joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a550
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
je 0x40a56e
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40a56e
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
jmp 0x40a575
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], 0
je 0x40a593
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx]
test edx, edx
je 0x40a593
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
jmp 0x40a59a
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0x10], ecx
call fcn.00409750
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0040a3e0
add esp, 8
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x415100
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_connect]
pop ebp
ret

Function at 0x4243be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x424406
call fcn.00430309
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x424406
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x424449
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x424432
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x424432
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x424446
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x425788
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4257ac
cmp dword [edi + 0x54], 0
jne 0x4257ac
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00430309
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00425749
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x427681
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00430309
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x4276ae
xor eax, eax
jmp 0x427754
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x4276a7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4276a7
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004230f4
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x427705
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x4276f4
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.004263b9
push edi
mov ebx, eax
call fcn.00423123
pop ecx
test ebx, ebx
je 0x427747
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00426a96
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00426b4a
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x42ed52
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42ed99
call fcn.00430309
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42ed99
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42edb5
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042e8ca
mov esi, eax
test edi, edi
je 0x42edb3
test ebx, ebx
je 0x42edb3
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42f5a9
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4a20d3
call fcn.0044af20
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x42f5ce
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42f614
lea ecx, [ebp - 0x10]
call fcn.00404fb0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042edbc
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404f50
mov eax, esi
call fcn.0044aff8
ret 8

Function at 0x446530
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d1968]
jne 0x44653a
repz ret
jmp fcn.0044de72

Function at 0x456e72
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044d7d6
and dword [ebp - 4], 0
cmp dword [0x4d8488], 0
mov ebx, eax
jne 0x456f23
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x456fd4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x456fd4
push eax
call fcn.0044d764
mov dword [esp], 0x4b1774
push edi
mov dword [0x4d8488], eax
call esi
push eax
call fcn.0044d764
mov dword [esp], 0x4b1760
push edi
mov dword [0x4d848c], eax
call esi
push eax
call fcn.0044d764
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d8490], eax
call esi
push eax
call fcn.0044d764
pop ecx
mov dword [0x4d8498], eax
test eax, eax
je 0x456f23
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044d764
pop ecx
mov dword [0x4d8494], eax
mov eax, dword [0x4d8494]
cmp eax, ebx
je 0x456f7b
cmp dword [0x4d8498], ebx
je 0x456f7b
push eax
call fcn.0044d7df
push dword [0x4d8498]
mov esi, eax
call fcn.0044d7df
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x456f7b
test edi, edi
je 0x456f7b
call esi
test eax, eax
je 0x456f72
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x456f72
test byte [ebp - 0xc], 1
jne 0x456f7b
or dword [ebp + 0x10], 0x200000
jmp 0x456fb4
mov eax, dword [0x4d848c]
cmp eax, ebx
je 0x456fb4
push eax
call fcn.0044d7df
pop ecx
test eax, eax
je 0x456fb4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x456fb4
mov eax, dword [0x4d8490]
cmp eax, ebx
je 0x456fb4
push eax
call fcn.0044d7df
pop ecx
test eax, eax
je 0x456fb4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d8488]
call fcn.0044d7df
pop ecx
test eax, eax
je 0x456fd4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x456fd6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4621a0
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4a32d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x461970
push 0x4d8718
call fcn.00461b80
mov eax, dword [0x4d8720]
add esp, 8
test eax, eax
je 0x4621fa
mov ecx, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call fcn.0044653f
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea edx, [esp + 4]
push edx
mov dword [esp + 0x20], 0
call fcn.004019d0
int3

Function at 0x462230
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4a3308
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x4d8720]
test eax, eax
jne 0x462262
xor esi, esi
jmp 0x46226b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x462297
cmp dword [esi + 0x14], 0
jne 0x4622d9
cmp dword [esi + 0x10], 0
jne 0x4622e0
push 0
call fcn.004621a0
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x4622c5
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4622c5
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x462320
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x46230e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x4622e0
cmp dword [esi + 0x14], 0
je 0x462287
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x462345
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x462376
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x462376
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x462376
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x46232a
jmp 0x462281
Function at 0x462410
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4a3358
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x462390
push 0
push 0
call fcn.0044b87d
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x46247b
lea ecx, [esp + 0x10]
call fcn.0044653f
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.004019d0
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x4624a1
cmp eax, 0xffffffff
je 0x4624a1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x463590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a3458
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d1968]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov esi, ecx
mov ecx, dword [esp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.00463350
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.004631b0
cmp dword [esp + 0x24], 0x10
jb 0x46362a
mov edx, dword [esp + 0x10]
push edx
call fcn.00423123
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00446530
add esp, 0x30
ret 0x1c

Function at 0x463650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a3488
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d1968]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4c]
mov esi, ecx
xor ecx, ecx
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x50]
push edx
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.00463420
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.00463280
cmp dword [esp + 0x24], 8
jb 0x4636ec
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00423123
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00446530
add esp, 0x30
ret 0x1c

Function at 0x464880
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x46489b
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x464a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a37a3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov edx, 7
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], ecx
mov word [eax + 4], si
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x30], ecx
mov word [eax + 0x20], dx
mov dword [eax + 0x50], 0xf
mov dword [eax + 0x4c], ecx
mov byte [eax + 0x3c], cl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4652f0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x4a3900
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
cmp eax, 1
jne 0x465348
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x465334
mov dword [esi], 0
call fcn.00466160
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret
cmp eax, 3
je 0x4653c3
cmp eax, 0xb
je 0x4653c3
push str.boost::filesystem::remove
lea ecx, [esp + 0x2c]
call fcn.0041e6f0
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x58]
push ecx
push eax
push eax
mov dword [esp + 0x5c], 1
call fcn.00464880
add esp, 4
test al, al
sete dl
movzx eax, dl
push eax
call fcn.00465160
add esp, 0x10
cmp dword [esp + 0x40], 0x10
mov bl, al
jb 0x4653a7
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00423123
add esp, 4
test bl, bl
je 0x465442
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret
push 0x19
xor esi, esi
push str.boost::filesystem::remove
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], esi
mov byte [esp + 0x18], 0
call fcn.0041e610
mov dword [esp + 0x4c], esi
mov esi, dword [esp + 0x54]
cmp dword [esi + 0x18], 8
jb 0x4653f9
mov eax, dword [esi + 4]
jmp 0x4653fc
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x5c]
test eax, eax
setne al
lea edx, [esp + 0xc]
push edx
test al, al
sete dl
push ecx
movzx eax, dl
push esi
push eax
call fcn.00465160
add esp, 0x10
cmp dword [esp + 0x24], 0x10
mov bl, al
jb 0x46543a
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00423123
add esp, 4
test bl, bl
jne 0x465334
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret

Function at 0x465580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp dword [ebx + 0x18], 8
push edi
jb 0x465591
mov eax, dword [ebx + 4]
jmp 0x465594
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4655ba
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.00465460
mov eax, dword [eax]
add esp, 0xc
pop edi
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4655d1
mov dword [esi], 0
call fcn.00466160
mov dword [esi + 4], eax
pop esi
test edi, 0x400
je 0x465604
push ebx
call fcn.004648b0
add esp, 4
test al, al
je 0x4655fc
mov edx, edi
and dl, 0x10
movzx eax, dl
neg eax
sbb eax, eax
and eax, 7
pop edi
add eax, 4
pop ebx
ret
pop edi
mov eax, 9
pop ebx
ret
mov eax, edi
and eax, 0x10
or eax, 0x20
pop edi
shr eax, 4
pop ebx
ret
Function at 0x465720
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4a3988
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x19
push str.boost::filesystem::rename
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.0041e610
mov edx, dword [esp + 0x3c]
mov ecx, 8
mov dword [esp + 0x30], 0
cmp dword [edx + 0x18], ecx
jb 0x465785
mov esi, dword [edx + 4]
jmp 0x465788
lea esi, [edx + 4]
mov eax, dword [esp + 0x38]
cmp dword [eax + 0x18], ecx
jb 0x465796
mov ecx, dword [eax + 4]
jmp 0x465799
lea ecx, [eax + 4]
lea edi, [esp + 0xc]
push edi
mov edi, dword [esp + 0x44]
push edi
push edx
push eax
push 1
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
sete al
movzx ecx, al
push ecx
call fcn.004651e0
add esp, 0x14
cmp dword [esp + 0x24], 0x10
jb 0x4657d4
mov edx, dword [esp + 0x10]
push edx
call fcn.00423123
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x4657f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4a39c0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x465827
mov eax, dword [esi]
jmp 0x465829
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46585f
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
push eax
push edi
push esi
call fcn.00465460
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
test ebx, 0x400
je 0x46595e
cmp dword [edi + 0x18], 8
jb 0x465879
mov ecx, dword [esi]
mov dword [esp + 0x40], ecx
jmp 0x46587d
mov dword [esp + 0x40], esi
push 0
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x18]
call fcn.00403890
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 0
jae 0x4658a4
lea eax, [esp + 0x14]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x40], esi
cmp dword [esp + 0x28], 8
mov byte [esp + 0x34], 2
jb 0x4658d9
mov eax, dword [esp + 0x14]
push eax
call fcn.00423123
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], cx
cmp esi, 0xffffffff
jne 0x46591d
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
push edx
push edi
push esi
call fcn.00465460
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
push edi
call fcn.004648b0
add esp, 4
mov dword [esp + 0x34], 0xffffffff
push esi
test al, al
jne 0x465958
mov edi, dword [esp + 0x40]
mov dword [edi], 9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x44]
test esi, esi
je 0x465974
mov dword [esi], 0
call fcn.00466160
mov dword [esi + 4], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 3
test bl, 0x10
jne 0x46598d
mov dword [esp + 0x40], 2
mov ecx, dword [eax]
mov eax, dword [esp + 0x3c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x466f60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x466f91
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movzx edi, word [ecx]
lea esi, [esi + edi - 0x61c88647]
add ecx, 2
xor eax, esi
cmp ecx, edx
jne 0x466f70
pop edi
pop esi
ret
Function at 0x46eaa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a4078
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d1968]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0041c7b0
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x46eaea
add edi, 0x28
jmp 0x46eaec
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x46eb04
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4