joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460fbc
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0x461050
call sub.kernel32.dll_GetModuleHandleA_2
test eax, eax
je 0x460fdf
mov eax, ebx
mov edx, 0x461064
call fcn.00405080
pop ebx
pop ebp
ret
push 0
push ebx
mov ecx, 0x461078
mov edx, 0x46108c
mov eax, 0x80000002
call fcn.00467208
mov eax, dword [ebx]
mov edx, 0x4610c0
call fcn.00405458
jne 0x461010
mov eax, ebx
mov edx, 0x4610e0
call fcn.00405080
mov eax, dword [ebx]
mov edx, 0x4610f0
call fcn.00405458
jne 0x46102a
mov eax, ebx
mov edx, 0x461110
call fcn.00405080
mov eax, dword [ebx]
mov edx, 0x461124
call fcn.00405458
jne 0x461046
mov eax, ebx
mov edx, 0x461144
call fcn.00405080
jmp 0x46104d
mov eax, ebx
call fcn.0040502c
pop ebx
pop ebp
ret

Function at 0x4614f4
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.0046118c
test al, al
jne 0x461507
xor eax, eax
jmp 0x461541
mov dword [ebp - 4], 0x40000000
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0046114c
cmp dword [ebp - 8], 0x61774d56
jne 0x46153b
cmp dword [ebp - 0xc], 0x4d566572
jne 0x46153b
cmp dword [ebp - 0x10], 0x65726177
je 0x46153f
xor eax, eax
jmp 0x461541
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x461738
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], 0x40000000
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0046114c
cmp dword [ebp - 8], 0x7263694d
jne 0x461772
cmp dword [ebp - 0xc], 0x666f736f
jne 0x461772
cmp dword [ebp - 0x10], 0x76482074
je 0x461776
xor eax, eax
jmp 0x461778
mov al, 1
test al, al
je 0x46179f
mov dword [ebp - 4], 0x40000001
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0046114c
cmp dword [ebp - 4], 0x31237648
sete al
mov esp, ebp
pop ebp
ret
Function at 0x461ab0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x461bd4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x574880], 0xff
je 0x461ade
movzx ebx, byte [0x574880]
jmp 0x461bb9
xor ebx, ebx
call fcn.0040ede8
test al, al
jne 0x461bb9
mov eax, dword [0x57aee4]
cmp dword [eax], 0
je 0x461bb9
push 4
lea eax, [ebp - 4]
push eax
push 0x461be4
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x461bb9
push 4
lea eax, [ebp - 4]
push eax
push 0x461bfc
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x461bb9
call fcn.00403544
mov esi, eax
test esi, esi
jle 0x461b68
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004035a4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00427d08
mov eax, dword [ebp - 8]
mov edx, 0x461c18
call fcn.00405458
je 0x461bb9
inc dword [ebp - 4]
dec esi
jne 0x461b3d
xor eax, eax
call fcn.00447100
test al, al
je 0x461bad
xor edx, edx
xor eax, eax
call fcn.0044710c
xor eax, eax
push ebp
push 0x461ba6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046198c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461bb2
mov dl, 1
xor eax, eax
call fcn.0044710c
ret
call fcn.0046198c
movzx ebx, byte [0x574880]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461bdb
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret
Function at 0x461df0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x461fc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040502c
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x461fa1
xor eax, eax
push ebp
push 0x461f9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x10]
call fcn.0040309c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x461f7c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x461f66
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
dec edi
test edi, edi
jns 0x461e9c
call fcn.00403edc
test edi, edi
jl 0x461f66
inc edi
xor ebx, ebx
cmp ebx, 0x400
jbe 0x461eb4
call fcn.00403edc
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [edx + eax*4 + 4]
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x400
jbe 0x461ed7
call fcn.00403edc
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov eax, dword [edx + eax*4 + 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405794
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405794
push dword [esi]
lea ecx, [ebp - 0x24]
mov edx, 0x1f
mov eax, dword [ebp - 8]
call fcn.00461dac
push dword [ebp - 0x24]
push ebp
lea eax, [ebp - 0x28]
call fcn.00461ce0
pop ecx
push dword [ebp - 0x28]
push 0x461fdc
mov eax, esi
mov edx, 4
call fcn.004053cc
inc ebx
dec edi
jne 0x461ea7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461f83
mov eax, dword [ebp - 0x14]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461fcb
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 8]
call fcn.0040502c
ret
Function at 0x46270c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
call fcn.00463904
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00462f74
test al, al
jne 0x4627c2
xor eax, eax
mov dword [ebp - 4], eax
push 0x4627f4
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4627c2
xor eax, eax
push ebp
push 0x4627bb
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4627a4
xor eax, eax
push ebp
push 0x46279d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4627a4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4627c2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
cmp dword [ebp - 4], 0
je 0x4627eb
push 0x462818
push 0x462834
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov ebx, esi
test esi, esi
je 0x4627eb
mov eax, dword [ebp - 4]
push eax
call ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x462840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 4], ecx
mov esi, edx
lea edi, [ebp - 0x184]
mov ecx, 0x5e
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x46293e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046270c
mov ebx, eax
push 0x462958
push esi
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x188]
call fcn.00428770
push dword [ebp - 0x188]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004053cc
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x46291b
xor eax, eax
push ebp
push 0x462910
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0x178
lea eax, [ebp - 0x184]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462917
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462945
lea eax, [ebp - 0x188]
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x462968
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x840], ecx
mov dword [ebp - 4], ecx
mov esi, edx
lea edi, [ebp - 0x83c]
mov ecx, 0x20c
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x462a6b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046270c
mov ebx, eax
push 0x462a84
push esi
push 0x462a9c
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x840]
call fcn.00428770
push dword [ebp - 0x840]
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053cc
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x462a48
xor eax, eax
push ebp
push 0x462a3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0x830
lea eax, [ebp - 0x83c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462a44
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462a72
lea eax, [ebp - 0x840]
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x462f74
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x462f99
mov dword [ebp - 5], eax
mov byte [ebp - 1], 0
lea eax, [ebp - 5]
push eax
push 0x462edc
call sub.user32.dll_EnumWindows
movzx edx, byte [ebp - 1]
mov eax, edx
pop ecx
pop ecx
pop ebp
ret

Function at 0x463880
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x14], eax
push 0x80000001
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.00439f9c
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
test eax, eax
jns 0x4638c1
call fcn.00403edc
push eax
push 0x463800
call sub.user32.dll_EnumWindows
test eax, eax
je 0x4638d9
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x4638ef
push 0
push ebx
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00439f9c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46639c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, 0x4663c8
call fcn.00466384
test al, al
je 0x4663b9
mov dword [ebx], 1
pop ebx
pop ebp
ret
xor eax, eax
mov dword [ebx], eax
pop ebx
pop ebp
ret

Function at 0x4663dc
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
cmp dword [eax], 0
je 0x4663f2
xor edx, edx
mov dword [eax], edx
mov eax, 0x4663fc
call fcn.00466390
pop ebp
ret
Function at 0x467608
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x46772a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, edi
call fcn.004050c4
cmp dword [ebp - 4], 0
je 0x46766f
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x467650
cmp eax, dword [edx - 4]
jb 0x467655
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x5c
jne 0x46766f
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004055ac
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x46770f
xor eax, eax
push ebp
push 0x467708
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405308
test eax, eax
jns 0x4676be
call fcn.00403edc
push eax
mov eax, ebx
call fcn.0040550c
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4676f1
call fcn.0042dff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467714
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
call fcn.0042dff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467731
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x4677c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x46791a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4677fc
mov ecx, 0x40b
mov edx, 0x467934
mov eax, 0x46795c
call fcn.00404f58
test edi, edi
jne 0x467814
mov ecx, 0x40c
mov edx, 0x467934
mov eax, 0x46795c
call fcn.00404f58
mov edx, ebx
mov eax, 0x467978
call fcn.00405650
test eax, eax
je 0x467838
mov ecx, 0x40d
mov edx, 0x467934
mov eax, 0x46795c
call fcn.00404f58
mov edx, ebx
mov eax, 0x467984
call fcn.00405650
test eax, eax
je 0x46785c
mov ecx, 0x40e
mov edx, 0x467934
mov eax, 0x46795c
call fcn.00404f58
cmp byte [0x68053c], 0
je 0x467894
mov eax, dword [ebp - 4]
push eax
push esi
push dword [0x680540]
push 0x467978
push ebx
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
mov edx, dword [ebp - 8]
mov ecx, edi
mov eax, 0x80000001
call fcn.00467208
jmp 0x4678ff
mov eax, esi
mov edx, 0x2800
call fcn.00405794
mov eax, dword [0x680540]
call fcn.0040550c
push eax
mov eax, dword [esi]
call fcn.00405308
test eax, eax
jns 0x4678bb
call fcn.00403edc
push eax
mov eax, dword [esi]
call fcn.0040550c
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, edi
call fcn.0040550c
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov edx, eax
mov eax, esi
call fcn.00405794
lea edx, [ebp - 0xc]
mov eax, dword [esi]
call fcn.00466fbc
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467921
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret
Function at 0x4698d8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x469acf
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x469937
lea edx, [ebp - 0x28]
mov eax, dword [0x57addc]
call fcn.0040765c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0041f6d4
mov eax, dword [ebp - 0x24]
mov ecx, 0x9e8
mov edx, 0x469ae8
call fcn.00404f58
mov byte [ebp - 0x11], 1
mov dl, 1
mov eax, dword [0x439390]
call fcn.00403fdc
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x469a65
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00469328
push dword [ebp - 4]
push 0x469b10
push 0x469b1c
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004053cc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, 0x3f
call fcn.004694d4
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x469a4f
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push dword [ebp - 4]
push 0x469b10
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x30]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4699fa
test al, 0x10
je 0x4699fa
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.004698d8
mov ebx, eax
jmp 0x469a35
cmp dword [ebp - 0x10], 0
je 0x469a0a
mov edx, eax
mov eax, dword [ebp - 8]
call dword [ebp - 0x10]
mov ebx, eax
test bl, bl
je 0x469a35
push 0x80
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x469a35
mov eax, dword [ebp - 8]
call fcn.00428e40
mov ebx, eax
test bl, bl
jne 0x469a43
mov byte [ebp - 0x11], 0
cmp byte [ebp - 9], 0
jne 0x469a4f
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x4699a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469a6c
lea eax, [ebp - 0x18]
call fcn.0042e580
ret
Function at 0x469c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x469c38
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x469d90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.00469bb8
cmp dword [ebp - 4], 0
jne 0x469c7d
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004035a4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.00428f74
test esi, esi
jne 0x469d24
lea eax, [ebp - 0x18]
push eax
call fcn.00427bac
lea edx, [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.0045c104
movzx eax, byte [0x469da0]
push eax
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x469dac
mov eax, dword [ebp - 8]
call fcn.00446614
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.004050c4
movzx eax, byte [0x469db0]
push eax
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 0x469dbc
mov eax, dword [ebp - 8]
call fcn.00446614
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.004050c4
movzx eax, byte [0x469db0]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, 0x469dc8
mov eax, dword [ebp - 8]
call fcn.00446614
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.004050c4
push dword [ebp - 4]
push dword [ebp - 8]
push 0x469dd4
mov eax, ebx
mov edx, 3
call fcn.004053cc
jmp 0x469d68
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00405794
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
push 0
mov eax, esi
call fcn.0040550c
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x469d68
lea eax, [ebp - 8]
call fcn.0046818c
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469d97
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x46ade4
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, edx
test edi, edi
jbe 0x46af5c
mov ebx, eax
mov eax, edi
mov esi, 3
xor edx, edx
div esi
mov esi, eax
test esi, esi
jns 0x46ae09
call fcn.00403edc
test esi, esi
jle 0x46ae9d
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae38
call fcn.00403edc
movzx edx, byte [edx + 0x57534c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae53
call fcn.00403edc
movzx edx, byte [edx + 0x57534c]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae6f
call fcn.00403edc
movzx edx, byte [edx + 0x57534c]
mov byte [ecx + 2], dl
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46ae86
call fcn.00403edc
movzx eax, byte [eax + 0x57534c]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x46ae11
mov eax, edi
mov esi, 3
xor edx, edx
div esi
dec edx
je 0x46aeb3
dec edx
je 0x46aef8
jmp 0x46af5c
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46aecb
call fcn.00403edc
movzx edx, byte [edx + 0x57534c]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46aee4
call fcn.00403edc
movzx eax, byte [eax + 0x57534c]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x46af5c
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46af19
call fcn.00403edc
movzx edx, byte [edx + 0x57534c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46af34
call fcn.00403edc
movzx edx, byte [edx + 0x57534c]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46af4e
call fcn.00403edc
movzx eax, byte [eax + 0x57534c]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
pop edi
pop esi
pop ebx
ret