joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbc71a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
call fcn.00bc15d6
mov dword [ebp - 0xc], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0xc]
add ecx, dword [eax + edx + 0x78]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x20]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x1c]
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x24]
mov dword [ebp - 0x14], edx
mov ecx, 1
test ecx, ecx
je 0xbc726b
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00bc6ef0
add esp, 0xc
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00bc7170
add esp, 8
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
add edx, 0x3c
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00bc7030
add esp, 0xc
movzx edx, al
test edx, edx
je 0xbc7269
mov eax, dword [ebp - 8]
jmp 0xbc726d
jmp 0xbc71f9
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0xc23048
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x214], eax
mov dword [eax], esi
lea eax, [ecx - 1]
cmp eax, 1
jbe 0xc23095
mov ecx, dword [ebp + 4]
mov esi, 0x80070057
push esi
push 0xb2f324
mov edx, 0x4bd
call fcn.00bc28ed
mov eax, esi
jmp 0xc23235
push edi
push ecx
push 0xb3df38
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.00b55e8f
mov edi, eax
add esp, 0x10
test edi, edi
jns 0xc230d0
mov ecx, dword [ebp + 4]
mov edx, 0x4c1
push edi
push 0xb2f324
call fcn.00bc2921
mov eax, edi
jmp 0xc23234
push ebx
push 0xb28bd8
mov edi, 0x124
push edi
call fcn.00bc1282
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0xc230f6
push edi
push esi
push ebx
call fcn.00bc259b
add esp, 0xc
jmp 0xc230f8
mov ebx, esi
test ebx, ebx
jne 0xc23119
mov ecx, dword [ebp + 4]
mov esi, 0x8007000e
push esi
push 0xb2f324
mov edx, 0x4c5
call fcn.00bc28ed
jmp 0xc23231
lea eax, [ebp - 0x20c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x204]
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0xc231fa
lea eax, [ebp - 0x208]
mov dword [ebp - 0x210], esi
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x208], 4
push eax
push esi
push 0x10
push 0xb3df90
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
test edi, edi
jne 0xc231ea
cmp dword [ebp - 0x210], esi
mov dword [ebp - 0x208], 0x20
setne al
mov byte [ebx], al
lea eax, [ebp - 0x208]
push eax
lea eax, [ebx + 2]
push eax
push esi
push 2
push 0xb3dfa0
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
test edi, edi
je 0xc231be
cmp edi, 0xea
jne 0xc231ea
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x102
push eax
lea eax, [ebx + 0x22]
push eax
push esi
push 2
push 0xb3dfb8
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0xc23229
cmp edi, 0xea
je 0xc23229
push ebx
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp edi, 2
je 0xc23231
test edi, edi
jg 0xc2321e
mov esi, edi
jmp 0xc23231
movzx esi, di
or esi, 0x80070000
jmp 0xc23231
mov eax, dword [ebp - 0x214]
mov dword [eax], ebx
mov eax, esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8
Function at 0xc232ee
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 2
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0x20001009
mov edi, 0x400
push edi
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
jle 0xc2333d
xor esi, esi
push esi
push 0x100
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call fcn.00c23246
push eax
push dword [ebp - 4]
push edi
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetCalendarInfoW]
test eax, eax
jg 0xc2335b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc23354
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc2335b
mov esi, 0x80004005
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0xc23d91
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
mov esi, 0xb3dfe8
xor ebx, ebx
push ebx
push 0xb27ee8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x18], 2
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
test eax, eax
je 0xc23e03
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0x4a
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
and al, 1
mov bl, al
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
Function at 0xc26185
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ebx
push edi
mov edi, ecx
test edx, edx
je 0xc261b7
cmp word [edx], bx
je 0xc261b7
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push edx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp - 4]
jmp 0xc261bc
mov eax, edi
mov dword [ebp - 4], eax
test esi, esi
jne 0xc261e4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov esi, eax
cmp dword [ebp - 4], edi
je 0xc261e4
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xc290d0
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xffffffe4
push eax
push 0xc35e10
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_EnumWindows]
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4
Function at 0xc360a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push ebx
push esi
push edi
push eax
push 1
xor esi, esi
push esi
push 0xb3ee28
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
push 4
pop edi
test eax, eax
jne 0xc360fb
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0xb3ee9c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xc360f2
cmp dword [ebp - 0xc], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 1
push esi
push 0xb27048
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xc3614e
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0xb3ee9c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xc36145
test ebx, ebx
jne 0xc36142
cmp dword [ebp - 0xc], esi
jne 0xc36142
mov ebx, esi
jmp 0xc36145
xor ebx, ebx
inc ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xc379de
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push esi
push esi
push 0xb46de8
call dword [sym.imp.api_ms_win_storage_exports_internal_l1_1_0.dll_SHGetKnownFolderIDList]
test eax, eax
js 0xc37a41
push 0x38
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 0x3c
push esi
push eax
call fcn.00bc259b
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 0x10000c
mov dword [ebp - 0x24], 1
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0xc37a48
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push edi
push edi
push eax
push edi
push 0xb2f448
mov esi, ecx
mov dword [ebp - 4], edi
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_SHParseDisplayName]
test eax, eax
js 0xc37aad
push 0x38
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 0x3c
push edi
push eax
call fcn.00bc259b
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 0x10000c
mov dword [ebp - 0x24], 1
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0xb3ede8
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 4]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0xc37ac2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0xd0ba60
xor edi, edi
push ebx
inc edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0xc37b1e
mov esi, 0x104
push edi
push ebx
push 0xb3ed7c
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00b55e8f
add esp, 0x14
lea eax, [ebp - 0x20c]
inc edi
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xc37af2
jmp 0xc37b79
push ebx
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindExtensionW]
mov ebx, eax
test ebx, ebx
je 0xc37b89
mov esi, 0x104
lea ecx, [ebp - 0x414]
push ebx
mov edx, esi
call fcn.00b7db60
xor eax, eax
mov word [ebx], ax
mov ebx, 0xd0ba60
lea eax, [ebp - 0x414]
push eax
push edi
push ebx
push 0xb3ed88
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00b55e8f
add esp, 0x18
lea eax, [ebp - 0x20c]
inc edi
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xc37b48
lea eax, [ebp - 0x20c]
mov edx, esi
push eax
mov ecx, ebx
call fcn.00b7db60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret

Function at 0xc37f84
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
mov edi, esi
cmp dword [ebx + 0xc4], esi
je 0xc38005
mov ecx, dword [ebx + 0x2c]
xor eax, eax
shr ecx, 1
and ecx, 1
cmp dword [ebx + 0x148], esi
setne al
cmp ecx, eax
jne 0xc38005
push 0x20
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0xc38005
mov eax, dword [ebx + 0xc4]
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0xc], eax
mov eax, dword [0xd0a20c]
mov dword [edi + 4], eax
mov eax, dword [ebx + 4]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x28]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x148]
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x1c], eax
mov dword [ebx + 0xc4], esi
mov dword [ebx + 0x2c], esi
test edi, edi
je 0xc3805d
push esi
push 0x2000
push edi
push 0xc34860
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
test eax, eax
je 0xc38027
xor esi, esi
inc esi
jmp 0xc3805d
cmp dword [ebx + 0xc4], esi
je 0xc38046
mov ebx, dword [edi]
test ebx, ebx
je 0xc3804e
push dword [ebx + 4]
call fcn.00b7e86f
push ebx
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0xc3804e
mov eax, dword [edi]
mov dword [ebx + 0xc4], eax
push edi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0xc38066
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0xd0a5c0], 1
push edi
mov edi, ecx
je 0xc38096
mov edx, 0xb3dba0
mov ecx, 0xd08200
call fcn.00b8e628
mov ecx, dword [edi + 4]
mov edx, 0xb47238
call fcn.00c72071
test eax, eax
jne 0xc3816c
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x2d2
push dword [0xd0a648]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadStringW]
lea eax, [ebp - 0x20c]
push eax
push 0x8002
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0xc38111
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowThreadProcessId]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
cmp dword [ebp - 0x210], eax
jne 0xc38111
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_IsWindowVisible]
test eax, eax
je 0xc38111
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetForegroundWindow]
jmp 0xc3816b
push 0x10
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc3816b
push esi
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_SetRectEmpty]
add dword [esi + 8], 0x28
add dword [esi + 0xc], 0x28
push 2
push esi
push 0
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_MapWindowPoints]
push 0
push 0x2008
push esi
push 0xc34e10
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
test eax, eax
jne 0xc3816b
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
Function at 0xc3843d
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
xor ecx, ecx
mov word [ebp - 0x20c], cx
test eax, eax
je 0xc384c6
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0xc384c6
cmp word [ebp - 0x20c], 0
je 0xc384b5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0xc384b5
push eax
call dword [sym.imp.SHCORE.dll_Ordinal_174]
cmp eax, 2
je 0xc384a4
cmp eax, 5
jne 0xc384b5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
test eax, eax
je 0xc384c6
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0xc384d8
push 0
push 0x10
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetSpecialFolderPathW]
push 0x100
