joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f9f4
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x41fbde
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x50d45c], 0
jne 0x41fbc3
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x41fbbc
xor eax, eax
push ebp
push 0x41fbb5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x41fb9e
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x41fb98
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x50ce20]
call fcn.00406714
mov eax, dword [ebp - 0x24]
call fcn.004039b8
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x41facc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x50ce24]
call fcn.00406714
mov eax, dword [ebp - 0x28]
call fcn.004039b8
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x41faff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x50ce28]
call fcn.00406714
mov eax, dword [ebp - 0x2c]
call fcn.004039b8
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x41fb32
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x41fb84
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x41fb4f
cmp eax, dword [ebp - 0x10]
je 0x41fb80
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x41fb64
cmp eax, dword [ebp - 0x18]
je 0x41fb80
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x1c]
jne 0x41fb79
cmp eax, dword [ebp - 0x20]
je 0x41fb80
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x41fb3c
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push ebx
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fbbc
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
ret
mov byte [0x50d45c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fbe5
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040354c
ret
Function at 0x4253bc
Capabilities:
Terminate process

Disassembly:
push 0x30
mov eax, 0x4cf743
call fcn.004b17f0
lea eax, [ebp - 0x3c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004237b9
push 1
push str.msiexec.exe
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00464890
pop ecx
pop ecx
test eax, eax
jne 0x425499
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push str.DoMsiTrackerStop:_no_msiexec.exe_currently_running
push eax
call fcn.00466a00
pop ecx
pop ecx
call fcn.00424c71
pop ecx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push str.DoMsiTrackerStop:_uninjecting_services.exe
push eax
call fcn.00466a00
pop ecx
pop ecx
call fcn.00424c71
pop ecx
push ebx
push dword [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.services.exe
call fcn.0042341f
call fcn.00424f74
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0046db80
add esp, 4
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [eax]
push str.DoMsiTrackerStop:_uninject_services.exe_returned:__s
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.00424c71
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], bl
call fcn.0043ea93
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
call fcn.004b18c8
ret
mov esi, dword [ebp - 0x30]
cmp esi, dword [ebp - 0x2c]
jbe 0x4254a6
call fcn.004aba61
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], esi
jbe 0x4254bc
call fcn.004aba61
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x4254c8
cmp eax, dword [ebp - 0x3c]
je 0x4254cd
call fcn.004aba61
cmp dword [ebp - 0x18], esi
je 0x42540c
lea esi, [ebp - 0x1c]
call fcn.0043eaf7
push dword [eax]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
call fcn.0043eaf7
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [eax]
cmp edi, ebx
je 0x425521
push str.DoMsiTrackerStop:_killing_msiexec.exe_PID__d
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.00424c71
pop ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x425535
push str.DoMsiTrackerStop:_cant_open_msiexec.exe_PID__d
push ecx
call fcn.00466a00
add esp, 0xc
call fcn.00424c71
pop ecx
lea edi, [ebp - 0x24]
lea esi, [ebp - 0x1c]
call fcn.00425687
jmp 0x4254af
Function at 0x42572b
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x45c
mov eax, 0x4cc798
call fcn.004b1859
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x454], eax
push 0x5c
push ecx
xor edi, edi
mov dword [ebp - 4], edi
mov eax, esp
mov dword [ebp - 0x458], esp
push eax
xor esi, esi
call fcn.00465890
pop ecx
lea eax, [ebp - 0x460]
push eax
call fcn.00466f10
add esp, 8
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x458], esp
push dword [ebp + 8]
push dword [ebp - 0x460]
push str._s:_CHttpStreaming::DownloadFileToMemory:__s
push eax
call fcn.00466a00
add esp, 0x10
call fcn.004256fb
mov eax, dword [0x5099ec]
pop ecx
cmp eax, edi
jne 0x4257c2
push edi
push edi
push edi
push edi
push str.http_cameyo_streaming
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [0x5099ec], eax
cmp eax, edi
je 0x4258b3
push edi
push edi
push edi
push edi
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x45c], eax
cmp eax, edi
je 0x425886
push edi
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push 0x13
push eax
mov dword [ebp - 0x458], 0x40
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea eax, [ebp - 0x50]
push 0x4dbd68
push eax
call fcn.004abb30
pop ecx
pop ecx
test eax, eax
jne 0x425878
mov esi, 0x4000
push esi
call fcn.004ac152
pop ecx
mov ebx, eax
lea eax, [ebp - 0x468]
push eax
push esi
push ebx
jmp 0x425855
add edi, dword [ebp - 0x468]
cmp dword [ebp - 0x468], esi
jne 0x425865
lea eax, [edi + 0x4000]
push eax
push ebx
call fcn.004ac3be
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0x468]
push eax
push esi
lea eax, [ebx + edi]
push eax
push dword [ebp - 0x45c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x42582a
mov eax, dword [ebp - 0x464]
mov dword [eax], ebx
mov eax, dword [ebp - 0x454]
xor esi, esi
mov dword [eax], edi
inc esi
push dword [ebp - 0x45c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x4258b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x464]
push eax
mov dword [ebp - 0x454], edi
call dword [sym.imp.WININET.dll_InternetGetLastResponseInfoW]
push ecx
mov eax, esp
mov dword [ebp - 0x454], esp
push dword [ebp - 0x460]
push str._s:_CHttpStreaming::DownloadFileToMemory:_out
push eax
call fcn.00466a00
add esp, 0xc
call fcn.004256fb
pop ecx
mov ecx, dword [ebp - 0x460]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
call fcn.004b18dc
ret
Function at 0x427f7b
Capabilities:
Enumerate files on windows

Disassembly:
push 0x274
mov eax, 0x4cc71a
call fcn.004b1859
xor esi, esi
push 0x24c
lea eax, [ebp - 0x260]
push esi
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x264], esi
call fcn.004ac220
pop ecx
pop ecx
mov eax, esp
mov dword [ebp - 0x26c], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.UnpackUtils_StampLocalCache:_FileNamePortion_s__FullStampLocalCache_s
push eax
call fcn.00466a00
add esp, 0x10
call fcn.004260b1
pop ecx
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x26c], esp
lea ecx, [ebp + 8]
push ecx
push str.EngineStamps_
push eax
call fcn.004236c3
lea eax, [ebp - 0x278]
add esp, 0xc
push eax
call fcn.00479360
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x274]
push str._s..stamp
push eax
call fcn.00466a00
add esp, 0x18
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ecx
mov ebx, eax
mov eax, esp
mov dword [ebp - 0x26c], esp
push dword [ebp - 0x274]
push str.UnpackUtils_FullStampLocalCache:_FindMask_s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.004260b1
pop ecx
cmp ebx, 0xffffffff
je 0x42816f
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x268]
call fcn.0042341f
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x280], esp
push 0x4d9c3c
call fcn.0042341f
push ecx
mov byte [ebp - 4], 6
lea eax, [ebp - 0x268]
mov dword [ebp - 0x27c], esp
mov ecx, esp
push eax
call fcn.00423aca
push ecx
mov dword [ebp - 0x270], esp
mov edi, esp
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push str.EngineStamps
mov byte [ebp - 4], 7
call fcn.0042341f
push edi
call fcn.00479360
add esp, 0xc
lea edi, [ebp - 0x26c]
mov byte [ebp - 4], 5
call fcn.00466550
add esp, 0xc
push eax
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 8
call fcn.00423aeb
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
mov eax, esp
mov dword [ebp - 0x270], esp
push dword [ebp - 0x268]
push str.UnpackUtils_FullStampLocalCache:_KillFile__s_
push eax
call fcn.00466a00
add esp, 0xc
call fcn.004260b1
lea eax, [ebp - 0x268]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.00423aca
call fcn.0046a050
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [ebp - 0x264]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x428064
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4d9c38
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.00423aca
mov edi, esi
call fcn.004676c0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x274]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.004b18dc
ret
Function at 0x42983e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10
mov eax, 0x4cf434
call fcn.004b17f0
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x50a12c
mov dword [ebp - 4], ebx
call fcn.00423aeb
lea eax, [ebp + 8]
mov esi, 0x509ef0
push eax
mov ecx, esi
call fcn.00423aeb
push 1
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push esi
call fcn.00423aca
lea edi, [ebp - 0x14]
call fcn.00466910
pop ecx
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00423aeb
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004235c7
mov edi, 0x4d9c3c
push edi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004239f5
test eax, eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0xd], bl
je 0x4298de
push edi
mov ecx, esi
call fcn.00428f7c
mov esi, dword [0x509ef0]
call fcn.00469460
push dword [0x509ef0]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42992b
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Diff_Init:_Cannot_create_TempDir
call fcn.0042341f
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.General
mov byte [ebp - 4], 3
call fcn.0042341f
push 3
mov byte [ebp - 4], bl
call fcn.0046b810
add esp, 0xc
push 0x509f1c
call fcn.00429984
mov esi, 0x4d9c38
push esi
mov ecx, 0x509ef4
call fcn.00423ef4
push esi
mov ecx, 0x509efc
call fcn.00423ef4
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.0042341f
mov ecx, 0x509f4c
call fcn.00429a24
call fcn.0044b3a0
call fcn.004518c0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
inc eax
call fcn.004b18c8
ret

Function at 0x42b295
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x50a36c], esi
jne 0x42b316
mov dword [0x50a36c], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00464e20
pop ecx
test eax, eax
jne 0x42b305
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x509e4c], eax
cmp dword [0x50a370], esi
jne 0x42b2f2
push esi
push esi
push 0x4d9c38
call fcn.004ae389
pop ecx
push eax
push 0x42af15
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x50a370], eax
push 0x190
push dword [0x509e4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret
push str.This_is_a_System_process__so_skipping_window_display.
push str.GfxServerInit
call fcn.004643c0
pop ecx
pop ecx
pop esi
ret
Function at 0x42b71a
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x14], ecx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ecx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call ebx
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
sub esi, dword [ebp - 0xc]
sub edi, dword [ebp - 8]
sub esi, dword [ebp - 0x24]
sub edi, dword [ebp - 0x20]
add esi, dword [ebp - 0x14]
add edi, dword [ebp - 0x18]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x42b7b0
lea ecx, [ebp - 0x34]
push ecx
push eax
call ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
test eax, eax
jg 0x42b7a2
test ecx, ecx
jle 0x42b7b0
jmp 0x42b7a7
sub eax, dword [ebp - 0x28]
add edi, eax
test ecx, ecx
jle 0x42b7b0
sub ecx, dword [ebp - 0x2c]
add esi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b90d
Capabilities:
Create directory
Create thread

Disassembly:
push 0x30
mov eax, 0x4cdadd
call fcn.004b17f0
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov ebx, 0x4da160
push ebx
mov dword [ebp - 0x18], esi
call fcn.0042341f
lea eax, [ebp - 0x10]
push eax
call fcn.00466100
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x10
call fcn.0049caea
mov edi, eax
pop ecx
cmp edi, esi
je 0x42b974
lea ecx, [edi + 8]
call fcn.0042148a
lea ecx, [edi + 0xc]
call fcn.0042148a
mov dword [0x509e54], edi
jmp 0x42b97a
mov dword [0x509e54], esi
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4d9c3c
call fcn.0042341f
push ecx
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Troubleshoot.log
call fcn.0042341f
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.0042341f
mov eax, dword [ebp - 0x14]
push eax
call fcn.00466100
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
call fcn.00466550
add esp, 0xc
call fcn.0042b336
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
push 0x42b63a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x42ba09
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
call edi
test eax, eax
jg 0x42b9f5
mov eax, dword [ebp - 0x34]
call fcn.004b18c8
ret 4
Function at 0x42cac8
Capabilities:
Move file

Disassembly:
push 0x10
mov eax, 0x4cfdf2
call fcn.004b17f0
and dword [ebp - 4], 0
push 0
call fcn.004aece0
pop ecx
push eax
call fcn.004aecac
pop ecx
call fcn.004aecbe
mov esi, eax
call fcn.004aecbe
push dword [ebp + 0x10]
shl esi, 0x10
push ecx
mov dword [ebp - 0x18], esp
xor eax, esi
mov esi, esp
push eax
push 0x5c
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423aca
lea eax, [ebp - 0x18]
push eax
call fcn.00466f10
add esp, 0xc
mov byte [ebp - 4], 1
push dword [eax]
push str._s._x.ToDelete
push esi
call fcn.00466a00
lea eax, [ebp - 0x14]
add esp, 0x10
push eax
call fcn.00479360
add esp, 0xc
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp + 0xc]
push dword [ebp + 0x10]
push 0
push 0
push ecx
mov dword [ebp + 0x10], esp
mov ecx, esp
push eax
call fcn.00423aca
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00479070
add esp, 0x14
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042101a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
call fcn.004b18c8
ret

Function at 0x42cba7
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x264
mov eax, 0x4cc3c3
call fcn.004b1859
and dword [ebp - 0x260], 0
push 0x24c
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.004ac220
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x26c], esp
push str..ToDelete
call fcn.0042341f
lea eax, [ebp - 0x26c]
push eax
call fcn.00479360
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x26c]
mov esi, eax
cmp esi, 0xffffffff
setne byte [ebp - 0x261]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0x261], 0
je 0x42ccae
push edi
push ecx
lea eax, [ebp - 0x234]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call fcn.0042341f
lea eax, [ebp - 0x268]
push eax
call fcn.00479360
and dword [ebp - 4], 0
add esp, 8
mov eax, esp
mov dword [ebp - 0x270], esp
push dword [ebp - 0x268]
push str.DeleteSharingViolationRemains:_deleting__s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.0042c5e1
pop ecx
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42cc2c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.004b18dc
ret
Function at 0x42e606
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0x1c
mov eax, 0x4cc37a
call fcn.004b17f0
push ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x24], esp
push dword [ebp + 8]
push str.Loader_SetVirtEnvVariables:_in___s_
push eax
call fcn.00466a00
add esp, 0xc
call fcn.0042c5e1
pop ecx
mov dword [ebp - 0x1c], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.::
lea edi, [ebp - 0x1c]
call fcn.0042341f
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x28], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 1
call fcn.00423aca
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], bl
call fcn.0046a8f0
add esp, 8
mov eax, esp
mov dword [ebp - 0x28], esp
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
push str.Loader_SetVirtEnvVariables:_setting_Env_variable:__s
push eax
call fcn.00466a00
add esp, 0xc
call fcn.0042c5e1
pop ecx
push ebx
push 0x3d
lea ecx, [ebp - 0x10]
call fcn.00425653
mov esi, eax
cmp esi, 0xffffffff
jne 0x42e6bc
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
push str.Loader_SetVirtEnvVariables:__error:_Env_variable_doesnt_contain_
push eax
call fcn.00466a00
pop ecx
pop ecx
call fcn.0042c5e1
pop ecx
jmp 0x42e7a9
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.0042360e
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00423aca
push ebx
lea ecx, [ebp - 0x14]
lea eax, [esi + 1]
push ecx
mov byte [ebp - 4], 4
call fcn.004234b6
push str._ExistingValue_
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00423532
mov esi, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x42e78e
call fcn.0049d1fb
push eax
lea ecx, [ebp - 0x18]
call fcn.0042149e
push ebx
push ebx
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
call edi
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x42e756
push eax
lea ecx, [ebp - 0x18]
call fcn.004214c6
push dword [ebp - 0x24]
push eax
push esi
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.0042372d
cmp edi, ebx
jne 0x42e756
push 0x4d9c38
lea ecx, [ebp - 0x18]
call fcn.00423ef4
mov edi, dword [ebp - 0x18]
push edi
push str._ExistingValue_
lea eax, [ebp - 0x14]
push eax
call fcn.00432a01
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x14]
push ecx
push str.Loader_SetVirtEnvVariables:_replacing__ExistingValue__with_existing_value:
push eax
call fcn.004236c3
add esp, 0xc
call fcn.0042c5e1
pop ecx
lea ecx, [edi - 0x10]
call fcn.0042101a
mov edi, dword [ebp - 0x14]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [edi - 0x10]
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x42e637
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.004b18c8
ret