joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6386a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69df98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x79b544]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.006326c0
lea ecx, [edi + 0x5c]
mov dword [edi], vtable.Poco::MD4Engine.0
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
push 0x10
mov byte [ebp - 4], 1
call fcn.00632730
push 0x58
lea esi, [edi + 4]
push 0
push esi
call fcn.00506c70
add esp, 0xc
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov eax, edi
mov dword [esi], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x638750
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x1c]
mov dword [esi], vtable.Poco::MD4Engine.0
push eax
call fcn.00506c70
mov dword [esi + 0x18], 0
add esp, 0xc
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x6387d8
mov ecx, dword [esi + 0x64]
sub ecx, eax
cmp ecx, 0x1000
jb 0x6387b9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6387e0
mov eax, edx
push ecx
push eax
call fcn.0049ba50
mov dword [esi + 0x5c], 0
add esp, 8
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov ecx, esi
pop esi
jmp fcn.006326d0
call fcn.005122ef
int3

Function at 0x6387f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x1c]
mov dword [esi], vtable.Poco::MD4Engine.0
push eax
call fcn.00506c70
mov dword [esi + 0x18], 0
add esp, 0xc
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x63887b
mov ecx, dword [esi + 0x64]
sub ecx, eax
cmp ecx, 0x1000
jb 0x63885c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x63889a
mov eax, edx
push ecx
push eax
call fcn.0049ba50
mov dword [esi + 0x5c], 0
add esp, 8
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov ecx, esi
call fcn.006326d0
test byte [ebp + 8], 1
je 0x638893
push 0x68
push esi
call fcn.0049ba50
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4
call fcn.005122ef
int3
Function at 0x639ff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69e3e4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x79b544]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x63a06f
mov dword [ecx], 0x72d2fc
mov dword [ecx + 0x50], 0x72d304
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x90], 0
mov dword [ecx + 0x94], 0
mov dword [ecx + 0x98], 0
mov dword [ecx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ecx]
push 8
mov eax, dword [eax + 4]
mov dword [ecx + eax], vtable.Poco::RandomIOS.0
lea eax, [ecx + 8]
mov dword [ebp + 8], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00474bfc
mov esi, eax
add esp, 4
test esi, esi
je 0x63a0ad
push 1
mov dword [ebp - 4], 2
call fcn.0049ea62
add esp, 4
mov dword [esi + 4], eax
jmp 0x63a0af
xor esi, esi
mov eax, dword [ebp + 8]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ebx, dword [ebp + 8]
push 0x100
mov dword [ebp - 4], 3
mov dword [ebx], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [ebx + 0x38], 0x100
mov dword [ebx + 0x3c], 0
call fcn.00474c39
mov dword [ebx + 0x40], eax
add esp, 4
mov dword [ebx + 0x44], 1
lea ecx, [eax + 4]
mov eax, dword [ebx + 0xc]
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x40]
mov dword [eax], ecx
mov eax, dword [ebx + 0x20]
mov dword [eax], ecx
mov eax, dword [ebx + 0x30]
mov dword [eax], edx
mov dword [ebx], vtable.Poco::RandomBuf.0
mov esi, dword [ebp - 0x18]
push 0
push 0
push ebx
lea ecx, [esi + 0x50]
mov dword [ebp - 4], 4
call fcn.0045b32e
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.Poco::RandomInputStream.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6670a3
Capabilities:
Delete service

Disassembly:
push 4
mov eax, 0x69e81f
call fcn.0049be25
push 0xd
pop edi
xor esi, esi
push 1
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x6670e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.RunAsSvcHandler::UninstallSvc
push str._s::OpenSCManager_failed___d_
call fcn.00677869
add esp, 0xc
jmp 0x66716e
push 0x10000
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x667121
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.RunAsSvcHandler::UninstallSvc
push str._s::OpenService_failed___d_
call fcn.00677869
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x66716e
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x667141
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.RunAsSvcHandler::UninstallSvc
push str._s::DeleteService_failed_with_errorcode_d
jmp 0x6670da
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x667158
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov eax, dword [ebp + 8]
push eax
push str.RunAsSvcHandler::UninstallSvc
push str._s::_s_Service_deleted_Succesfully
call fcn.00677869
xor esi, esi
add esp, 0xc
inc esi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp + 8]
dec esi
neg esi
sbb esi, esi
add ecx, 0xfffffff0
and esi, edi
call fcn.0044ec01
mov eax, esi
call fcn.0049bdee
ret 4
Function at 0x667198
Capabilities:
Modify service

Disassembly:
push 4
mov eax, 0x69e84a
call fcn.0049be25
push 0xd
pop edi
push 0xf003f
xor esi, esi
mov dword [ebp - 4], 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x6671d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.RunAsSvcHandler::ChangeSvcBinPath
push str._s::OpenSCManager_failed___d_
jmp 0x667254
push 2
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x66720f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.RunAsSvcHandler::ChangeSvcBinPath
push str._s::OpenService_failed___d_
call fcn.00677869
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x66725c
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x667241
push edi
push str.RunAsSvcHandler::ChangeSvcBinPath
push str._s::Changeing_service_BinPath_success_with_errorcode_d
call fcn.00677869
xor esi, esi
add esp, 0xc
inc esi
jmp 0x66725c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.RunAsSvcHandler::ChangeSvcBinPath
push str._s::Changeing_service_BinPath_fail_with_errorcode_d
call fcn.00677869
add esp, 0xc
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp + 8]
dec esi
neg esi
sbb esi, esi
add ecx, 0xfffffff0
and esi, edi
call fcn.0044ec01
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, esi
call fcn.0049bdee
ret 8
Function at 0x6674a8
Capabilities:
Start service

Disassembly:
push 4
mov eax, 0x69e89a
call fcn.0049be25
xor edi, edi
push 1
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x6674e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.RunAsSvcHandler::StartSvc
push str._s:_Unable_to_obtain_handle_to_Service_manager._Error:__d
call fcn.00677869
add esp, 0xc
jmp 0x667585
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x667500
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov eax, dword [ebp + 8]
push 0x10
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x667538
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push dword [ebp + 8]
push str.RunAsSvcHandler::StartSvc
push str._s:_Unable_to_obtain_handle_to_Service__s._Error:__d
call fcn.00677869
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x667585
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x667566
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edi, eax
call esi
push eax
push str.RunAsSvcHandler::StartSvc
push str._s:_Start_Service_failed._Error:__d
call fcn.00677869
add esp, 0xc
jmp 0x667577
push str.RunAsSvcHandler::StartSvc
push str._s:_Service_start_signalled_successfully
call fcn.006777f4
pop ecx
pop ecx
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov eax, edi
call fcn.0049bdee
ret 4
Function at 0x66759a
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
mov eax, dword [0x79b544]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
push 0xd
pop ebp
push 1
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x6675de
call ebx
push eax
push str.RunAsSvcHandler::QuerySvcState
push str._s::OpenSCManager_failed___d_
call fcn.00677869
add esp, 0xc
push str.RunAsSvcHandler::QuerySvcState
push str._s::Service_mgr_opened
call fcn.00677869
pop ecx
pop ecx
push 4
push dword [esi + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x667623
call ebx
mov esi, eax
push esi
push str.RunAsSvcHandler::QuerySvcState
push str._s::OpenService_failed___d_
call fcn.00677869
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x667671
push str.RunAsSvcHandler::QuerySvcState
push str._s::Service_opened
call fcn.00677869
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x66764a
mov ebp, dword [esp + 0x14]
jmp 0x66765f
call ebx
push eax
push str.RunAsSvcHandler::QuerySvcState
push str._s::QueryService_failed___d_
call fcn.00677869
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test edi, edi
je 0x66766f
push edi
call esi
mov eax, ebp
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049b511
add esp, 0x20
ret

Function at 0x66772c
Capabilities:
Create directory

Disassembly:
push 0
mov eax, 0x69e8f5
call fcn.0049be25
mov esi, ecx
and dword [ebp - 4], 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x667753
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp + 8]
add esi, 8
push eax
mov ecx, esi
call fcn.00451d78
push dword [esi]
push str.RunAsSvcHandler::SetAppDirectory
push str._s_::_appdir:_s
call fcn.00677869
mov ecx, dword [ebp + 8]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0044ec01
call fcn.0049bdee
ret 4

Function at 0x6683d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x79b544]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
mov ebx, dword [esp + 0x224]
lea eax, [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x230]
push esi
mov esi, dword [esp + 0x238]
push edi
push eax
xor edi, edi
mov dword [esp + 0x18], ebx
push edi
push edi
push dword [esp + 0x240]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [esi], eax
test eax, eax
jne 0x668421
inc edi
jmp 0x66842e
push eax
push str.SHGetFolderPath_returned_error_:__d
call fcn.00677763
pop ecx
pop ecx
lea eax, [esp + 0x18]
mov dword [ebp], edi
push eax
mov ecx, ebx
call fcn.004514db
mov ecx, dword [esp + 0x224]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049b511
add esp, 0x21c
ret 0x10
Function at 0x668b53
Capabilities:
Create process on windows
Self delete

Disassembly:
push 0x67c
mov eax, 0x69ecb9
call fcn.0049be59
push str._cmd.exe___C_ping_1.1.1.1__n_1__w_3000___Nul__Del___s_
lea ecx, [ebp - 0x62c]
call fcn.004514db
xor esi, esi
lea eax, [ebp - 0x688]
push 0x44
push esi
push eax
mov dword [ebp - 4], esi
call fcn.00506c70
xor eax, eax
lea edi, [ebp - 0x63c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x62c]
cmp dword [eax - 4], 1
jle 0x668bc8
push dword [eax - 0xc]
lea ecx, [ebp - 0x62c]
call fcn.00451ca4
mov eax, dword [ebp - 0x62c]
lea ecx, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0x628]
push 0x208
push eax
call fcn.00454783
add esp, 0x10
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x688]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x638]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x63c]
call esi
mov ecx, dword [ebp - 0x62c]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
call fcn.0049be03
ret
Function at 0x669200
Capabilities:
Delete directory
Delete file

Disassembly:
push 8
mov eax, 0x69edff
call fcn.0049be25
xor ebx, ebx
lea eax, [ebp - 0x14]
inc ebx
lea ecx, [ebp + 8]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00451390
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
push 0x5c
pop edi
cmp dword [eax - 0xc], 0
je 0x6692d7
mov ecx, dword [esi - 0xc]
test ecx, ecx
je 0x669285
cmp ecx, ebx
jne 0x669251
test ecx, ecx
js 0x66937e
movzx ecx, word [esi]
cmp cx, di
je 0x669285
push 0x7516bc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00451281
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.00451d78
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x6692d7
mov eax, dword [esi - 0xc]
test eax, eax
je 0x6692d7
cmp eax, ebx
jne 0x6692a6
test eax, eax
js 0x66937e
movzx eax, word [esi]
cmp ax, di
je 0x6692d7
push 0x7516bc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00451281
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.00451d78
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
call fcn.00474f38
push eax
lea ecx, [ebp - 0x10]
call fcn.00451c1b
mov byte [ebp - 4], 5
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
jb 0x6692f5
mov eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.00452465
mov edi, dword [ebp - 0x10]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x669351
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x669351
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
jb 0x66932f
mov eax, dword [ebp + 0xc]
push eax
push str.file_deleting_failed__s
call fcn.006778de
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UNINSTALL::_Deleting_failed_for_error_code__d
call fcn.006778de
pop ecx
pop ecx
xor bl, bl
lea ecx, [edi - 0x10]
call fcn.0044ec01
lea ecx, [esi - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0044ec01
lea ecx, [ebp + 0xc]
call fcn.00451740
mov al, bl
call fcn.0049bdee
ret 0x1c
push 0x80070057
call fcn.0044ea32
int3
Function at 0x6693f8
Capabilities:
Check if file exists

Disassembly:
push 0x224
mov eax, 0x69ee9f
call fcn.0049be59
mov eax, dword [ebp + 8]
push 0x104
lea ecx, [ebp - 0x21c]
xor ebx, ebx
push ecx
push ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x66943f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileNameEx_failed_with_error_code:_d
call fcn.006778de
pop ecx
pop ecx
jmp 0x66955b
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x228]
call fcn.004514db
push str.Program_Files
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call fcn.004514db
push str.C:Program_Files__x86_
mov byte [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x66948a
push 0x13
push str.Program_Files__x86_
lea ecx, [ebp - 0x220]
call fcn.00452145
call fcn.00474f38
push eax
lea ecx, [ebp - 0x224]
call fcn.00451c1b
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 3
push eax
call fcn.00670e3b
mov esi, eax
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 4
push eax
call fcn.00670e3b
mov byte [ebp - 4], 5
push dword [ebp + 0xc]
push dword [esi]
push dword [eax]
lea eax, [ebp - 0x224]
push dword [ebp - 0x220]
push str.C:_s_sUnattended_s_s
push eax
call fcn.00452465
mov ecx, dword [ebp - 0x22c]
add esp, 0x18
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x230]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov esi, dword [ebp - 0x224]
lea ecx, [ebp - 0x228]
push esi
call fcn.00454b86
push str.AppInstaller::canWeKillProcess
test eax, eax
je 0x669529
push str._s:_some_other_process__so_not_killing
call fcn.006778de
jmp 0x669535
push str._s:_expected_process__so_killing
call fcn.006778de
mov bl, 1
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.0044ec01
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0044ec01
mov al, bl
call fcn.0049be03
ret 8
Function at 0x669570
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x26c
mov eax, 0x69eed7
call fcn.0049be59
mov dword [ebp - 0x26c], ecx
xor edi, edi
mov dword [ebp - 0x260], edi
and dword [ebp - 4], edi
push edi
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x25c], 0x22c
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x274], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x669791
push 5
call fcn.00673d92
mov esi, dword [ebp + 8]
neg eax
sbb al, al
inc al
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x270], eax
cmp esi, eax
je 0x669783
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x2c]
and dword [ebp - 0x18], 0
push esi
call fcn.00454c7a
cmp byte [ebp - 0x264], 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
je 0x669694
cmp dword [ebp - 0x18], 8
jb 0x669613
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x238]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x66963f
test dx, dx
je 0x66963b
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x66963f
add ecx, 4
add eax, 4
test dx, dx
jne 0x669619
xor eax, eax
jmp 0x669644
sbb eax, eax
or eax, 1
test eax, eax
jne 0x66966f
lea eax, [ebp - 0x268]
push eax
call fcn.00670d2d
or edi, 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x260], edi
push dword [eax]
call fcn.00454aa5
test eax, eax
je 0x66966f
mov bl, 1
jmp 0x669671
xor bl, bl
mov eax, dword [ebp - 0x260]
test al, 1
je 0x6696e5
mov ecx, dword [ebp - 0x268]
and eax, 0xfffffffe
add ecx, 0xfffffff0
mov dword [ebp - 0x260], eax
call fcn.0044ec01
jmp 0x6696e5
cmp dword [ebp - 0x18], 8
jb 0x66969d
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x238]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x6696c9
test dx, dx
je 0x6696c5
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x6696c9
add ecx, 4
add eax, 4
test dx, dx
jne 0x6696a3
xor eax, eax
jmp 0x6696ce
sbb eax, eax
or eax, 1
test eax, eax
jne 0x6696e3
push 0x7557b8
lea ecx, [ebp - 0x2c]
call fcn.00454aa5
test eax, eax
jne 0x6696e9
xor bl, bl
test bl, bl
je 0x66975c
push dword [ebp - 0x254]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x66975c
lea eax, [ebp - 0x238]
push eax
push str.AppInstaller::killApplicationProcess
push str._s:_Killing_process_with_name:__s
call fcn.006777f4
mov eax, dword [ebp - 0x26c]
add esp, 0xc
cmp dword [eax + 8], 3
je 0x66972d
cmp dword [eax + 8], 4
jne 0x66974c
cmp byte [ebp + 0x14], 0
je 0x669755
push ecx
lea eax, [ebp - 0x238]
mov ecx, esp
push eax
call fcn.004514db
push edi
call fcn.006693f8
test al, al
je 0x669755
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00451740
mov edi, dword [ebp - 0x260]
add esi, 0x18
cmp esi, dword [ebp - 0x270]
jne 0x6695e5
mov ebx, dword [ebp - 0x274]
lea eax, [ebp - 0x25c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x6695be
test ebx, ebx
je 0x6697a4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
call fcn.00454bee
call fcn.0049be03
ret 0x10