joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4137c2
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1460
call fcn.00522d80
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x250
xor esi, esi
lea eax, [ebp - 0x145c]
push esi
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
call fcn.00403a64
push eax
lea ecx, [ebp - 0x1460]
call fcn.00402a6b
push 0x208
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
mov ebx, 0x800
lea eax, [ebp - 0xa0c]
push ebx
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x120c]
push esi
push eax
call sub.msvcrt.dll_memset
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push dword [edi + 4]
call fcn.00415db7
add esp, 0x30
cmp dword [edi + 8], esi
jle 0x413868
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
inc esi
cmp esi, dword [edi + 8]
jl 0x413855
push str.config
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcslen
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x1460]
call fcn.00404550
mov esi, str..
push esi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1460]
call fcn.00402d75
mov esi, dword [ebp - 0x1460]
lea eax, [ebp - 0x145c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
test ebx, ebx
je 0x41394d
test byte [ebp - 0x145c], 0x10
je 0x413934
lea eax, [ebp - 0x1430]
push 0x529aac
push eax
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x413934
lea eax, [ebp - 0x1430]
push 0x529ab0
push eax
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x413934
lea eax, [ebp - 0x1430]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x120c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x120c]
mov ecx, edi
push eax
call fcn.004139b7
lea eax, [ebp - 0x145c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4138d4
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esi - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x41505c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0x527fb4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x415088
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415088
test al, 0x10
jne 0x415088
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4150ee
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], esi
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x529bc8
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop esi
test eax, eax
jne 0x415173
push str.pagetype:69
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x415173
xor eax, eax
inc eax
jmp 0x415175
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522d04
leave
ret

Function at 0x415a08
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 2
mov eax, dword [edi]
mov dword [edi + 4], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x415a7b
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x415a7b
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00412c6d
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x415a50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x415a7d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret
Function at 0x415e64
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa24
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa14], 0
lea eax, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x208
push 0
push eax
mov esi, ecx
mov dword [ebp - 0xa24], ebx
mov dword [ebp - 0xa1c], 1
mov dword [ebp - 0xa18], 0x104
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x415ed9
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
je 0x415ed9
add ecx, 0xfffffff0
push ecx
call fcn.00402f5d
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
pop ecx
jmp 0x416052
cmp dword [esi + 0xc], 0
mov ebx, str.configdefaultskin
je 0x415f19
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa1c]
push eax
push dword [esi + 0x18]
push dword [esi + 0x14]
push dword [esi + 0x10]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcslen
pop ecx
test eax, eax
jne 0x415f28
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcslen
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00404550
xor ebx, ebx
lea eax, [ebp - 0xa14]
push 0x5c
inc ebx
mov ecx, esi
push ebx
push eax
call fcn.0040448b
push eax
call fcn.00413382
pop ecx
pop ecx
test al, al
jne 0x415f8c
push 3
pop ebx
push 0x2f
push 1
lea eax, [ebp - 0xa20]
mov ecx, esi
push eax
call fcn.0040448b
push eax
call fcn.00413382
mov byte [ebp - 0xa0d], 0
pop ecx
pop ecx
test al, al
je 0x415f93
mov byte [ebp - 0xa0d], 1
test bl, 2
je 0x415fa6
mov ecx, dword [ebp - 0xa20]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0xa14]
lea ecx, [ecx - 0x10]
call fcn.004042e9
cmp byte [ebp - 0xa0d], 0
je 0x415fcd
mov eax, dword [esi]
mov ecx, esi
push 1
mov eax, dword [eax - 0xc]
dec eax
push eax
call fcn.00403457
push edi
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push dword [esi + 4]
call fcn.00415db7
xor edi, edi
add esp, 0xc
cmp dword [esi + 8], edi
jle 0x415fff
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
inc edi
cmp edi, dword [esi + 8]
jl 0x415fec
push dword [esi]
lea eax, [ebp - 0xa0c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xa0c]
push eax
push 0
call fcn.00416e51
pop ecx
pop ecx
test eax, eax
jne 0x416038
mov edi, str.configdefaultskin
push edi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00404550
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.00402f5d
pop ecx
