joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x589644]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x8c], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x8c]
mov eax, 0x58f5f8
mov dword [ebp - 0x88], 0x540046
push edi
mov dword [ebp - 0x84], 0x410057
mov edx, 0x43
mov dword [ebp - 0x80], 0x450052
sub esi, eax
mov dword [ebp - 0x7c], 0x4d005c
mov dword [ebp - 0x78], 0x630069
mov dword [ebp - 0x74], 0x6f0072
mov dword [ebp - 0x70], 0x6f0073
mov dword [ebp - 0x6c], 0x740066
mov dword [ebp - 0x68], 0x57005c
mov dword [ebp - 0x64], 0x6e0069
mov dword [ebp - 0x60], 0x6f0064
mov dword [ebp - 0x5c], 0x730077
mov dword [ebp - 0x58], 0x43005c
mov dword [ebp - 0x54], 0x720075
mov dword [ebp - 0x50], 0x650072
mov dword [ebp - 0x4c], 0x74006e
mov dword [ebp - 0x48], 0x650056
mov dword [ebp - 0x44], 0x730072
mov dword [ebp - 0x40], 0x6f0069
mov dword [ebp - 0x3c], 0x5c006e
mov dword [ebp - 0x38], 0x700041
mov dword [ebp - 0x34], 0x200070
mov dword [ebp - 0x30], 0x610050
mov dword [ebp - 0x2c], 0x680074
mov dword [ebp - 0x28], 0x5c0073
mov dword [ebp - 0x24], 0x360033
mov dword [ebp - 0x20], 0x440030
mov dword [ebp - 0x1c], 0x730065
mov dword [ebp - 0x18], 0x74006b
mov dword [ebp - 0x14], 0x70006f
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
nop
lea ecx, [edx + 0x7fffffbb]
test ecx, ecx
je 0x4652ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x4652ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x465290
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b85ea
mov esp, ebp
pop ebp
ret
Function at 0x4652d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x589644]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x98], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x98]
mov eax, 0x58f0f8
mov dword [ebp - 0x94], 0x540046
push edi
mov dword [ebp - 0x90], 0x410057
mov edx, 0x49
mov dword [ebp - 0x8c], 0x450052
sub esi, eax
mov dword [ebp - 0x88], 0x4d005c
mov dword [ebp - 0x84], 0x630069
mov dword [ebp - 0x80], 0x6f0072
mov dword [ebp - 0x7c], 0x6f0073
mov dword [ebp - 0x78], 0x740066
mov dword [ebp - 0x74], 0x57005c
mov dword [ebp - 0x70], 0x6e0069
mov dword [ebp - 0x6c], 0x6f0064
mov dword [ebp - 0x68], 0x730077
mov dword [ebp - 0x64], 0x43005c
mov dword [ebp - 0x60], 0x720075
mov dword [ebp - 0x5c], 0x650072
mov dword [ebp - 0x58], 0x74006e
mov dword [ebp - 0x54], 0x650056
mov dword [ebp - 0x50], 0x730072
mov dword [ebp - 0x4c], 0x6f0069
mov dword [ebp - 0x48], 0x5c006e
mov dword [ebp - 0x44], 0x700041
mov dword [ebp - 0x40], 0x200070
mov dword [ebp - 0x3c], 0x610050
mov dword [ebp - 0x38], 0x680074
mov dword [ebp - 0x34], 0x5c0073
mov dword [ebp - 0x30], 0x360033
mov dword [ebp - 0x2c], 0x770030
mov dword [ebp - 0x28], 0x610070
mov dword [ebp - 0x24], 0x700070
mov dword [ebp - 0x20], 0x65002e
mov dword [ebp - 0x1c], 0x650078
mov dword [ebp - 0x18], 0x66005c
mov dword [ebp - 0x14], 0x6c0069
mov dword [ebp - 0x10], 0x5f0065
mov dword [ebp - 0xc], 0x650070
nop dword [eax]
lea ecx, [edx + 0x7fffffb5]
test ecx, ecx
je 0x46542e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46542e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x465410
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b85ea
mov esp, ebp
pop ebp
ret

Function at 0x465580
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538248
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x589644]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0xd]
call fcn.00464d10
push eax
lea ecx, [ebp - 0x14]
call fcn.004108d0
push dword [ebp - 0x14]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Delete_uninstall_registry
call fcn.0045cb30
mov edx, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4655fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4659b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5382c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x589644]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x1c], 1
call fcn.0040cb80
mov ecx, eax
test ecx, ecx
je 0x465b38
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov eax, dword [esi - 8]
mov ebx, 1
mov ecx, ebx
mov dword [ebp - 4], 0
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x465a30
push 0x104
lea ecx, [ebp - 0x14]
call fcn.0040d870
mov esi, dword [ebp - 0x14]
cmp dword [esi - 8], 0x104
jl 0x465b42
xor eax, eax
mov dword [esi - 0xc], 0x104
mov word [esi + 0x208], ax
lea ecx, [ebp - 0xd]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push str.VendorID
call fcn.00464a10
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push dword [esi - 8]
push esi
call fcn.00504175
add esp, 8
test eax, eax
js 0x465b42
cmp eax, dword [esi - 8]
jg 0x465b42
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov edi, dword [esi - 0xc]
test edi, edi
js 0x465b4c
mov eax, dword [esi - 8]
sub ebx, dword [esi - 4]
sub eax, edi
or eax, ebx
jge 0x465ab8
push edi
lea ecx, [ebp - 0x14]
call fcn.0040d870
mov esi, dword [ebp - 0x14]
lea eax, [edi + 1]
push eax
push esi
call fcn.0050220c
add esp, 8
cmp edi, dword [esi - 8]
jg 0x465b42
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
cmp dword [esi - 0xc], eax
jge 0x465add
or edi, 0xffffffff
jmp 0x465afa
push str.bizhi
push esi
call fcn.004d8a44
mov edi, eax
add esp, 8
test edi, edi
jne 0x465af6
or edi, 0xffffffff
jmp 0x465afa
sub edi, esi
sar edi, 1
mov eax, dword [ebp - 0x20]
not edi
shr edi, 0x1f
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 0x7c], edi
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x465b24
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00408f30
push 0x80070057
call fcn.00408f30
push 0x80070057
call fcn.00408f30
int3
Function at 0x465db0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538340
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x589644]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0040cb80
mov ecx, eax
test ecx, ecx
je 0x465e91
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
push 0x550318
push eax
mov dword [ebp - 4], 0
call fcn.00413040
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp edi, 0x64
mov dword [ebp - 0x20], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov eax, 0x63
mov dword [ebp - 0x1c], 0x465f30
cmovl eax, edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
call fcn.004688c0
add esp, 4
mov dword [ebp - 0x20], vtable.mf_bind_t_1_class_CUninstaller__class_CUninstaller___void__int_.0
mov dword [ebp - 0x1c], 0
add esi, 0xfffffff0
mov dword [ebp - 0x18], 0
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x465e7d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00408f30
int3
Function at 0x466940
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5384bb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x589644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d7bd0
add esp, 0xc
lea eax, [ebp - 0x218]
push str.config.set
push dword [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
push 0x550370
push str.open
push 0x549e20
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x219]
call fcn.004594d0
lea ecx, [ebp - 0x21a]
mov dword [ebp - 4], 0
call fcn.00464930
push eax
lea ecx, [ebp - 0x219]
call fcn.0045b010
push eax
push str.Delete_AutoRun_Registry__ret___d
call fcn.0045cb30
add esp, 8
lea ecx, [ebp - 0x21a]
call fcn.00463b60
push eax
lea ecx, [ebp - 0x219]
call fcn.0045b050
push eax
push str.Delete_AutoRun_Task_Schedule__ret___d
call fcn.0045cb30
add esp, 8
push str.wpapp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.00460050
test eax, eax
je 0x466a88
push 0xf013f
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
call fcn.00448d30
mov esi, dword [ebp - 0x228]
test eax, eax
jne 0x466a7d
push str.wpapp
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x466a88
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x219]
call fcn.00459930
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b85ea
mov esp, ebp
pop ebp
ret
Function at 0x466b40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4808
call fcn.004b8600
mov eax, dword [0x589644]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004d7bd0
add esp, 0xc
lea eax, [ebp - 0x804]
push 1
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0x1804]
push 0
push eax
call fcn.004d7bd0
add esp, 0xc
lea ecx, [ebp - 0x4805]
call fcn.00464ed0
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1804]
push eax
call edi
lea eax, [ebp - 0x1804]
push eax
call fcn.00457220
push 0x800
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.004d7bd0
add esp, 0x10
lea eax, [ebp - 0x804]
push 0x549db8
push eax
lea eax, [ebp - 0x2004]
push eax
call edi
lea eax, [ebp - 0x2004]
push eax
call fcn.00457220
push 0x800
lea eax, [ebp - 0x2804]
push 0
push eax
call fcn.004d7bd0
add esp, 0x10
lea eax, [ebp - 0x804]
push 0x550334
push eax
lea eax, [ebp - 0x2804]
push eax
call edi
lea eax, [ebp - 0x2804]
push eax
call fcn.00457220
push 0x800
lea eax, [ebp - 0x3004]
push 0
push eax
call fcn.004d7bd0
add esp, 0x10
lea eax, [ebp - 0x804]
push 0x549d80
push eax
lea eax, [ebp - 0x3004]
push eax
call edi
lea eax, [ebp - 0x3004]
push eax
call fcn.00457220
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004d7bd0
add esp, 0x10
lea eax, [ebp - 0x1004]
push 1
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0x3804]
push 0
push eax
call fcn.004d7bd0
add esp, 0xc
lea ecx, [ebp - 0x4805]
call fcn.004638c0
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x3804]
push eax
call edi
lea eax, [ebp - 0x3804]
push eax
call fcn.00457220
push 0x800
lea eax, [ebp - 0x4004]
push 0
push eax
call fcn.004d7bd0
add esp, 0x10
lea eax, [ebp - 0x1004]
push 0x549db8
push eax
lea eax, [ebp - 0x4004]
push eax
call edi
lea eax, [ebp - 0x4004]
push eax
call fcn.00457220
push 0x800
lea eax, [ebp - 0x4804]
push 0
push eax
call fcn.004d7bd0
add esp, 0x10
lea eax, [ebp - 0x1004]
push 0x549d80
push eax
lea eax, [ebp - 0x4804]
push eax
call edi
lea eax, [ebp - 0x4804]
push eax
call fcn.00457220
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
call fcn.004b85ea
mov esp, ebp
pop ebp
ret
Function at 0x466e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.004b8600
mov eax, dword [0x589644]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004d7bd0
add esp, 0xc
lea eax, [ebp - 0x804]
push 1
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004d7bd0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
add esp, 0xc
push 0x550348
push eax
lea eax, [ebp - 0x1004]
push eax
call esi
lea eax, [ebp - 0x1004]
push eax
call fcn.00457290
push 0x800
lea eax, [ebp - 0x1804]
push 0
push eax
call fcn.004d7bd0
add esp, 0x10
lea eax, [ebp - 0x804]
push 0x549dd0
push eax
lea eax, [ebp - 0x1804]
push eax
call esi
lea eax, [ebp - 0x1804]
push eax
call fcn.00457290
push 0x800
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.004d7bd0
add esp, 0x10
lea ecx, [ebp - 0x2005]
call fcn.004644d0
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x2004]
push eax
call esi
lea eax, [ebp - 0x2004]
push eax
call fcn.00457290
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.004b85ea
mov esp, ebp
pop ebp
ret
Function at 0x468c00
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x589644]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x468cc1
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004d7bd0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x468cab
push edi
push 0x104
lea edi, [ebx + 4]
push 0
push edi
call fcn.004d7bd0
add esp, 0xc
lea eax, [ebp - 0x108]
push edi
push 0
push 0x550518
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx], eax
pop edi
cmp dword [ebx], 0
jne 0x468cc1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b85ea
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.004d7bd0
add esp, 0xc
mov dword [ebp - 0x314], 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x310]
push 0x207
push eax
call fcn.00409550
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004f4980
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x468d21
cmp eax, 0x207
ja 0x468d21
jne 0x468d28
mov byte [ebp - 0x109], 0
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x468d31
push 0
lea eax, [ebp - 0x314]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x310]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b85ea
mov esp, ebp
pop ebp
ret
Function at 0x468f20
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1318
call fcn.004b8600
mov eax, dword [0x589644]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x800
mov dword [ebp - 0x1318], eax
lea eax, [ebp - 0x1304]
push 0
push eax
call fcn.004d7bd0
push 0x800
lea eax, [ebp - 0xb04]
push 0
push eax
call fcn.004d7bd0
add esp, 0x18
lea eax, [ebp - 0x1304]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xfe
lea eax, [ebp - 0x102]
push 0
push eax
call fcn.004d7bd0
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x1314]
push eax
movups xmmword [ebp - 0x1314], xmm0
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x200
lea eax, [ebp - 0x304]
push 0
push eax
call fcn.004d7bd0
movzx eax, byte [ebp - 0x1305]
push eax
movzx eax, byte [ebp - 0x1306]
push eax
movzx eax, byte [ebp - 0x1307]
push eax
movzx eax, byte [ebp - 0x1308]
push eax
movzx eax, byte [ebp - 0x1309]
push eax
movzx eax, byte [ebp - 0x130a]
push eax
movzx eax, byte [ebp - 0x130b]
push eax
movzx eax, byte [ebp - 0x130c]
push eax
movzx eax, word [ebp - 0x130e]
push eax
movzx eax, word [ebp - 0x1310]
push eax
push dword [ebp - 0x1314]
lea eax, [ebp - 0x304]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.004450c0
lea eax, [ebp - 0x304]
add esp, 0x40
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x469050
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.00502586
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x1304]
push eax
lea eax, [ebp - 0xb04]
push eax
call edi
push str._TemporaryCache
lea eax, [ebp - 0xb04]
push 0x400
push eax
call fcn.00506ae1
add esp, 0xc
lea eax, [ebp - 0xb04]
push eax
call ebx
test eax, eax
je 0x4690d5
inc esi
cmp esi, 0xa
jl 0x468fa2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b85ea
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xb04]
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4690e0
mov ecx, dword [ebp - 0x1318]
lea eax, [ebp - 0xb04]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.00412460
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b85ea
mov esp, ebp
pop ebp
ret
Function at 0x469160
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.004b8600
mov eax, dword [0x589644]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4691bb
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b85ea
mov esp, ebp
pop ebp
ret 4
mov esi, dword [edi + 4]
test esi, esi
je 0x46928c
mov ecx, dword [edi + 8]
test ecx, ecx
jle 0x46928c
mov eax, ecx
cdq
and edx, 0xfff
add eax, edx
sar eax, 0xc
mov dword [ebp - 0x1010], eax
and ecx, 0x80000fff
jns 0x4691f5
dec ecx
or ecx, 0xfffff000
inc ecx
xor edi, edi
mov dword [ebp - 0x100c], ecx
mov dword [ebp - 0x1008], 0
test eax, eax
jle 0x46925a
nop dword [eax + eax]
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004d7650
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46928c
inc edi
add esi, 0x1000
cmp edi, dword [ebp - 0x1010]
jl 0x469210
mov ecx, dword [ebp - 0x100c]
test ecx, ecx
jle 0x46928c
push ecx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004d7650
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0
push eax
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b85ea
mov esp, ebp
pop ebp
ret 4
Function at 0x46b6b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x46b6c7
mov eax, 0x8000ffff
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x46b6f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x46b6ec
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x46b80b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x46b729
cmp byte [edi + 0x18], al
je 0x46b71d
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.004469e0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x46b762
call fcn.004469e0
push 0x2710
mov ecx, esi
mov edi, eax
call fcn.0046b840
test eax, eax
jns 0x46b808
test edi, edi
pop ebx
cmovns edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.0046b2e0
mov dword [ebp - 4], eax
test eax, eax
jns 0x46b792
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.0046b840
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x46b739
push 0
push 0
push ebx
mov ecx, esi
call fcn.0046b2e0
mov edi, eax
test edi, edi
jns 0x46b7d0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.0046b840
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x46bb60
push 0
push 0
call fcn.0050475a
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x46b739
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x46b808
call fcn.004469e0
mov edi, eax
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret