joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fe0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov eax, 0x1010
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
call fcn.0040acf0
sub esp, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x40e328
mov dword [esp], eax
call fcn.004031b0
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00404e70
test eax, eax
mov edi, eax
je 0x4050e4
test ebx, ebx
je 0x4050e4
lea esi, [esp + 0x10]
mov dword [esp], ebx
call sub.msvcr100.dll_feof
test eax, eax
jne 0x4050e0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x1000
mov dword [esp], esi
call sub.msvcr100.dll_fread
cmp eax, 0xffffffff
je 0x4050c0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x1000
mov dword [esp], esi
call sub.msvcr100.dll_fwrite
test eax, eax
jle 0x40508f
mov dword [esp], edi
call sub.msvcr100.dll_ferror
test eax, eax
je 0x405032
mov dword [esp], edi
mov esi, 0xffffffff
call sub.msvcr100.dll_clearerr
mov dword [esp], ebx
call sub.msvcr100.dll_fclose
mov dword [esp], edi
call sub.msvcr100.dll_fclose
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sub.msvcr100.dll_ferror
test eax, eax
je 0x405032
mov dword [esp], ebx
mov esi, 0xffffffff
call sub.msvcr100.dll_clearerr
jmp 0x40509c
xor esi, esi
jmp 0x40509c
mov eax, 0xffffffff
jmp 0x4050ae
Function at 0x405170
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
mov eax, 0x20a8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.0040acf0
sub esp, eax
mov eax, dword [ecx]
lea esi, [ebp - 0x2018]
mov dword [esp + 8], 0x1000
mov dword [ebp - 0x207c], 0
lea edi, [ebp - 0x205c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00405770
mov dword [esp + 4], 1
mov dword [esp], 0x16
call sub.msvcr100.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.msvcr100.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 0xf
call sub.msvcr100.dll_signal
mov dword [esp + 4], 1
mov dword [esp], 0x15
call sub.msvcr100.dll_signal
mov dword [ebp - 0x2078], 0xc
mov dword [ebp - 0x2074], 0
mov dword [ebp - 0x2070], 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
sub esp, 4
mov dword [ebp - 0x2058], 0
mov word [ebp - 0x202c], ax
mov eax, dword [sym.imp.msvcr100.dll__iob]
mov dword [ebp - 0x2054], 0
mov dword [ebp - 0x2050], 0
mov dword [ebp - 0x2030], 0x101
mov dword [esp], eax
call sub.msvcr100.dll__fileno
mov ebx, dword [sym.imp.msvcr100.dll__get_osfhandle]
mov dword [esp], eax
call ebx
mov dword [ebp - 0x2024], eax
mov eax, dword [sym.imp.msvcr100.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcr100.dll__fileno
mov dword [esp], eax
call ebx
mov dword [ebp - 0x2020], eax
mov eax, dword [sym.imp.msvcr100.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcr100.dll__fileno
mov dword [esp], eax
call ebx
mov dword [ebp - 0x201c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [ebp - 0x206c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], edx
lea edx, [ebp - 0x2078]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x405332
mov dword [esp], str.Error_creating_child_process__n
call fcn.00401ee0
lea esp, [ebp - 0x10]
mov eax, 0xffffffff
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [ebp - 0x206c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x207c]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x206c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x207c]
sub esp, 8
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x40a190
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcr100.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcr100.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcr100.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcr100.dll_vfprintf
call sub.msvcr100.dll_abort
jmp fcn.0040a1f0

Function at 0x40a1f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x41e640]
test eax, eax
jle 0x40a2f3
mov edx, dword [0x41e644]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x40a221
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x40a296
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x40a210
mov dword [esp], esi
call fcn.0040aad0
test eax, eax
mov edi, eax
je 0x40a31a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x41e644]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.0040abc0
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x41e644]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40a2fa
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x40a2a0
add dword [0x41e640], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x40a28f
cmp eax, 0x80
je 0x40a28f
cmp eax, 8
je 0x40a28f
mov eax, dword [ebp - 0x28]
add esi, dword [0x41e644]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40a28f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040a190
xor ebx, ebx
jmp 0x40a22b
mov eax, dword [0x41e644]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040a190
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040a190
lea esi, [esi]

Function at 0x40a9f0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40aa28
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x40aa1e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x40aa2a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40aa10
xor eax, eax
pop ebx
pop esi
ret
Function at 0x412a80
Capabilities:
Encode data using xor

Disassembly:
fst dword [esi + 0x1d]
and bl, bl
cmp ebp, dword [eax - 0x20366c2]
cdq
cld
std
mov eax, dword [0x3bba7167]
xor eax, 0x3550854d
add bl, ch
in eax, dx
add bl, byte [esi + 0x366c24d5]
inc edi
pop es
mov esi, 0xe49746b
jecxz 0x412a88
cmc
jo 0x412ace
mov bh, 0x46
push ds
in al, 0xa5
cmp dword [esi - 0x69], esp
mov dword [ecx], esp
sbb al, 0xe9
add dword [edx + 0x5d], esi
jo 0x412b04
or eax, 0x105b891e
popal
sbb ah, byte [eax - 0x72]
push esi
pop ebp
lds ebp, [ecx]
sub edx, dword [ecx - 0x77]
out dx, al
mov byte cs:[0x13f44ead], al
mov byte [0x13f44ead], al
dec esi
hlt
ror byte [ebx], cl
mov ds, word [ebp - 0x73eba2b3]
dec ebp
pop ebp
adc al, 0x8c
mov cl, byte [edx]
or al, 0xbc
cdq
jmp 0x69f5bf
cmp ebx, dword [eax - 0x1f]
das
daa
stosd dword es:[edi], eax
loope 0x412ad7
mov dl, 0x92
jae 0x412aa8
xchg edx, eax
jl 0x412b3a
pop esi
rcr dword [edx], 0xb5
in al, 0xbd
dec eax
and dword [esi + 0x4e], esp
xor al, byte [ebp + 0x43]
mov esi, esp
jge 0x412b1f
sbb ch, ch
xor al, 0x12
in eax, 0xf
and ebp, esp
jns 0x412ad0
adc eax, 0xf28d7dd7
mov byte [eax - 0x5f], bh
xlatb
jge 0x412aaf
mov byte [eax - 0x5f], bh
xchg esi, eax
cmp byte [esi + 0x656bdb8], ah
insb byte es:[edi], dx
nop
out dx, eax
js 0x412af4
mov al, 0xd1
salc
rcl dword [ecx + 0x787444ee], cl
out dx, al
inc esp
je 0x412bb3
js 0x412b6a
pop edx
pop edx
les edi, [esi + 0x22]
sbb bl, byte [ebp - 0x79]
scasd eax, dword es:[edi]
xor bl, byte [eax - 0x52]
adc eax, 0x83f20d6f
pop ds
or eax, ebp
add dl, byte [edi]
add edi, dword [ecx - 0x7d]
sub al, 0x45
jp 0x412b37
jae 0x412b76
sahf
sbb eax, 0x3a93831c
scasd eax, dword es:[edi]
and dword [esi - 0x521bc92b], esp
mov eax, dword [0xcdaf266a]
sub esi, eax
inc edx
into
fdivr qword [eax + edi*4]
mov bl, 3
scasd eax, dword es:[edi]
int 0x2b
invalid
xchg esp, eax
dec ebp
retf
sahf
adc al, 0x14
mov byte [0x61563058], al
jno 0x412c13
hlt
lodsb al, byte [esi]
das
insd dword es:[edi], dx
and al, 0xc1
cmp al, 0xb1
mov word [edi + 0x3d9e9403], cs
sar byte [edx], 1
lea edx, [esi + ecx*8 + 0x3e]
adc eax, 0x488a8289
cmp byte [edi - 0x51], ah
mov ch, 0xb2
push ds
xchg edx, eax
add al, 0x31
cmp byte [ecx - 0x5b7d93f], bh
mov edi, 0xdf8d7b05
fsetpm
les esp, [ecx]
pop ecx
xchg edi, eax
jmp 0xe6722b6a
Function at 0x412f40
Capabilities:
Encode data using xor

Disassembly:
fstp qword [ebp - 5]
ror byte [esi - 0x7e], 1
iretd
mov word [ecx + 0x165f3cc3], es
imul dword [eax - 0x80]
cwde
cmp eax, 0xed18bb1a
push edi
lodsb al, byte [esi]
sbb bh, byte [ebx - 0x53a812e8]
xor al, byte [eax + 0x6b34192f]
das
sbb dword [ebx + ebp*2], esi
adc cl, byte [edx + 0x1a]
loope 0x412f4b
dec edx
mov ch, byte [ecx + 0x703ad193]
not byte [edx - 0x34]
shl byte [eax + 0x26], 1
jp 0x412fa4
fld qword [edi]
loopne 0x412f0e
jbe 0x412f53
cmp eax, 0xf01a2412
loop 0x412f93
je 0x412f89
pushfd
int 0x3d
mov ss, word [edx - 0x37]
or eax, 0xd3e03f10
sub ebp, edx
push cs
inc dword [ebx + 0x1b]
jno 0x412fdc
jne 0x412f49
neg byte [ebx - 0x5114e652]
sbb ebx, ebp
scasb al, byte es:[edi]
dec ecx
mov edi, dword [ebx + edi + 0x66cc9be1]
mov dh, 0x3f
sbb byte [edi], dh
lds esp, [esi + 0x30bd2738]
pop edx
mov byte [edx - 0x46be5d32], 0xfc
xor bl, byte [ecx - 0x18eabf68]
invalid
cmp byte [edi], ah
mov ebp, 0x82c65a30
into
mov byte [0x32fcb941], al
cdq
cwde
inc eax
adc eax, 0xe70c6e7
xor ebx, dword [ecx + 0x27e377e]
dec esp
into
jle 0x413003
wait
push edx
mov ecx, edx
insb byte es:[edi], dx
or al, byte [esi - 0x7d]
inc eax
jge 0x412fee
jg 0x412fe3
or al, byte [eax + 0x27]
push ebx
mov edi, 0xc7da4579
lds esp, [edx + 0x65]
in eax, 0x2f
call [ebx]
invalid
mov ecx, 0x60c3bd7
mov al, byte [0xb0adc4b1]
xchg eax, ebp
call 0xcb7ca904
retf
adc dword [ecx + 0x3b], edi