mov ecx, dword [ebp - 0xa24]
add eax, 0x10
pop edi
mov dword [ecx], eax
mov eax, ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret 8
Function at 0x416062
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2428
call fcn.00522d80
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x2414]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0x2000
push 0
push eax
mov dword [ebp - 0x2418], ebx
mov dword [ebp - 0x2424], edi
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00402f5d
pop ecx
lea esi, [eax + 0x10]
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416122
lea eax, [ebp - 0x2414]
mov ecx, ebx
push eax
call fcn.00402af5
jmp 0x416262
push edi
lea eax, [ebp - 0x241c]
push str..SoftMgr_
push eax
call fcn.0041346d
mov edi, dword [ebp - 0x241c]
lea eax, [ebp - 0x20c]
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41616f
lea eax, [ebp - 0x2414]
push eax
jmp 0x416253
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x2420], 0x104
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x2428]
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41624e
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x1000
lea eax, [ebp - 0x2414]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x41624e
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x2414]
push str.SoftMgr
push eax
call ebx
mov eax, dword [ebp - 0x2424]
push dword [eax]
lea eax, [ebp - 0x2414]
push eax
call ebx
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416248
mov ecx, dword [ebp - 0x2418]
lea eax, [ebp - 0x2414]
push eax
call fcn.00402af5
lea ecx, [edi - 0x10]
call fcn.004042e9
lea ecx, [esi - 0x10]
call fcn.004042e9
mov eax, dword [ebp - 0x2418]
jmp 0x41626c
mov ebx, dword [ebp - 0x2418]
push 0x527fb4
mov ecx, ebx
call fcn.00402af5
lea ecx, [edi - 0x10]
call fcn.004042e9
lea ecx, [esi - 0x10]
call fcn.004042e9
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x416e51
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x416eac
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
push edi
call fcn.00415b4d
add esp, 0x1c
test eax, eax
je 0x416eac
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x416eae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret
Function at 0x417118
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.00522d80
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push str.0xbe8a2dc1__0xdd26__0x1122__0x33__0x44__0x0__0xe0__0x4c__0x53__0xf6__0xe6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x574064], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4172cb
call fcn.00417329
cmp dword [eax + 4], 6
jae 0x4171a4
test edi, edi
je 0x4171a4
push str.fromplantask
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4171a4
push ebx
push ebx
push ebx
push 0x414583
push ebx
push ebx
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x4172ce
push ebx
sub esp, 0x18
mov ecx, esp
push 0x529e48
call fcn.004108e3
lea ecx, [ebp - 0x20]
call fcn.004a7875
push 0x133f0eb
push edi
call sub.msvcrt.dll_wcslen
pop ecx
lea ecx, [ebp - 0x2024]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
call fcn.00413118
push eax
lea ecx, [ebp - 0x20]
call fcn.0041295e
test eax, eax
jne 0x41731c
lea eax, [ebp - 0x2034]
mov dword [ebp - 0x2034], ebx
push eax
mov dword [ebp - 0x2030], ebx
mov dword [ebp - 0x202c], ebx
call fcn.00415a08
mov esi, dword [ebp - 0x2034]
pop ecx
jmp 0x4172ac
lea eax, [esi + 0x24]
push 0x529d34
push eax
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
test eax, eax
jne 0x4172a6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [esi + 8]
je 0x4172a6
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x2028], 1
push ebx
push 0x529e48
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
test ebx, ebx
jne 0x4172dd
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2028]
inc eax
mov dword [ebp - 0x2028], eax
cmp eax, 7
jl 0x41724d
jne 0x4172a4
push dword [esi + 8]
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4172a4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
add esi, 0x22c
cmp esi, dword [ebp - 0x2030]
jne 0x417219
lea ecx, [ebp - 0x2034]
call fcn.004199ed
lea ecx, [ebp - 0x20]
call fcn.004a78a1
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test edi, edi
je 0x417311
push str._fromrenwu
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x417311
push 0
push 0
push 0x1dcc
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x2034]
call fcn.004199ed
lea ecx, [ebp - 0x20]
call fcn.004a78a1
jmp 0x41719d
Function at 0x41744b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x104]
push esi
push 0x100
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
xor esi, esi
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4174a2
test byte [ebp - 0xf2], 0x80
jne 0x4174a2
push esi
inc esi
push esi
push 0
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ebx, eax
test esi, esi
je 0x4174bd
push 0
push 3
push 0
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret

Function at 0x418002
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [0x527b90]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40c], eax
xor eax, eax
push 0x60
push eax
push esi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x408], eax
call ebx
mov edi, eax
test edi, edi
jne 0x41806b
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x41806b
call fcn.00414089
mov esi, eax
jmp 0x41810c
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41808b
call fcn.00414089
jmp 0x4180ff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x418084
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x4180b1
mov esi, 0x8007000e
jmp 0x418101
push eax
lea ecx, [ebp - 0x408]
call fcn.00413f06
cmp dword [ebp - 0x408], 0
je 0x4180aa
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x418084
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.00417ec9
mov esi, eax
test edi, edi
je 0x41810c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x418125
lea ecx, [ebp - 0x408]
call fcn.004152f3
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret 0x10
Function at 0x418b99
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x10]
call fcn.004125d7
pop ecx
test eax, eax
je 0x418bbb
or dword [esi + 4], 0x1000
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
pop ebp
ret

Function at 0x418fd8
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.004daaae
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x10
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x419043
push str..360
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.00414a73
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret
Function at 0x4193ae
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffffe
pop edi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
mov ebx, 0x104
push ebx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00516cf0
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x529eb0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
mov ebx, 0x576d98
push eax
mov ecx, ebx
call fcn.00410b48
test eax, eax
je 0x4194ae
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x418]
call fcn.00402af5
mov esi, str.__elevated
push esi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x418]
call fcn.00402d75
mov esi, dword [ebp - 0x418]
lea eax, [ebp - 0x41c]
and dword [ebp - 0x41c], 0
mov ecx, ebx
push eax
push 1
push 0xbb8
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.004dbb62
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.004042e9
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x41bccc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x1c]
push 0x22
mov dword [ebp - 0x210], eax
pop eax
cmp ax, word [esi]
jne 0x41bd5a
push esi
call sub.msvcrt.dll_wcslen
pop ecx
cmp eax, 0x104
jae 0x41bd5a
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
push esi
call sub.msvcrt.dll_wcslen
sub eax, 2
push eax
lea eax, [esi + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcsncpy
lea eax, [ebp - 0x20c]
push eax
call fcn.004125d7
add esp, 0x20
jmp 0x41bd61
push esi
call fcn.004125d7
pop ecx
test eax, eax
je 0x41bd80
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push dword [ebp - 0x218]
push esi
push ebx
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x41c8ef
Capabilities:
Check if file exists
Check mutex on windows
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0041b2bb
mov esi, eax
mov edx, dword [esi + 0x30]
test edx, edx
je 0x41c919
mov ecx, dword [edx]
push edx
call dword [ecx + 0x2c]
jmp 0x41c91b
xor eax, eax
cmp eax, 3
jne 0x41cb42
push str.QHASKQUESTION:8F96C336_9360_49d9_9CA7_53E459CAFC67_And_360
push 0
push 0x1f0000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x41cb3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41cb42
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str._APPDATA_360Safe360Ask
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41c983
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.AskSet.ini
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x288]
mov ecx, esi
push eax
call fcn.0049fa00
cmp dword [ebp - 0x210], 0
je 0x41cb2e
lea ecx, [ebp - 0x2a8]
call fcn.0041d5b0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x28c]
call fcn.00402af5
push 1
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.0041d7e8
mov ecx, dword [ebp - 0x28c]
mov esi, eax
add ecx, 0xfffffff0
call fcn.004042e9
test esi, esi
jne 0x41cb23
cmp dword [ebp - 0x274], 8
lea eax, [ebp - 0x288]
jb 0x41ca0e
mov eax, dword [ebp - 0x288]
push eax
lea ecx, [ebp - 0x294]
call fcn.00402af5
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
push str.name
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x298], eax
call fcn.00402af5
mov esi, str.User
lea ecx, [ebp - 0x28c]
push esi
call fcn.00402af5
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.0041dfec
mov ecx, dword [ebp - 0x28c]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0x290]
lea ecx, [ecx - 0x10]
call fcn.004042e9
push 0x52b21c
lea ecx, [ebp - 0x28c]
call fcn.00402af5
push esi
lea ecx, [ebp - 0x290]
call fcn.00402af5
push 1
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.0041cbd0
mov ecx, dword [ebp - 0x290]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0x28c]
lea ecx, [ecx - 0x10]
call fcn.004042e9
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x290]
call fcn.00402af5
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.0041dd0a
mov ecx, dword [ebp - 0x290]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0x294]
lea ecx, [ecx - 0x10]
call fcn.004042e9
lea ecx, [ebp - 0x2a8]
call fcn.0041d648
lea ecx, [ebp - 0x288]
call fcn.0041ae0e
jmp 0x41cb42
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret