joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451420
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
add eax, esi
push edi
push 0x2f
push eax
call fcn.005d6ec0
mov edi, eax
add esp, 8
test edi, edi
je 0x451475
nop
mov byte [edi], 0
cmp byte [esi], 0
je 0x45145e
push esi
call fcn.004513f0
add esp, 4
test al, al
jne 0x45145e
push esi
call fcn.005b9afe
add esp, 4
lea eax, [edi + 1]
mov byte [edi], 0x2f
push 0x2f
push eax
call fcn.005d6ec0
mov edi, eax
add esp, 8
test edi, edi
jne 0x451440
cmp byte [esi], 0
je 0x451497
push esi
call fcn.005b9afe
add esp, 4
test eax, eax
je 0x451497
call fcn.005b7f69
cmp dword [eax], 0x11
je 0x451497
pop edi
xor al, al
pop esi
pop ebp
ret
pop edi
mov al, 1
pop esi
pop ebp
ret

Function at 0x451630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0x2e
jne 0x451651
mov al, byte [esi + 1]
cmp al, 0x2f
je 0x45164e
cmp al, 0x5c
jne 0x451651
add esi, 2
push 6
push str.b64:__
push esi
call fcn.005b7850
add esp, 0xc
test eax, eax
je 0x451742
push 8
push str.asset:__
push esi
call fcn.005b7850
add esp, 0xc
test eax, eax
jne 0x451688
lea eax, [esi + 8]
test eax, eax
jne 0x4517eb
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x451690
sub ecx, edx
movzx eax, byte [ecx + esi - 1]
push eax
push 0x601530
call fcn.005d6ec0
add esp, 8
test eax, eax
jne 0x4517eb
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push esi
push eax
call fcn.00452810
add esp, 0xc
cmp dword [ebp - 8], 0
mov ebx, dword [eax]
je 0x4516fb
push dword [0x6996b8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
sub edi, 1
jne 0x4516ee
push 0x6996b0
call fcn.00452da0
add esp, 4
push edi
push dword [0x6996b8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test ebx, ebx
pop ebx
jne 0x451742
push esi
call fcn.0044e710
add esp, 4
test al, al
je 0x45174a
push 0x103
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.005b3b70
lea eax, [ebp - 0x10c]
push eax
call fcn.0044fb40
lea eax, [ebp - 0x10c]
push eax
call fcn.00451370
add esp, 0x14
test al, al
je 0x4517eb
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x5ff700
mov dword [ebp + 8], ecx
test esi, esi
je 0x45176d
cmp byte [esi], 0x25
jne 0x45176d
lea eax, [ebp + 8]
push eax
push esi
call fcn.00453000
mov ecx, dword [ebp + 8]
add esp, 8
mov esi, eax
mov edi, 0x6996c0
mov eax, dword [edi]
test eax, eax
je 0x4517de
cmp byte [eax], 0
jne 0x451791
cmp byte [ecx], 0
jne 0x451791
push esi
call fcn.00451370
add esp, 4
test al, al
jne 0x4517e0
jmp 0x4517bd
push esi
push ecx
push eax
push 0x601500
lea eax, [ebp - 0x10c]
push 0x104
push eax
call fcn.0044de40
lea eax, [ebp - 0x10c]
push eax
call fcn.00451370
add esp, 0x1c
test al, al
jne 0x4517cd
add edi, 4
cmp edi, 0x6997c0
jge 0x4517de
mov ecx, dword [ebp + 8]
jmp 0x451772
lea esi, [ebp - 0x10c]
test esi, esi
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
test esi, esi
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x452740
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, dword [ecx]
test esi, esi
je 0x45276c
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
sub edi, 1
jne 0x452761
push esi
call fcn.00452da0
add esp, 4
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
ret
Function at 0x452db0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, dword [eax]
mov eax, 0x811c9dc5
mov dword [ebp - 4], ebx
mov dl, byte [ebx]
lea esi, [ebx + 1]
mov byte [ebp + 0xf], dl
movzx edx, dl
test edx, edx
je 0x452de8
imul eax, eax, 0x1000193
lea esi, [esi + 1]
xor eax, edx
movzx edx, byte [esi - 1]
test edx, edx
jne 0x452dd5
mov edi, dword [ecx + 4]
xor edx, edx
mov ecx, dword [ecx + 8]
div ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], ecx
lea eax, [edi + edx*4]
mov edi, dword [eax]
mov dword [ebp - 0xc], eax
test edi, edi
je 0x452e9a
cmp byte [ebp + 0xf], 0
mov eax, ebx
je 0x452e16
inc eax
cmp byte [eax], 0
jne 0x452e10
sub eax, ebx
mov bl, byte [edi + 0xb]
test bl, bl