retf
xchg byte [edx + 0x21d32a6d], bl
mov dl, 0x6c
xlatb
dec ecx
loop 0x412fef
js 0x412fcb
call 0xefc9102c
out dx, al
wait
out dx, eax
sub dword [ebx + ebx - 0x30f7fd34], ebp
iretd
Function at 0x45fa60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret 4

Function at 0x461d30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.00474490
add esp, 8
cmp dword [ebp + 8], 0
je 0x461d7a
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x4d90e8
call fcn.0040a720
push eax
lea ecx, [ebp - 0x148]
push ecx
call fcn.00473c05
add esp, 0x10
jmp 0x461d9c
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x4d9114
call fcn.0040a720
push eax
lea ecx, [ebp - 0x148]
push ecx
call fcn.00473c05
add esp, 0x10
push 0
lea edx, [ebp - 0x48]
push edx
push 0
push 0x20006
push 0
push 0x4f9cb0
push 0
lea eax, [ebp - 0x148]
push eax
push 0x80000001
call dword [0x4ff3ac]
test eax, eax
jne 0x461df7
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 3
push 0
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
test eax, eax
jne 0x461ded
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x48]
push edx
call dword [0x4fab64]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x462a30
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], 0
push 0xc8
push 0
lea eax, [ebp - 0xe0]
push eax
call fcn.00473c80
add esp, 0xc
push 0
lea ecx, [ebp - 4]
push ecx
push 0xc8
lea edx, [ebp - 0xe0]
push edx
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0x2d1400
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.kernel32.dll_DeviceIoControl]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x462af6
lea edx, [ebp - 0xe0]
mov dword [ebp - 0xe4], edx
push 0x24
mov eax, dword [ebp - 0xe4]
add eax, 0x28
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004738d0
add esp, 0xc
mov dword [ebp - 0xc], 0
jmp 0x462ad5
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0x24
jae 0x462af6
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov dl, byte [eax]
xor dl, byte [ecx + 1]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov byte [eax], dl
jmp 0x462acc
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x462b00
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
push 0xc8
push 0
lea eax, [ebp - 0xdc]
push eax
call fcn.00473c80
add esp, 0xc
push 0
lea ecx, [ebp - 4]
push ecx
push 0xc8
lea edx, [ebp - 0xdc]
push edx
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_DeviceIoControl]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x462b84
push 0x20
lea edx, [ebp - 0xdc]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004738d0
add esp, 0xc
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x46c7d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
push 0x4e3ca8
lea ecx, [ebp - 0x20]
push ecx
call fcn.00473c05
add esp, 0xc
lea edx, [ebp - 0x20]
push edx
push 0
push 0x1f0003
call dword [sym.imp.kernel32.dll_OpenEventA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x46c950
cmp dword [0x4d77c8], 0
je 0x46c833
cmp dword [0x4d77cc], 0
je 0x46c833
call fcn.004615e0
mov dword [0x4d77cc], 0
mov dword [0x4fe720], 0
mov eax, dword [0x4f9a68]
push eax
mov ecx, dword [0x4fe720]
push ecx
mov edx, dword [0x4fa9a0]
push edx
call dword [0x4fccc0]
call dword [0x4fcff4]
cmp dword [0x4f9a50], 0
je 0x46c872
mov eax, dword [0x4f9a50]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x502aec], 0
je 0x46c888
mov ecx, dword [0x502aec]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x4f9c84], 0
je 0x46c89e
mov edx, dword [0x4f9c84]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x4f9bec], 0
je 0x46c8b3
mov eax, dword [0x4f9bec]
push eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
cmp dword [0x4f9a68], 0
je 0x46c8c9
mov ecx, dword [0x4f9a68]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x4f9a54], 0
je 0x46c8df
mov edx, dword [0x4f9a54]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x4f9a58], 0
je 0x46c8f4
mov eax, dword [0x4f9a58]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x4f9a5c], 0
je 0x46c90a
mov ecx, dword [0x4f9a5c]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x4f9a60], 0
je 0x46c920
mov edx, dword [0x4f9a60]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x4f9a6c], 0
je 0x46c935
mov eax, dword [0x4f9a6c]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.kernel32.dll_SetEvent]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0xe
call fcn.004737ee
mov esp, ebp
pop ebp
ret
Function at 0x46cb00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.00474580
add esp, 4
add eax, 0x11
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00475174
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x46cbcb
cmp dword [ebp + 8], 0x30
je 0x46cb69
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x10010]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x10010]
add ecx, 1
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x10010], ecx
jmp 0x46cb72
mov eax, dword [ebp - 8]
mov dword [eax], 0
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x10
push ecx
call fcn.00474490
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0xc]
call fcn.0046cf90
mov byte [ebp - 4], al
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00475182
add esp, 4
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46cc80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
mov dword [ebp - 0x114], ecx
mov eax, dword [ebp - 0x114]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp + 0xc]
sub eax, 4
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x20], eax
push 0x4e3ce4
call fcn.0040a720
push eax
push 0x1388
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x24], eax
push 0x4e3cf4
call fcn.0040a720
push eax
push 0x1388
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreA]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x28], eax
mov dword [ebp - 0x108], 0
jmp 0x46cd19
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
cmp dword [ebp - 0x108], 4
jge 0x46cd6a
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4e3d0c
call fcn.0040a720
push eax
lea edx, [ebp - 0x100]
push edx
call fcn.00473c05
add esp, 0x10
lea eax, [ebp - 0x100]
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0x114]
mov dword [edx + ecx*4 + 8], eax
jmp 0x46cd0a
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov edx, dword [ebp - 0x114]
mov dword [edx + 4], eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x104], eax
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x18], eax
cmp dword [ebp - 0x104], 0xb7
je 0x46cdff
push 8
mov ecx, dword [ebp - 0x114]
call fcn.0046cc40
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
push 8
lea eax, [ebp - 0x110]
push eax
push 0
mov ecx, dword [ebp - 0x114]
call fcn.0046cee0
mov ecx, dword [ebp - 0x114]
mov esi, dword [ecx + 0x1c]
sub esi, 4
mov ecx, dword [ebp - 0x114]
call fcn.0046cc60
sub esi, eax
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x20], esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x46d190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x202]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x46d200
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x46d1d1
xor eax, eax
jmp 0x46d202
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
jmp 0x46d202
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x46d210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov dword [ebp - 0x204], ecx
lea eax, [ebp - 0x100]
push eax
push 0xff
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x204]
add ecx, 4
push ecx
lea edx, [ebp - 0x100]
push edx
push 0x4e3d1c
lea eax, [ebp - 0x200]
push eax
call fcn.00473c05
add esp, 0x10
lea ecx, [ebp - 0x200]
push ecx
mov edx, dword [ebp - 0x204]
add edx, 0x103
push edx
call fcn.00474490
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0x204]
call fcn.0046d190
test eax, eax
je 0x46d295
mov eax, dword [ebp - 0x204]
add eax, 0x103
jmp 0x46d2a0
mov eax, dword [ebp - 0x204]
add eax, 0x103
mov esp, ebp
pop ebp
ret

Function at 0x46db60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.00474610
add esp, 8
test eax, eax
jne 0x46dc13
push 0x100
lea ecx, [ebp - 0x348]
push ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x348]
push edx
call fcn.00474580
add esp, 4
movsx eax, byte [ebp + eax - 0x349]
cmp eax, 0x5c
jne 0x46dbc4
lea ecx, [ebp - 0x348]
push ecx
call fcn.00474580
add esp, 4
mov byte [ebp + eax - 0x349], 0
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x46dbf2
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x348]
push ecx
push 0x4e3d58
lea edx, [ebp - 0x248]
push edx
call fcn.00473c05
add esp, 0x10
jmp 0x46dc11
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x348]
push ecx
push 0x4e3d68
lea edx, [ebp - 0x248]
push edx
call fcn.00473c05
add esp, 0x10
jmp 0x46dc26
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.00474490
add esp, 8
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x148], 0xffffffff
je 0x46dc64
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8