lea eax, [ebp - 0x40c]
push eax
push 0x2d2
push dword [0xd0a648]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadStringW]
push 4
push 0
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_61]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0x10

Function at 0xc3b2d4
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x230
mov eax, 0xbcce40
call fcn.00bc132b
mov edi, ecx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [edi + 0x28]
call fcn.00c3b755
and dword [ebp - 4], 0
push ecx
call fcn.00bb5d8a
mov ecx, dword [edi]
call fcn.00c3b67f
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xc3b31c
push eax
push 0xb2f934
mov edx, 0x315
call fcn.00b913f8
mov ecx, dword [edi]
call fcn.00c3c764
mov esi, eax
test esi, esi
jns 0xc3b341
mov ecx, dword [ebp + 4]
mov edx, 0x317
push esi
push 0xb2f934
call fcn.00bc2921
jmp 0xc3b3c6
push ecx
call fcn.00bb5d8a
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00bc259b
pop ecx
pop ecx
lea ecx, [edi + 0x18]
lea edx, [ebp - 0x218]
call fcn.00c3babd
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xc3b383
push eax
push 0xb2f934
mov edx, 0x31f
call fcn.00b913f8
jmp 0xc3b3bb
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0xc3b3a3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0xc3b3a3
mov al, 1
jmp 0xc3b3a5
xor al, al
mov ecx, dword [ebp + 4]
test al, al
je 0xc3b3bb
push 0xb2f934
mov edx, 0x322
call fcn.00c2616d
push ecx
lea ecx, [edi + 0x28]
call fcn.00bb4624
xor esi, esi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x220], 0
je 0xc3b3de
lea ecx, [ebp - 0x22c]
call fcn.00b54a44
lea ecx, [ebp - 0x23c]
call fcn.00b8458c
mov eax, esi
call fcn.00bc12da
ret
Function at 0xc3babd
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0xd0b218], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0xc3bb1a
push 0xd0b218
push 0xb3f030
xor eax, eax
push eax
push eax
push 0x801c
push eax
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathAndSubDirW]
mov esi, eax
test esi, esi
jns 0xc3bb1a
mov edx, 0x1cf
mov ecx, dword [ebp + 4]
push esi
push 0xb2f934
call fcn.00bc2921
mov eax, esi
jmp 0xc3bb99
push 0x27
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
test eax, eax
jg 0xc3bb45
mov ecx, dword [ebp + 4]
mov esi, 0x80004005
push esi
push 0xb2f934
mov edx, 0x1d3
call fcn.00bc28ed
jmp 0xc3bb16
lea eax, [ebp - 0x54]
push eax
push 0xb3efe0
lea eax, [ebp - 0x260]
push 0x105
push eax
call fcn.00b55e8f
mov esi, eax
add esp, 0x10
test esi, esi
jns 0xc3bb6f
mov edx, 0x1d6
jmp 0xc3bb08
lea eax, [ebp - 0x260]
push eax
push 0xd0b218
push 0x104
push ebx
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
mov esi, eax
test esi, esi
jns 0xc3bb97
mov edx, 0x1d8
jmp 0xc3bb08
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4

Function at 0xc3f0ce
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ecx + 0x18]
test esi, esi
je 0xc3f174
push 0x4e
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x58]
mov ecx, esi
push 0x27
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00b55c30
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
test eax, eax
jle 0xc3f174
push 0x38
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00bc259b
and dword [ebp - 0x9c], 0
lea eax, [ebp - 0xa4]
add esp, 0xc
mov dword [ebp - 0xa4], 0x3c
mov dword [ebp - 0xa0], 0x100
mov dword [ebp - 0x98], 0xb2f6b8
mov dword [ebp - 0x94], 0xb3f1f8
push eax
mov dword [ebp - 0x88], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
Function at 0xc3f45d
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 0x18]
test edx, edx
je 0xc3f4ad
test ecx, ecx
jne 0xc3f497
mov eax, dword [edx + 0x528]
mov ecx, eax
and ecx, 0xf
test al, 0x20
je 0xc3f497
add ecx, 3
lea eax, [edx + 0x228]
push eax
push ecx
push 0x421
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov eax, dword [edi + 0x18]
test eax, eax
je 0xc3f4d9
test byte [eax + 0x528], 0x10
jne 0xc3f4d9
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1388
jb 0xc3f4d9
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ebx, eax
call fcn.00cdd1fa
mov ecx, edi
call fcn.00c3f183
mov ecx, dword [edi + 0x3c]
push 0x10
push 0
push ecx
mov esi, dword [ecx]
mov esi, dword [esi + 0x8c]
mov ecx, esi
call dword [0xd0cffc]
call esi
push 0x2c
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], 0x30
push 0
push eax
call fcn.00bc259b
mov eax, dword [edi + 0x18]
add esp, 0xc
test eax, eax
je 0xc3f53b
mov ecx, dword [edi + 0xc]
add eax, 0x328
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x439
push ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
xor ecx, ecx
mov dword [edi + 0x2c], 1
cmp dword [edi + 0x18], ecx
je 0xc3f5e7
push ecx
lea eax, [ebp - 0x38]
push eax
push ecx
push 0x2016
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
test eax, eax
je 0xc3f57a
imul eax, dword [ebp - 0x38], 0x3e8
mov dword [ebp - 0x38], eax
cmp eax, 0x2328
jb 0xc3f57a
add eax, 0xffffe890
jmp 0xc3f57f
mov eax, 0xbb8
add eax, 0x3e8
mov ecx, edi
push eax
push 0xe
call fcn.00c3f41c
test al, al
je 0xc3f5e7
mov byte [edi + 0x35], 0
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
push 0x3e8
push 4
mov esi, 0x403
mov dword [edi + 0x30], eax
push esi
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
push 0x1388
push 5
push esi
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
push 0
push 0
add esi, 0xe
push esi
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
lea eax, [ebp - 0x34]
push eax
push 1
push esi
push dword [edi + 0xc]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8