jns 0x452e24
mov edx, dword [edi + 4]
jmp 0x452e2e
movzx ecx, bl
mov edx, 0xb
sub edx, ecx
cmp edx, eax
jne 0x452eba
test bl, bl
jns 0x452e3e
mov edx, dword [edi]
jmp 0x452e40
mov edx, edi
mov ebx, dword [ebp - 4]
mov esi, ebx
sub eax, 4
jb 0x452e61
nop word [eax + eax]
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x452e66
add edx, 4
add esi, 4
sub eax, 4
jae 0x452e50
cmp eax, 0xfffffffc
je 0x452e93
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x452ebd
cmp eax, 0xfffffffd
je 0x452e93
mov cl, byte [edx + 1]
cmp cl, byte [esi + 1]
jne 0x452ebd
cmp eax, 0xfffffffe
je 0x452e93
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
jne 0x452ebd
cmp eax, 0xffffffff
je 0x452e93
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
jne 0x452ebd
test edi, edi
jne 0x452ea6
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp - 4]
mov edi, dword [edi + 0x18]
test edi, edi
jne 0x452e08
jmp 0x452e97
Function at 0x457c10
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [0x69f10c]
test eax, eax
je 0x457d7b
cmp byte [eax], 0
je 0x457d7b
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6a3d5c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x69f32c]
cmp eax, dword [ecx + 0x70]
jg 0x457e31
push esi
push edi
call dword [0x68c480]
test eax, eax
je 0x457c98
call dword [0x68c480]
push 1
mov esi, eax
push 0xffffffffffffffff
push str.langAlias
mov ecx, esi
call fcn.004a1850
push eax
mov ecx, esi
call fcn.004a15e0
test eax, eax
mov ecx, 0x6a19c0
mov edi, 0x5ff700
cmovne ecx, eax
mov edx, edi
mov eax, dword [0x69f10c]
test eax, eax
cmovne edx, eax
push edx
push edx
call fcn.004a1ab0
mov esi, eax
jmp 0x457ca9
mov eax, dword [0x69f10c]
mov edi, 0x5ff700
test eax, eax
mov esi, edi
cmovne esi, eax
mov eax, dword [0x69f328]
cmp eax, esi
je 0x457ce3
test eax, eax
je 0x457cc2
mov ecx, dword [0x6962b0]
push eax
mov edx, dword [ecx]
call dword [edx + 0x20]
test esi, esi
je 0x457cdc
cmp byte [esi], 0
je 0x457cdc
push dword [0x6962b0]
push esi
call fcn.0044d570
add esp, 8
jmp 0x457cde
xor eax, eax
mov dword [0x69f328], eax
test eax, eax
je 0x457d73
mov cl, byte [eax]
test cl, cl
je 0x457d71
movzx eax, cl
push eax
call fcn.005ba760
add esp, 4
test eax, eax
jne 0x457d6c
mov eax, dword [0x69f10c]
mov edx, edi
test eax, eax
mov ecx, edi
push ebx
cmovne edx, eax
mov eax, dword [0x69f328]
test eax, eax
cmovne ecx, eax
nop
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x457d40
test bl, bl
je 0x457d3c
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x457d40
add ecx, 2
add edx, 2
test bl, bl
jne 0x457d20
xor ecx, ecx
jmp 0x457d45
sbb ecx, ecx
or ecx, 1
pop ebx
test ecx, ecx
jne 0x457d71
test eax, eax
mov ecx, edi
cmovne ecx, eax
movzx eax, byte [ecx]
push eax
call fcn.005b37bf
mov ecx, dword [0x69f328]
add esp, 4
test ecx, ecx
mov edx, edi
cmovne edx, ecx
mov byte [edx], al
mov eax, dword [0x69f328]
test eax, eax
cmovne edi, eax
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [0x69f0d4]
test eax, eax
jne 0x457e30
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov eax, ecx
and eax, 0x3ff
sub eax, 4
cmp eax, 0x1f
ja case.0x457dab.6
movzx eax, byte [eax + 0x457eb4]
jmp dword [eax*4 + 0x457e68]
mov eax, str.Japanese
ret
mov eax, str.German
ret
mov eax, str.French
ret
mov eax, str.Spanish
ret
mov eax, str.Italian
ret
mov eax, str.Korean
ret
mov eax, str.Portuguese
ret
mov eax, str.Polish
ret
mov eax, str.Russian
ret
mov eax, str.Czech
ret
mov eax, str.Turkish
ret
mov eax, str.Belarusian
ret
mov eax, str.Ukrainian
ret
mov eax, str.Serbian
ret
mov eax, str.Hungarian
ret
mov eax, str.Romanian
ret
shr ecx, 0xa
sub ecx, 1
je 0x457e25
sub ecx, 1
jne case.0x457dab.6
mov eax, str.Chinese
ret
mov eax, str.TChinese
ret
mov eax, 0x600264
ret
push 0x69f32c
call fcn.005b0623
add esp, 4
cmp dword [0x69f32c], 0xffffffff
jne 0x457c46
push 0x5fe890
call fcn.005b0412
push 0x69f32c
call fcn.005b05d9
add esp, 8
jmp 0x457c46
Function at 0x458000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x458126
cmp byte [ebx], 0
je 0x458126
mov ecx, dword [0x69f100]
test ecx, ecx
je 0x458126
push dword [ebp + 0xc]
push ebx
call fcn.00457b50
test eax, eax
jne 0x458128
push esi
mov esi, dword [0x69f0f0]
test esi, esi
jne 0x45806f
mov ecx, dword [0x6962c8]
push 0x20
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x458063
push 0
push esi
call fcn.00450290
add esp, 8
jmp 0x458065
xor esi, esi
mov dword [0x69f0f0], esi
test esi, esi
je 0x45807a
push 0
push esi
call fcn.004502d0
add esp, 8
movzx eax, byte [ebx]
lea ecx, [ebx + 1]
push edi
mov edi, 0x811c9dc5
test eax, eax
je 0x4580a3
nop word [eax + eax]
imul edi, edi, 0x1000193
lea ecx, [ecx + 1]
xor edi, eax
movzx eax, byte [ecx - 1]
test eax, eax
jne 0x458090
mov eax, dword [0x69f0f8]
mov ecx, eax
mov ebx, dword [0x69f0f4]
sub ecx, ebx
sar ecx, 2
mov dword [ebp - 4], edi
test ecx, ecx
jle 0x4580e3
nop dword [eax]
mov edx, ecx
shr edx, 1
cmp dword [ebx + edx*4], edi
lea eax, [ebx + edx*4]
jae 0x4580d8
lea ebx, [eax + 4]
or eax, 0xffffffff
sub eax, edx
add ecx, eax
jmp 0x4580da
mov ecx, edx
test ecx, ecx
jg 0x4580c0
mov eax, dword [0x69f0f8]
cmp ebx, eax
je 0x4580ef
cmp edi, dword [ebx]
jb 0x4580ef
xor bl, bl
jmp 0x458100
lea eax, [ebp - 4]
mov ecx, 0x69f0f4
push eax
push ebx
call fcn.00456370
mov bl, 1
pop edi
test esi, esi
je 0x45810e
push esi
call fcn.004502e0
add esp, 4
pop esi
test bl, bl
je 0x458126
lea eax, [ebp + 8]
push eax
push str._LANG__error:_no_key__s_in_localization_table
push 3
call fcn.004453b0
add esp, 0xc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460c30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push ebx
push esi
push edi
push eax
call fcn.0045e510
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
cmp esi, edi
je 0x460d02
xor ecx, ecx
mov eax, 0x38e38e39
mov dword [ebp - 4], ecx
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x460cdb
xor ebx, ebx
lea ecx, [ebx + esi]
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x460c81
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x460c94
shr eax, 4
and al, 1
jne 0x460cb5
mov esi, dword [ebp - 0x10]
add esi, ebx
mov ecx, esi
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x460ca8
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x460cdf
mov edi, dword [ebp - 0xc]
mov eax, 0x38e38e39
mov esi, dword [ebp - 0x10]
mov ecx, edi
inc dword [ebp - 4]
sub ecx, esi
imul ecx
add ebx, 0x24
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 4], eax
jb 0x460c71
mov bl, 1
jmp 0x460d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0xb], 0
jge 0x460ced
mov esi, dword [esi]
push eax
push esi
push str.Couldnt_create_folder__s__error__d
call fcn.004631b0
mov edi, dword [ebp - 0xc]
add esp, 0xc
mov esi, dword [ebp - 0x10]
xor bl, bl
cmp esi, edi
je 0x460d5e
add esi, 0x17
nop dword [eax + eax]
cmp byte [esi + 0xc], 0
jge 0x460d26
mov eax, dword [esi + 1]
test eax, eax
je 0x460d26
push eax
call fcn.0044d750
add esp, 4
cmp byte [esi], 0
jge 0x460d3b
mov eax, dword [esi - 0xb]
test eax, eax
je 0x460d3b
push eax
call fcn.0044d750
add esp, 4
cmp byte [esi - 0xc], 0
jge 0x460d51
mov eax, dword [esi - 0x17]
test eax, eax
je 0x460d51
push eax
call fcn.0044d750
add esp, 4
add esi, 0x24
lea eax, [esi - 0x17]
cmp eax, edi
jne 0x460d10
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x460d6b
push esi
call fcn.0044d750
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x460d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x460d93
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x460da3
xor al, al
pop ebp
ret
shr eax, 4
and al, 1
pop ebp
ret
Function at 0x460db0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.005b0bc0
push ebx
push 0x1000
lea eax, [ebp - 0x100c]
push 0
push eax
call fcn.005d6d60
mov bl, byte [ebp + 8]
add esp, 0xc
xor eax, eax
mov byte [ebp + 8], bl
mov word [ebp + 0xa], ax
lea eax, [ebp - 0x100c]
mov byte [ebp + 9], 0x3a
push 0x1000
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x460e8f
cmp byte [ebp - 0x100c], 0x5c
lea ecx, [ebp - 0x100c]
jne 0x460e47
cmp byte [ebp - 0x100b], 0x3f
jne 0x460e47
cmp byte [ebp - 0x100a], 0x3f
jne 0x460e47
cmp byte [ebp - 0x1009], 0x5c
jne 0x460e47
push dword [ebp + 0xc]
push dword [ebp - 0x1008]
call fcn.00460db0
add esp, 8
test al, al
je 0x460ea7
lea ecx, [ebp - 0x1005]
cmp byte [ecx], 0
mov eax, ecx
mov byte [ebp - 0xc], 0
mov byte [ebp - 1], 0xb
je 0x460e5c
inc eax
cmp byte [eax], 0
jne 0x460e56
push eax
push ecx
lea ecx, [ebp - 0xc]
call fcn.004409b0
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
call fcn.0045cf90
test byte [ebp - 1], 0x80
je 0x460e88
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x460e88
push eax
call fcn.0044d750
add esp, 4
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
movzx eax, bl
push eax
push str.Couldnt_get_device_name_for_drive__c__error__d
call fcn.004631b0
add esp, 0xc
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461bf0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push edi
push eax
mov ecx, esi
call fcn.0045d030
mov eax, dword [ebp - 0x19]
test al, al
jns 0x461c13
mov ecx, dword [ebp - 0x20]
jmp 0x461c1d
movzx eax, al
mov ecx, 0xb
sub ecx, eax
test ecx, ecx
je 0x461c62
lea ecx, [ebp - 0x24]
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x461c31
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x461c44
shr eax, 4
and al, 1
jne 0x461c62
cmp byte [ebp + 0x10], 0
je 0x461d10
lea eax, [ebp - 0x24]
push eax
call fcn.00460c30
add esp, 4
test al, al
je 0x461d10
mov ecx, esi
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x461c71
mov eax, dword [eax]
push 0
push eax
call fcn.005c01a3
add esp, 8
test eax, eax
jne 0x461cbb
mov ecx, esi
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x461c8f
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x461cbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0xb], 0
jge 0x461caa
mov ecx, dword [esi]
jmp 0x461cac
mov ecx, esi
push eax
push ecx
push str.Couldnt_delete_file__s__error__d
call fcn.004631b0
add esp, 0xc
mov ecx, esi
call fcn.0045e410
mov ebx, eax
cmp byte [ebx + 0xb], 0
jge 0x461ccc
mov ebx, dword [ebx]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x461cde
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x461d14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0xb], 0
jge 0x461cf8
mov esi, dword [esi]
cmp byte [edi + 0xb], 0
jge 0x461d00
mov edi, dword [edi]
push eax
push esi
push edi
push str.Couldnt_rename__s_to__s__error__d
call fcn.004631b0
add esp, 0x10
xor bl, bl
jmp 0x461d16
mov bl, 1
cmp byte [ebp - 1], 0
jge 0x461d2c
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x461d2c
push eax
call fcn.0044d750
add esp, 4
cmp byte [ebp - 0xd], 0
jge 0x461d42
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x461d42
push eax
call fcn.0044d750
add esp, 4
cmp byte [ebp - 0x19], 0
jge 0x461d58
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x461d58
push eax
call fcn.0044d750
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x461d70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x461d86
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x461d96
mov al, 1
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0xb], 0
jge 0x461da4
mov esi, dword [esi]
push eax
push esi
push str.Couldnt_delete_file__s__error__d
call fcn.004631b0
add esp, 0xc
xor al, al
pop esi
pop ebp
ret
Function at 0x4621e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov al, byte [ebx + 0xb]
test al, al
jns 0x4621f8
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
jmp 0x462202
movzx eax, al
mov ecx, 0xb
sub ecx, eax
mov edi, dword [ebp + 8]
lea eax, [ecx + ebx]
mov ecx, edi
mov dword [ebp + 0xc], eax
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x46221a
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x46229f
cmp esi, 0xffffffff
je 0x46229f
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push 0
push ecx
sub eax, ebx
push eax
push ebx
push esi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x462286
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [edi + 0xb], 0
jge 0x462267
mov edi, dword [edi]
push eax
push edi
push str.Couldnt_write_file__s__error__d
call fcn.004631b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 4], eax
push esi
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [edi + 0xb], 0
jge 0x4622ad
mov edi, dword [edi]
push eax
push edi
push str.Couldnt_open_file__s__error__d
call fcn.004631b0
add esp, 0xc
test esi, esi
je 0x4622cc
cmp esi, 0xffffffff
je 0x4622cc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4622e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0045e410
cmp byte [eax + 0xb], 0
jge 0x4622f9
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x46236a
cmp esi, 0xffffffff
je 0x46236a
mov ebx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push 0
push edx
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
sub eax, ecx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46234f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [edi + 0xb], 0
jge 0x462348
mov edi, dword [edi]
mov ecx, str.Couldnt_write_file__s__error__d
jmp 0x46237d
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
cmp dword [ebp - 4], eax
push esi
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [edi + 0xb], 0
jge 0x462378
mov edi, dword [edi]
mov ecx, str.Couldnt_open_file__s__error__d
push eax
push edi
push ecx
call fcn.004631b0
add esp, 0xc
test esi, esi
je 0x4623a3
xor bl, bl
cmp esi, 0xffffffff
je 0x4623a3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463060
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
xor esi, esi
nop word [eax + eax]
mov eax, dword [esi + 0x6a1610]
test eax, eax
je 0x46309b
push 0
push dword [eax + 4]
call edi
mov ecx, dword [esi + 0x6a1610]
test ecx, ecx
je 0x463091
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x6a1610], 0
add esi, 4
cmp esi, 0x320
jb 0x463070
pop edi
pop esi
ret

Function at 0x475e50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi + 0xb], 0
jge 0x475e64
mov eax, dword [esi]
jmp 0x475e66
mov eax, esi
push eax
push str.Open_in_browser:__s
call fcn.004631b0
add esp, 8
cmp byte [esi + 0xb], 0
jge 0x475e7c
mov esi, dword [esi]
push 5
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [edi + 0x1c]
mov dword [edi + 0x44], 2
mov dword [edi + 0x20], 0
mov dword [edi + 0x18], 0
test ecx, ecx
je 0x475eb6
mov eax, dword [ecx]
push 0
push 0
push edi
push dword [edi + 0xc]
push ecx
call dword [eax]
pop edi
pop esi
pop ebp
ret 4
Function at 0x4873e0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
lea esi, [edi + 8]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x48740c
cmp byte [esi + 0xb], al
jge 0x4873f9
mov esi, dword [esi]
push esi
push str.Thread___s__is_already_running
call fcn.004631b0
add esp, 8
xor al, al
pop edi
pop esi
ret
lea ecx, [edi + 4]
call fcn.00462400
lea ecx, [edi + 0x14]
call fcn.00462400
cmp byte [esi + 0xb], 0
jge 0x487426
mov eax, dword [esi]
jmp 0x487428
mov eax, esi
push ebx
push eax
push str.Creating_thread___s_...
call fcn.004631b0
push 0
push 0
push edi
push 0x4874b0
push 0
push 0
call fcn.005b9f5c
mov ebx, eax
add esp, 0x20
mov eax, dword [edi + 0x18]
test eax, eax
je 0x48745a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x18], ebx
test ebx, ebx
je 0x487478
cmp ebx, 0xffffffff
je 0x487478
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 4]
call eax
pop ebx
test al, al
pop edi
sete al
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0xb], 0
jge 0x487486
mov esi, dword [esi]
push eax
push esi
push str.Couldnt_start_thread___s___error__d
call fcn.004631b0
add esp, 0xc
lea ecx, [edi + 0x14]
call fcn.00462410
pop ebx
pop edi
xor al, al
pop esi
ret