joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002acc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov bl, byte [ebp + 8]
push esi
push edi
mov esi, 0x1002264
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x5c3a3f
push eax
movsb byte es:[edi], byte [esi]
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
dec eax
dec eax
je 0x1002b0f
dec eax
je 0x1002b5d
sub eax, 3
je 0x1002b0a
xor edi, edi
jmp 0x1002b5d
push 3
pop edi
jmp 0x1002b5d
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0x80000000
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1002b06
push esi
lea eax, [ebp + 8]
push eax
push 0x18
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push 0x70000
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1002b54
cmp dword [ebp - 0x1c], 0xb
je 0x1002b56
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1002cf7
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push 0x100ad40
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x100a184]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1002d1e
push eax
call esi
and dword [0x100a184], 0
mov eax, dword [0x100a020]
cmp eax, 0xffffffff
je 0x1002d32
push eax
call esi
or dword [0x100a020], 0xffffffff
mov esi, dword [0x100a004]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edi, 0x100a004
jmp 0x1002d76
mov eax, dword [esi + 4]
test eax, eax
je 0x1002d74
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1002d70
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1002d70
cmp eax, 3
je 0x1002d70
push 4
push 0
push dword [esi + 4]
call ebx
and dword [esi + 4], 0
mov esi, dword [esi]
cmp esi, edi
jne 0x1002d45
mov esi, dword [0x100a00c]
mov edi, 0x100a00c
jmp 0x1002db8
mov eax, dword [esi + 4]
test eax, eax
je 0x1002db6
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1002db2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1002db2
cmp eax, 3
je 0x1002db2
push 4
push 0
push dword [esi + 4]
call ebx
and dword [esi + 4], 0
mov esi, dword [esi]
cmp esi, edi
jne 0x1002d87
push 0x100ad40
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret

Function at 0x10030b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
test edx, edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
je 0x10030de
push esi
push edi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x100a1a0]
inc ecx
dec edx
jne 0x10030c6
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10033fa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [0x100ad24]
xor ebx, ebx
cmp eax, ebx
je 0x1003472
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003426
push ebx
lea ecx, [ebp - 4]
push ecx
sub eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp + 8]
push dword [0x100ad24]
call esi
test eax, eax
je 0x1003475
mov ecx, 0x100235c
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1003455
push ebx
lea edx, [ebp - 4]
push edx
sub eax, edi
push eax
push ecx
push dword [0x100ad24]
call esi
test eax, eax
pop edi
je 0x1003475
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x1003604
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
cmp dword [0x100a044], 0
jne 0x10036e7
push esi
push 0x100242c
push 0x1002424
push dword [ebp + 8]
call fcn.010060e4
test eax, eax
mov esi, 0x104
je 0x100365f
push esi
lea ecx, [ebp - 0x208]
push ecx
push 1
push eax
call fcn.01005fbe
test eax, eax
je 0x100365f
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
push 0x100ad60
jmp 0x1003680
push esi
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x104]
push eax
push 0x1002414
lea eax, [ebp - 0x30c]
push eax
call fcn.01002b66
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x100a058], eax
je 0x10036c0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10023fc
push eax
call esi
push 0x10023e8
push dword [0x100a058]
mov dword [0x100a044], eax
call esi
mov dword [0x100a040], eax
cmp dword [0x100a044], 0
pop esi
jne 0x10036d4
mov dword [0x100a044], 0x10035ff
cmp dword [0x100a040], 0
jne 0x10036e7
mov dword [0x100a040], 0x10035fa
leave
ret 4
Function at 0x100375b
Capabilities:
Query environment variable
Set environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push edi
push edi
push 0x1002448
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1003824
push esi
mov esi, 0x100afa0
push esi
push 0x1002438
push 0x100ad60
call fcn.01002b66
push edi
push 0x4000002
push 1
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [0x100a020], edx
