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x430]
push ecx
push 0
push 0x5af9bc
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x430]
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffff
jne 0x46748a
xor eax, eax
jmp 0x4675ed
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x434]
call fcn.0045bce0
push eax
mov edx, dword [ebp - 0x434]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x21c]
push edx
call fcn.00460e10
add esp, 4
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00480940
add esp, 8
mov dword [ebp - 0x224], eax
cmp dword [ebp + 0x10], 0
je 0x4674ea
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x438], ecx
jmp 0x4674f4
movzx edx, word [ebp + 0x14]
mov dword [ebp - 0x438], edx
mov eax, dword [ebp + 0xc]
sub eax, 0xe
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xe
push ecx
movzx edx, word [ebp + 0x1c]
push edx
mov eax, dword [ebp - 0x438]
push eax
push 2
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
mov edx, dword [ebp - 0x224]
push edx
call fcn.00480b70
add esp, 8
push 0x8000
push 0
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
lea edx, [ebp - 0x430]
push edx
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x21c], eax
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x220]
push ecx
call fcn.0045ee00
add esp, 4
mov dword [ebp - 8], eax
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x21c]
push eax
call fcn.00460e10
add esp, 4
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x434]
mov dword [edx + 0xc], 1
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x434]
call fcn.00461100
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00555ac5
mov esp, ebp
pop ebp
ret 0x18
Function at 0x467600
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x467634
xor eax, eax
jmp 0x4676f5
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.00526059
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x467671
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00460e10
add esp, 4
xor eax, eax
jmp 0x4676f5
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4676af
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0052604e
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call fcn.00460e10
add esp, 4
xor eax, eax
jmp 0x4676f5
mov eax, dword [ebp - 0x14]
push eax
call fcn.00460e10
add esp, 4
movzx ecx, word [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
movzx eax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00467410
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0052604e
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x467700
Capabilities:
Delete file
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x604e14]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x43c], ecx
lea eax, [ebp - 0x220]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x438]
push ecx
push 0
push 0x5af9c4
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x438]
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xffffffff
jne 0x46777a
xor eax, eax
jmp 0x4678fe
push 0
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x43c]
call fcn.0045bce0
push eax
mov edx, dword [ebp - 0x43c]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x224]
push edx
call fcn.00460e10
add esp, 4
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, 6
mov dword [ebp - 0x228], ecx
push 0
lea edx, [ebp - 0x438]
push edx
call fcn.00480940
add esp, 8
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x228]
mov ecx, dword [eax + 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
je 0x4677fb
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x440], edx
jmp 0x467805
movzx eax, word [ebp + 0x14]
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x228]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
movzx ecx, word [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 0x440]
push edx
push 3
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.00480b70
add esp, 8
push 0x8000
push 0
mov edx, dword [ebp - 0x43c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
lea ecx, [ebp - 0x438]
push ecx
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x224], eax
push 0
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
push eax
call fcn.0045ee00
add esp, 4
mov dword [ebp - 0xc], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x224]
push edx
call fcn.00460e10
add esp, 4
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x43c]
mov dword [ecx + 0xc], 1
mov edx, dword [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x43c]
call fcn.00461100
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00555ac5
mov esp, ebp
pop ebp
ret 0x18
Function at 0x467910
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x467944
xor eax, eax
jmp 0x467a05
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.00526059
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x467981
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00460e10
add esp, 4
xor eax, eax
jmp 0x467a05
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4679bf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0052604e
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call fcn.00460e10
add esp, 4
xor eax, eax
jmp 0x467a05
mov eax, dword [ebp - 0x14]
push eax
call fcn.00460e10
add esp, 4
movzx ecx, word [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
movzx eax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00467700
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0052604e
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x467d70
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x467da4
xor eax, eax
jmp 0x467e65
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.00526059
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x467de1
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00460e10
add esp, 4
xor eax, eax
jmp 0x467e65
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x467e1f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0052604e
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call fcn.00460e10
add esp, 4
xor eax, eax
jmp 0x467e65
mov eax, dword [ebp - 0x14]
push eax
call fcn.00460e10
add esp, 4
movzx ecx, word [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
movzx eax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00467a10
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0052604e
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x467e70
Capabilities:
Delete file
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x604e14]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x434], ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x430]
push ecx
push 0
push 0x5af9d4
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x430]
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffff
jne 0x467eea
xor eax, eax
jmp 0x468063
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x434]
call fcn.0045bce0
push eax
mov edx, dword [ebp - 0x434]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x21c]
push edx
call fcn.00460e10
add esp, 4
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.00480940
add esp, 8
mov dword [ebp - 0x224], eax
cmp dword [ebp + 0x14], 0
je 0x467f4a
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x438], ecx
jmp 0x467f54
movzx edx, word [ebp + 0x18]
mov dword [ebp - 0x438], edx
cmp dword [ebp + 8], 0
je 0x467f65
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x43c], eax
jmp 0x467f6f
movzx ecx, word [ebp + 0xc]
mov dword [ebp - 0x43c], ecx
push 0
push 0
movzx edx, word [ebp + 0x20]
push edx
mov eax, dword [ebp - 0x438]
push eax
mov ecx, dword [ebp - 0x43c]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
mov eax, dword [ebp - 0x224]
push eax
call fcn.00480b70
add esp, 8
push 0x8000
push 0
mov ecx, dword [ebp - 0x434]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x430]
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x21c], eax
push 0
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x220], eax
mov edx, dword [ebp - 0x220]
push edx
call fcn.0045ee00
add esp, 4
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.00460e10
add esp, 4
lea edx, [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x434]
mov dword [eax + 0xc], 1
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x434]
call fcn.00461100
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00555ac5
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x468080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.0045bfd0
test eax, eax
jne 0x4680a1
xor eax, eax
jmp 0x468109
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4680cc
xor eax, eax
jmp 0x468109
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4680f8
mov ecx, dword [ebp - 8]
push ecx
call fcn.00460e10
add esp, 4
xor eax, eax
jmp 0x468109
mov edx, dword [ebp - 8]
push edx
call fcn.00460e10
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46c7c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5826b4
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x604e14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x84]
call fcn.00461040
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x46c855
mov dword [ebp - 0x88], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.004610a0
mov eax, dword [ebp - 0x88]
jmp 0x46c982
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
push edx
call fcn.0045ee00
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x46c895
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46c8df
cmp dword [ebp - 0x10], 0
je 0x46c8ac
push 0x8000
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x18]
push edx
call fcn.00460e10
add esp, 4
mov dword [ebp - 0x8c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.004610a0
mov eax, dword [ebp - 0x8c]
jmp 0x46c982
mov eax, dword [ebp - 0x18]
push eax
call fcn.00460e10
add esp, 4
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x84]
call fcn.00461100
test eax, eax
jne 0x46c937
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 0x90], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.004610a0
mov eax, dword [ebp - 0x90]
jmp 0x46c982
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x84]
push edx
mov ecx, dword [ebp - 0x98]
call fcn.0046bf30
mov dword [ebp - 0x1c], eax
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.004610a0
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x46c9a0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x604e14]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x42c], ecx
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x428]
push ecx
push 0
push 0x5b0298
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x428]
push eax
call fcn.00460cf0
add esp, 0x1c
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x46ca17
xor eax, eax
jmp 0x46ca91
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x42c]
call fcn.0045bce0
push eax
mov edx, dword [ebp - 0x42c]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x214]
push edx
call fcn.00460e10
add esp, 4
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumW]
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00555ac5
mov esp, ebp
pop ebp
ret
Function at 0x47e410
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CMD5Checksum.0
push 0x40
push 0
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call fcn.00556110
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x44], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4c], 0x67452301
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 0x54], 0x98badcfe
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x58], 0x10325476
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x480940
Capabilities:
Check os version
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5827fb
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x604e14]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x20c
call fcn.0052601f
add esp, 4
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp + 8]
push ecx
push 0x104
mov edx, dword [ebp - 0x130]
push edx
call fcn.0045eee0
add esp, 0xc
mov eax, dword [ebp - 0x130]
mov dword [eax + 0x208], 0
push 0x114
push 0
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00556110
add esp, 0xc
mov dword [ebp - 0x12c], 0x114
lea edx, [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x128], 6
jb 0x480afe
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.0045ee60
add esp, 8
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x480afe
lea ecx, [ebp - 0x19c]
call fcn.00461040
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x138]
push edx
mov eax, dword [ebp - 0x134]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00461100
cmp eax, 1
jne 0x480add
push 0
push 0x5b7478
push 0x5b7480
lea ecx, [ebp - 0x19c]
call fcn.0046b3a0
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0x130]
mov dword [ecx + 0x208], eax
mov edx, dword [ebp - 0x130]
cmp dword [edx + 0x208], 1
jne 0x480add
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xffffffff
je 0x480add
push 0
lea ecx, [ebp - 0x1a4]
push ecx
mov edx, dword [ebp - 0x138]
push edx
mov eax, dword [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x1a0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x1a0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x134]
push eax
call fcn.0045ee40
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.004610a0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x480b32
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1ac], eax
mov ecx, dword [ebp - 0x1ac]
push ecx
call fcn.0052604e
add esp, 4
jmp 0x480b48
lea edx, [ebp - 0x10]
push edx
mov ecx, 0x608f38
call fcn.00480d70
mov ecx, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00555ac5
mov esp, ebp
pop ebp
ret