joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4150e0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00428ae0
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x1024]
test eax, eax
je 0x415155
push eax
call fcn.0041ce60
add esp, 4
mov dword [esi + 0x1024], 0
test eax, eax
jne 0x415164
push edi
lea edi, [esi + 0x1028]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41513d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41513d
push edi
push 2
jmp 0x41516d
push edi
add esi, 0x1230
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop edi
test eax, eax
jne 0x415155
push esi
push 3
jmp 0x41516d
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00428a63
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x1230]
push eax
push 1
lea ecx, [ebp - 0x1008]
call fcn.0041a5d0
push 0x4a5ae8
lea eax, [ebp - 0x1008]
push eax
call fcn.0042eb3c
int3

Function at 0x4151c0
Capabilities:
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4152fa
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4151e4
sub ecx, edx
sar ecx, 1
je 0x4152fa
push esi
push edi
call fcn.00401750
mov edi, eax
movzx eax, word [ebx]
push eax
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
pop edi
pop esi
cmp eax, 2
je 0x41524f
cmp eax, 3
je 0x41524f
cmp eax, 5
je 0x41524f
cmp eax, 6
je 0x41524f
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and al, 0x10
movzx eax, al
neg eax
pop ebx
sbb eax, eax
neg eax
dec eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0042e960
push 2
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0043725b
add esp, 0x1c
lea ecx, [ebx + 2]
nop dword [eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x415280
sub ebx, ecx
sar ebx, 1
cmp word [ebp + ebx*2 - 0x20e], 0x5c
je 0x4152b5
push 1
push 0x4a1a04
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00437185
add esp, 0x10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x4152e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop ebx
call fcn.00428a63
mov esp, ebp
pop ebp
ret
Function at 0x416b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00428ae0
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, 4
mov ecx, dword [esi + 0x1230]
test ecx, ecx
jne 0x416be1
cmp dword [esi + 8], ecx
jne 0x416b5e
cmp dword [esi + 0x18], 0
mov ecx, 2
cmovne eax, ecx
push edi
push 0
push 0x80000000
push eax
push 0
push 5
push 0x40000000
lea edi, [esi + 0x1024]
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x1230], eax
cmp eax, 0xffffffff
je 0x416bf2
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esi + 0x18], 0
pop edi
je 0x416bd4
push 0
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1010], 0
push eax
push 3
lea eax, [ebp - 0x100c]
mov word [ebp - 0x100c], 0xbbef
push eax
push dword [esi + 0x1230]
mov byte [ebp - 0x100a], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 0x1230]
mov dword [esi + 0x18], 1
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push edi
push 0
lea ecx, [ebp - 0x1008]
call fcn.0041a5d0
push 0x4a5ae8
lea eax, [ebp - 0x1008]
push eax
call fcn.0042eb3c
int3

Function at 0x418160
Capabilities:
Print debug messages
Reference absolute stream path on windows

Disassembly:
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x47e844
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x418192
push str.C:_bambooxml_data_build_dirCRED_CSV2279_JOB1_srcCmgWinNtShield_srcWSScanLibScanner.cpp:OpenFileSystemFilter____error_opening_CEF_device_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop esi
ret

Function at 0x419b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push 0xffffffffffffffff
push eax
push 0x104
lea esi, [edi + 0x1028]
push esi
call fcn.0043725b
push 0
push 0
push 0
push 0
push 0x100
lea eax, [ebp - 0x20c]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.00438dcf
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004388db
add esp, 0x4c
lea eax, [edi + 0x1230]
push eax
push 0
push 0x482038
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428a63
mov esp, ebp
pop ebp
ret 4
Function at 0x419c10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
call fcn.00415800
mov dword [ebp - 0x810], 0
lea ebx, [esi + eax*2]
lea eax, [ebp - 0x810]
push eax
push ebx
call fcn.00401260
add esp, 0xc
test eax, eax
je 0x419ca2
cmp eax, 2
je 0x419d71
push eax
push ebx
push str._s:_FCUM_ClassifyFile___failed.__MS_Error_lu_
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0040b5a0
mov eax, dword [edi]
lea ecx, [ebp - 0x804]
add esp, 0x14
mov esi, dword [eax + 4]
push ecx
push 2
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
push 0
push 5
push 0x80
xorps xmm0, xmm0
mov dword [ebp - 0x80c], 0xffffffff
push ebx
movlpd qword [ebp - 0x818], xmm0
mov dword [ebp - 0x808], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x419d05
lea eax, [ebp - 0x80c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
lea eax, [ebp - 0x818]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x810]
test al, 0x17
jne 0x419d38
cmp dword [edi + 0x9b0c], 0
je 0x419d71
push eax
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [ebp - 0x808]
push dword [ebp - 0x80c]
push 0x482b20
jmp 0x419d5f
cmp dword [edi + 0x9b08], 0
je 0x419d71
push eax
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [ebp - 0x808]
push dword [ebp - 0x80c]
push str.USER
mov esi, dword [edi]
push ebx
mov esi, dword [esi + 0x4c]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a63
mov esp, ebp
pop ebp
ret

Function at 0x419d90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x1a30], 0
jne 0x419de5
cmp dword [ecx + 0x1a34], 0
jne 0x419de5
mov eax, dword [ebp + 8]
mov dword [ecx + 0x1a70], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x9ac4], eax
push ecx
test eax, eax
je 0x419dd4
push 0
push fcn.00415380
call fcn.00439abe
add esp, 0xc
mov eax, 1
pop ebp
ret 8
call fcn.00415380
add esp, 4
mov eax, 1
pop ebp
ret 8
xor eax, eax
pop ebp
ret 8
Function at 0x419fd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00428ae0
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x1010], esi
push edi
mov edi, ecx
test esi, esi
je 0x41a09e
push esi
call fcn.00419ed0
mov ecx, edi
call fcn.00416b20
mov dword [ebp - 0x1014], eax
test eax, eax
je 0x41a09e
cmp eax, 0xffffffff
je 0x41a09e
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
mov dword [ebp - 0x100c], ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
call fcn.004360b7
add esp, 4
mov ebx, eax
push 0
push 0
push esi
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x1010]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
cmp byte [esi + ebx - 1], 0
jne 0x41a06a
dec esi
push 0
lea eax, [ebp - 0x100c]
push eax
push esi
push ebx
push dword [ebp - 0x1014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call fcn.0043609c
xor ebx, ebx
add esp, 4
cmp dword [ebp - 0x100c], esi
sete bl
jne 0x41a0b3
mov ecx, edi
call fcn.00415190
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a63
mov esp, ebp
pop ebp
ret 4
lea eax, [edi + 0x1024]
push eax
push 1
lea ecx, [ebp - 0x1008]
call fcn.0041a5d0
push 0x4a5ae8
lea eax, [ebp - 0x1008]
push eax
call fcn.0042eb3c
int3
Function at 0x41a1a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe18
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x614]
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push 0
push eax
call fcn.0042e960
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0042e960
push 0x200
lea eax, [ebp - 0x40c]
push 0
push eax
call fcn.0042e960
push str.WSScanMismatchedEntries.log
lea eax, [ebp - 0x40c]
push 0x100
push eax
call fcn.0043703a
add esp, 0x30
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x41a30b
push esi
lea eax, [ebp - 0x20c]
push eax
push str.Info:_Log_directory_is_:__s
lea eax, [ebp - 0xe14]
push 0x400
push eax
call fcn.0040b5a0
mov eax, dword [edi]
lea ecx, [ebp - 0xe14]
add esp, 0x10
mov esi, dword [eax + 4]
push ecx
push 1
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x47f870
lea eax, [ebp - 0x614]
push 0x104
push eax
call fcn.0040b5a0
push 0x482a88
lea eax, [ebp - 0x614]
mov dword [ebp - 0xe18], 0
push eax
lea eax, [ebp - 0xe18]
push eax
call fcn.00439538
mov eax, dword [ebp - 0xe18]
add esp, 0x20
test eax, eax
jne 0x41a2e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
push str.Error_opening_log_file
push 1
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push eax
push ebx
call fcn.00439430
push 2
push 0
push 0
push dword [ebp - 0xe18]
call fcn.00439936
push dword [ebp - 0xe18]
call fcn.004395f6
add esp, 0x1c
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00428a63
mov esp, ebp
pop ebp
ret

Function at 0x41a710
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.0041a700
add esp, 4
cmp dword [eax], 0xf1d05bed
je 0x41a733
push str.GetHeader:__Failed_header_validation_check__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop ebp
ret

Function at 0x41a740
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41a76f
push esi
call fcn.0041a710
add esp, 4
test eax, eax
je 0x41a76f
mov eax, dword [eax + 8]
cmp dword [esi + eax], 0x92546ca5
je 0x41a774
push str.IsValid:__Failed_footer_validation_check__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x41a7a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x10]
cmp esi, 0xffff
jb 0x41a820
push 4
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x41a819
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.memAlloc:__VirtualAlloc_failed_to_allocate__Iu_bytes__MS_error___lu__n
push 0xffffffffffffffff
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.00401690
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
mov ecx, 1
jmp 0x41a89b
mov eax, dword [0x4ac0cc]
test eax, eax
jne 0x41a879
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x4ac0cc], eax
test eax, eax
jne 0x41a879
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.memAlloc:__Failed_to_acquire_process_heap__MS_error___lu__n
push 0xffffffffffffffff
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.00401690
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push edi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x41a899
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.memAlloc:__HeapAlloc_failed_to_allocate__Iu_bytes__MS_error___lu__n
jmp 0x41a7e4
xor ecx, ecx
mov word [eax + 4], cx
mov ecx, dword [ebp - 4]
mov dword [eax + 8], esi
xor ecx, ebp
mov dword [eax], 0xf1d05bed
mov dword [esi + eax + 0xc], 0x92546ca5
add eax, 0xc
pop edi
pop esi
call fcn.00428a63
mov esp, ebp
pop ebp
ret
Function at 0x41a960
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0041a740
add esp, 4
test eax, eax
jne 0x41a993
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push ebx
push esi
call fcn.0041aab0
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
jne 0x41a9c1
push str.memFree:__Invalid_size__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.0041a700
push esi
mov edi, eax
call fcn.0041a780
lea edx, [ebx + 0xc]
add esp, 8
mov ecx, edi
test edx, edx
je 0x41a9eb
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x41a9e0
test eax, eax
jne 0x41aa0f
push edi
push eax
push dword [0x4ac0cc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x41aa63
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.memFree:__HeapFree_failed__MS_error___lu__n
jmp 0x41aa2d
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x41aa63
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.memFree:__VirtualFree_failed__MS_error___lu__n
push 0xffffffffffffffff
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.00401690
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00428a63
mov esp, ebp
pop ebp
ret

Function at 0x41ac20
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
mov ebx, eax
test ecx, ecx
jne 0x41ac44
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov eax, ecx
jmp 0x41ac66
cmp ecx, 2
jne 0x41ac53
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [ebx + ecx]
jmp 0x41ac66
push esi
mov edi, 1
call fcn.0041ab70
mov ecx, dword [ebp + 0xc]
add esp, 4
add eax, ecx
cmp eax, ebx
jbe 0x41ac72
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
push edi
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4218e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b58b
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x248]
push 7
xor eax, eax
mov dword [ebp - 0x248], 0
push str.Drivers
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
call fcn.00402bd0
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421a0f
xor eax, eax
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x230], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4219a0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00402bd0
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.00421ae0
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.00402860
lea ecx, [ebp - 0x248]
call fcn.00402860
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
push 0x486b00
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x458]
call fcn.00421f60
push 0x4a72b4
lea eax, [ebp - 0x458]
push eax
call fcn.0042eb3c
int3
Function at 0x421ca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x10], 0
je case.0x421ceb.2
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x421cc8
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x421cf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea ecx, [edi - 2]
cmp ecx, 0x1e
ja case.0x421ceb.4
movzx edx, byte [ecx + 0x421d94]
jmp dword [edx*4 + 0x421d88]
test al, 0x10
jne 0x421d5f
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00428a63
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00402e40
push eax
push str.ERROR_getting_file_attributes_for___S_
lea eax, [ebp - 0x158]
push 0x154
push eax
call fcn.0040ea70
add esp, 0x10
lea eax, [ebp - 0x158]
lea ecx, [ebp - 0x368]
push eax
push edi
call fcn.00421ec0
push 0x4a72b4
lea eax, [ebp - 0x368]
push eax
call fcn.0042eb3c
mov ecx, esi
call fcn.00402e40
push eax
push 0x10b
lea ecx, [ebp - 0x368]
call fcn.00421f60
push 0x4a72b4
lea eax, [ebp - 0x368]
push eax
call fcn.0042eb3c
or byte [0x1cf60042], bl
inc edx
add byte [edx], bl
sbb eax, 0x42
add al, byte [ecx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add esp, ecx
int3
Function at 0x4235c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b680
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4a90d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
cmp byte [ebp + 8], 0
mov dword [ebp - 4], 0
je 0x423640
push dword [ebp + 0xc]
push 0x104
push edi
call fcn.00422f30
mov esi, eax
jmp 0x4236c0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
push edi
push 3
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x4236b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MCID___Unable_to_get_Fully_Qualified_System_Name__MS_error___d_
push 1
push 0x104
push str.C:_bambooxml_data_build_dirCRED_CSV2279_JOB1_srcCmgWinNtShield_srcCmgWinNtShieldCommonMCID.cpp
call fcn.00413000
add esp, 0x14
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x4236b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.MCID___Unable_to_get_System_Name__MS_error___d_
push 1
push 0x109
push str.C:_bambooxml_data_build_dirCRED_CSV2279_JOB1_srcCmgWinNtShield_srcCmgWinNtShieldCommonMCID.cpp
call fcn.00413000
add esp, 0x14
test esi, esi
jne 0x4236c4
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
test esi, esi
je 0x4236de
push esi
push str.MCID_GenerateUniqueID___Failed_with_error__d
push 0xf
push 0x93
push str.C:_bambooxml_data_build_dirCRED_CSV2279_JOB1_srcCmgWinNtShield_srcCmgWinNtShieldCommonMCID.cpp
call fcn.00413000
add esp, 0x14
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x423700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b6a0
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x20a
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], 0
push 0
push eax
call fcn.0042e960
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x220]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x4248c0
push 1
call fcn.00429f70
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4237da
push dword [ebp - 0x224]
push str.MCID___Failed_to_initialize_CSS_session__CSS_error__d_
push 1
push 0x232
push str.C:_bambooxml_data_build_dirCRED_CSV2279_JOB1_srcCmgWinNtShield_srcCmgWinNtShieldCommonMCID.cpp
call fcn.00413000
add esp, 0x14
jmp 0x4237da
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
Function at 0x42a860
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a7a0

Function at 0x42bbe0
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x42bccd
cmp eax, 0x104
jae 0x42bccd
push esi
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.004306a0
mov esi, eax
add esp, 8
test esi, esi
je 0x42bc4f
push 0
lea eax, [ebp - 0x108]
mov byte [esi], 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov byte [esi], 0x5c
lea eax, [ebp - 0x108]
push eax
call fcn.0041ab10
add esp, 4
test eax, eax
lea eax, [ebp - 0x108]
je 0x42bc90
push 0x8009
push eax
call fcn.0041ab90
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x42bccc
test esi, esi
je 0x42bccc
push 2
push 0
push esi
call fcn.0041ac20
add esp, 0xc
jmp 0x42bca9
push 0x8101
push eax
call fcn.0041ab90
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x42bccc
test esi, esi
je 0x42bccc
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42bcb0
push 0
sub ecx, edx
push ecx
push edi
push esi
call fcn.0041ac90
push esi
call fcn.0041ab00
add esp, 0x14
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00428a63
mov esp, ebp
pop ebp
ret