je 0x1003823
push ebx
xor eax, eax
mov ebx, 0x100a5a0
push eax
mov ecx, 0xc5
mov edi, ebx
rep stosd dword es:[edi], eax
mov byte [0x100a7b0], al
lea eax, [ebp - 4]
push eax
mov edi, 0x314
push edi
push ebx
push edx
mov dword [0x100a5a0], 0x6e776453
mov dword [0x100a5a4], 0x10000
mov dword [0x100a5a8], 0xc0000013
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop ebx
je 0x1003810
cmp dword [ebp - 4], edi
jne 0x1003810
push esi
push 0x1002448
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x1003823
push dword [0x100a020]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x100a020], 0xffffffff
pop esi
pop edi
leave
ret

Function at 0x1003827
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x1003841
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [0x101b0c0], 0
jne 0x10038a2
lea eax, [ebp - 0x280]
push eax
push 0x200
push esi
call fcn.01002c8f
lea eax, [ebp - 0x280]
push eax
call fcn.01003486
push 0x80
lea eax, [ebp - 0x80]
push eax
push 0x20000003
push dword [0x100a05c]
mov byte [ebp - 0x80], 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x10010
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x280]
push eax
push dword [0x100aae4]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.01002cf7
test esi, esi
jne 0x10038ac
inc esi
cmp dword [0x100a060], 0
je 0x10038c7
push 0x100ad40
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and dword [0x100a060], 0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1003d4e
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push dword [ebp + 8]
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1003da6
lea eax, [ebp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1003dad
xor eax, eax
jmp 0x1003e63
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push 0x10000
push 0x100b0c0
push 4
push dword [ebp + 8]
call ebx
test eax, eax
je 0x1003e62
push esi
push dword [0x100b0c0]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, eax
push esi
call fcn.01003b2a
cmp eax, edi
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
je 0x1003e3f
mov ecx, esi
mov esi, dword [0x100b0c0]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 4]
push eax
push 0x10000
push 0x100b0c0
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 8]
call ebx
test eax, eax
je 0x1003e61
push dword [0x100b0c0]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, eax
push esi
call fcn.01003b2a
test eax, eax
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jne 0x1003e46
push 8
call fcn.01003827
mov ecx, esi
mov esi, dword [0x100b0c0]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
inc eax
pop esi
pop ebx
pop edi
leave
ret 0xc
Function at 0x10044c3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, esi
xor ebx, ebx
push edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10044d5
push 0x2e
push esi
call dword [sym.imp.msvcrt.dll_strrchr]
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x1004551
push 0x10025cc
push edi
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x1004551
xor ebx, ebx
inc ebx
mov eax, dword [0x101b0c8]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ecx, eax
mov eax, dword [0x101b0c8]
imul ecx, ecx, 0x3e8
sub eax, ecx
inc dword [0x101b0c8]
push eax
push 0x10025c4
push edi
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1004505
push esi
push 0x100a004
call fcn.0100449c
jmp 0x1004553
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x10045fa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100460d
sub eax, edx
lea ecx, [eax + 1]
mov edx, ecx
shr ecx, 2
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp + eax - 0x104]
cmp byte [eax - 1], 0x5c
pop edi
pop esi
je 0x1004643
mov byte [eax], 0x5c
mov byte [eax + 1], 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push eax
call fcn.010045a6
test eax, eax
je 0x10046a8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10046a8
test al, 0x10
je 0x10046a8
push 0x10024cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10046a3
push 0x10025d4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10046a3
push 0
lea ecx, [ebp - 0x104]
push ecx
call eax
test eax, eax
jne 0x10046a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
inc eax
jmp 0x10046aa
xor eax, eax
leave
ret 0xc
Function at 0x1007390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [ebp + 0x10]
jle 0x10073cb
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x10073a8
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x10073e7
dec esi
je 0x10073e0
dec esi
jne 0x10073ec
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x1f3355a9
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x44fb3a76
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x6620146b
Capabilities:
Accept command line arguments
Create process on windows
Query environment variable
Set environment variable
Terminate process

Disassembly:
mov eax, 0x6621b3ad
call fcn.6620d084
sub esp, 0x3bc
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0x110]
call fcn.66203100
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 4], edi
je 0x662014af
push 0x104
lea eax, [ebp - 0x3c8]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.6620d5a0
xor ecx, ecx
xor edx, edx
inc edx
movzx ebx, cl
test eax, eax
lea eax, [ebp - 0x3c8]
push ecx
cmovne ebx, edx
cmp dword [esi + 4], ecx
push ecx
push ecx
cmove eax, ecx
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.66206570
add esp, 0x1c
test al, al
je 0x662015fb
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.6620d510
add esp, 0xc
mov dword [ebp - 0x60], esi
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea ecx, [ebp - 0x1c0]
push 0xffffffffffffffff
push esi
call fcn.66203100
mov byte [ebp - 4], 1
test bl, bl
jne 0x6620157c
movzx eax, word [esi]
push 0x22
pop ecx
cmp ax, cx
jne 0x6620155c
jmp 0x6620153e
cmp cx, ax
je 0x6620154b
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x66201539
jmp 0x66201561
add esi, 2
jmp 0x66201561
cmp ax, 0x20
je 0x66201561
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x66201550
push esi
push dword [ebp - 0x110]
lea eax, [ebp - 0x1c0]
push str.__ls__ls
push eax
call fcn.662045b0
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push str.TS_SOURCE
call esi
push edi
push str.TS_ORIGIN
call esi
test bl, bl
je 0x662015bf
push dword [ebp - 0x110]
push str.TS_UPDATED_DATFILE
call esi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x1c0]
push dword [ebp + 0xc]
jmp 0x662015dc
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x1c0]
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x662015ed
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], bl
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x6620161b
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x6621b3c2
call fcn.6620d084
sub esp, 0xb0
push ebx
push esi
lea ecx, [ebp - 0xbc]
call fcn.662031a0
mov ecx, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.66203cb0
push ebx
lea eax, [ebp - 0xbc]
mov esi, str.TS_UPDATED_DATFILE
push eax
push esi
call fcn.66203d80
add esp, 0xc
test eax, eax
js 0x66201679
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xbc]
push eax
call fcn.66203f20
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x66201da0
Capabilities:
Create process on windows
Create process suspended
Delete file
Set environment variable

Disassembly:
mov eax, 0x6621b4b8
call fcn.6620d084
sub esp, 0x314
push ebx
lea ecx, [ebp - 0x270]
call fcn.662031a0
xor ebx, ebx
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 4], ebx
call fcn.662031a0
lea eax, [ebp - 0x1c0]
mov byte [ebp - 4], 1
push str.TS_UPDATE_THINREG
push eax
call fcn.662045b0
push ebx
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x1c0]
call fcn.66203d80
add esp, 0x14
test eax, eax
jne 0x66201f2b
push esi
push edi
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0xcc]
call fcn.66202f60
push ebx
push ebx
push 0xffffffffffffffff
xor edi, edi
mov byte [ebp - 4], 2
push 0x6621c4f0
inc edi
lea ecx, [ebp - 0xcc]
push edi
call fcn.662033b0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xcc]
push ebx
push ebx
push dword [eax + 4]
push dword [eax]
push edi
call fcn.662033b0
push ebx
push ebx
push 0xffffffffffffffff
push str..exe
push edi
lea ecx, [ebp - 0xcc]
call fcn.662033b0
push ebx
push ebx
push 0xffffffffffffffff
push 0x6621c508
push edi
lea ecx, [ebp - 0xcc]
call fcn.662033b0
push 0x44
pop esi
push esi
lea eax, [ebp - 0x110]
push ebx
push eax
call fcn.6620d510
add esp, 0xc
mov dword [ebp - 0x110], esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xcc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x66201ec6
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c]
call esi
mov eax, dword [ebp - 0xcc]
push 0x22
pop ecx
cmp word [eax], cx
jne 0x66201f0e
push edi
push ecx
lea ecx, [ebp - 0xcc]
call fcn.66204300
cmp eax, 0xffffffff
je 0x66201f0e
dec eax
lea ecx, [ebp - 0xcc]
push eax
push edi
lea eax, [ebp - 0x320]
push eax
call fcn.6620247a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x320]
call fcn.66203220
push ebx
push str.TS_UPDATE_THINREG
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 1
call fcn.66203220
pop edi
pop esi
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], bl
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x66201f57
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, 0x6621b4e0
call fcn.6620d084
sub esp, 0x300
push esi
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0xbc]
call fcn.66202f60
lea eax, [ebp - 0x30c]
mov byte [ebp - 4], 2
push eax
push dword [ebp + 0xb8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x2e0]
push eax
push 1
lea ecx, [ebp - 0xbc]
call fcn.662033b0
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xbc]
call fcn.66203f20
lea eax, [ebp - 0x30c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x66201f97
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 1
call fcn.66203220
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb8]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x66202017
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
mov eax, 0x6621b51e
call fcn.6620d084
sub esp, 0x460
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp + 8]
inc ebx
lea ecx, [ebp - 0xbc]
push eax
mov dword [ebp - 4], ebx
call fcn.66202f60
lea eax, [ebp - 0x46c]
mov byte [ebp - 4], 2
push eax
push dword [ebp + 0xb8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x440]
push eax
push ebx
lea ecx, [ebp - 0xbc]
call fcn.662033b0
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x21c]
call fcn.66202f60
mov esi, dword [ebp - 0xb8]
push 0x6621c4c0
mov byte [ebp - 4], 3
call fcn.6620cda1
pop ecx
sub esi, eax
lea ecx, [ebp - 0xbc]
push esi
lea eax, [ebp - 0x16c]
push eax
call fcn.662043a0
push ebx
push dword [ebp - 0x16c]
mov byte [ebp - 4], 4
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xbc]
call fcn.66203f20
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 3
call fcn.66203220
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.66203220
lea eax, [ebp - 0x46c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x66202058
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], bl
call fcn.66203220
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb8]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x66202141
Capabilities:
Create process on windows
Create process suspended
Set environment variable
Terminate process

Disassembly:
mov eax, 0x6621b551
call fcn.6620d084
sub esp, 0x368
push ebx
push esi
xor ebx, ebx
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], ebx
call fcn.662031a0
mov esi, str.TS_UPDATE_CMDLINE
mov byte [ebp - 4], 1
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.662045b0
pop ecx
pop ecx
lea ecx, [ebp - 0x114]
call fcn.662031a0
push ebx
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x214]
call fcn.66203d80
add esp, 0xc
test eax, eax
js 0x66202205
push 0xffffffffffffffff
push 0x6621c3d8
lea ecx, [ebp - 0x374]
call fcn.66203100
push ebx
push eax
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 3
call fcn.66203670
mov ebx, eax
mov byte [ebp - 4], 2
neg ebx
lea ecx, [ebp - 0x374]
sbb bl, bl
call fcn.66203220
inc bl
je 0x662021fb
xor esi, esi
push esi
push 0x6621c3dc
push str.Your_application_was_updated._____________Please_relaunch_to_use_the_new_version
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.6620d510
add esp, 0xc
mov dword [ebp - 0x64], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.66202f60
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x10]
push 2
push 1
push ebx
push eax
call esi
push eax
call esi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push dword [ebp - 0x10]
lea eax, [ebp - 0x164]
push 0x6621c494
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x164]
push eax
push str.TS_PARENT_HANDLE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x2c4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x662022a5
push ebx
jmp 0x662021f5
lea ecx, [ebp - 0x2c4]
call fcn.66203220
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 1
call fcn.66203220
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], bl
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret