joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40164d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
test esi, esi
jne 0x401660
push 0xd
pop eax
jmp 0x401688
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x401663
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x401dd2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x34], eax
cmp eax, esi
jne 0x401df1
xor al, al
jmp 0x401e0a
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x401d9b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
leave
ret

Function at 0x401e8d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x418550]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], esi
call fcn.004015d6
mov ebx, eax
cmp ebx, esi
je 0x401efe
lea ecx, [ebp - 0x114]
call fcn.0040155f
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088ca
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x401f1c
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x114]
call fcn.00401e8d
cmp eax, esi
jne 0x401f63
lea eax, [ebp - 0x120]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x114]
mov dword [ebp - 0x108], 0x100
call ebx
test eax, eax
je 0x401f06
lea ecx, [ebp - 0x114]
call fcn.0040155f
push dword [ebp - 0x118]
mov ecx, edi
call fcn.0040153d
lea ecx, [ebp - 0x114]
mov esi, eax
call fcn.0040155f
mov eax, esi
jmp 0x401eed
Function at 0x404407
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x411ee8
call fcn.0040919a
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x418], edi
mov byte [ebp - 4], 1
cmp esi, edi
je 0x4044bb
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0040107a
add esp, 0xc
test eax, eax
js 0x4044bb
mov ebx, dword [ebp - 0x41c]
cmp ebx, 0x400
jg 0x40449b
push ebx
call fcn.00401d06
pop ecx
test al, al
je 0x40449b
mov eax, ebx
call fcn.00408c00
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x4044ad
push ebx
lea ecx, [ebp - 0x424]
call fcn.004021c5
mov edi, dword [ebp - 0x424]
push 3
push ebx
push esi
push eax
call fcn.00401160
test eax, eax
jne 0x4044ed
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4044df
lea ecx, [ebp - 0x418]
call fcn.00401c6b
jmp 0x4044df
push edi
mov edi, dword [edi]
call fcn.00408530
pop ecx
test edi, edi
jne 0x4044d6
mov eax, 0x8007000e
jmp 0x40460a
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x404510
call fcn.00401278
mov esi, eax
jmp 0x4045e0
push dword [ebp - 0x420]
push dword [ebp - 0x428]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x404533
call fcn.00401278
jmp 0x4045d2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x404529
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x428], esi
cmp eax, esi
jae 0x404563
mov esi, 0x8007000e
jmp 0x4045d4
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00403206
mov dword [ebp - 4], 1
jmp 0x404595
cmp dword [ebp - 0x418], 0
je 0x40455c
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.00401214
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], 0
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.004041d8
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x404604
lea ecx, [ebp - 0x418]
call fcn.00401c6b
jmp 0x404604
push edi
mov edi, dword [edi]
call fcn.00408530
pop ecx
test edi, edi
jne 0x4045fb
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.004091f6
ret 0x10
Function at 0x405c48
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0
mov dword [ebp + 0x10], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x4132f4
push dword [ebp + 8]
mov ebx, 0x4193c8
push 0x418000
mov ecx, ebx
call fcn.00401aac
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, 0x413864
lea edi, [ebp - 4]
movsw word es:[edi], word [esi]
mov dword [0x4193f8], eax
lea eax, [ebp - 4]
movsb byte es:[edi], byte [esi]
xor esi, esi
push eax
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
jmp 0x405cc6
push str.UnregServer
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x405cf3
push 0x41384c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x405d09
lea eax, [ebp - 4]
push eax
push edi
call fcn.004012fc
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
jne 0x405ca1
mov ecx, ebx
call fcn.00401dd2
push 5
push 4
mov ecx, ebx
call fcn.0040204b
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x405d2d
push esi
push esi
push 0x64
push ebx
call fcn.00404d2f
push esi
push 1
mov ecx, ebx
call fcn.00404383
jmp 0x405d1e
push esi
push 1
push 0x64
push ebx
call fcn.00404d2f
push esi
push 1
mov ecx, ebx
call fcn.00404314
mov dword [ebp + 8], eax
jmp 0x405d4c
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
push esi
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
jne 0x405d23
mov ecx, ebx
call fcn.0040208d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.00401ff9
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4088ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x418550]
jne 0x4088d4
repz ret
jmp fcn.0040b79b
Function at 0x40eee2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418550]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a72d
and dword [ebp - 0x14], 0
cmp dword [0x41a15c], 0
mov dword [ebp - 0x18], eax
jne 0x40ef95
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40f03d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40f03d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41a15c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41a160], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41a164], eax
call edi
push eax
call esi
mov dword [0x41a16c], eax
test eax, eax
je 0x40ef95
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41a168], eax
mov eax, dword [0x41a168]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40efee
cmp dword [0x41a16c], ecx
je 0x40efee
push eax
call esi
push dword [0x41a16c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40efee
test ebx, ebx
je 0x40efee
call edi
test eax, eax
je 0x40efe5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40efe5
test byte [ebp - 8], 1
jne 0x40efee
or dword [ebp + 0x10], 0x200000
jmp 0x40f021
mov eax, dword [0x41a160]
cmp eax, dword [ebp - 0x18]
je 0x40f021
push eax
call esi
test eax, eax
je 0x40f021
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40f021
mov eax, dword [0x41a164]
cmp eax, dword [ebp - 0x18]
je 0x40f021
push eax
call esi
test eax, eax
je 0x40f021
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41a15c]
call esi
test eax, eax
je 0x40f03d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40f03f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088ca
leave
ret
Function at 0x1002737
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
cmp word [edi], 0x2c
je 0x10025f8
mov eax, dword [ebp + 0xc]
cmp word [eax], 0x20
je 0x1002601
push ebx
push dword [ebp - 0x18]
push ebx
push dword [ebp + 0x14]
push ebx
push eax
call fcn.01001573
test eax, eax
je 0x10025d9
inc dword [ebp - 0xc]
mov dword [ebp + 0xc], edi
cmp word [edi], bx
je 0x10028a0
jmp 0x1002a63
cmp dword [ebp + 0xc], ebx
jne 0x10036c7
jmp 0x10036da
xor eax, eax
mov word [edi], ax
inc edi
inc edi
jmp 0x10025ba
inc eax
inc eax
jmp 0x10025bd
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
neg eax
sbb eax, eax
push esi
and eax, 6
push edi
inc eax
mov esi, 0x208
movzx eax, ax
push esi
push 0x40
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
call dword [fcn.0100117c]
mov edi, eax
mov dword [ebp - 8], edi
cmp edi, ebx
je 0x10036c0
cmp dword [ebp + 0xc], ebx
je 0x100279a
push dword [ebp + 0xc]
push 0x104
push edi
call fcn.010021a9
cmp eax, ebx
mov dword [ebp - 0x20], eax
jl 0x1003737
lea eax, [ebp + 0x18]
push eax
xor eax, eax
cmp dword [ebp + 0x10], ebx
push 0x20019
setne al
push ebx
push 0x1002248
add eax, 0x80000001
push eax
call dword [fcn.01001024]
test eax, eax
jne 0x100280a
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebp + 0x18]
call dword [fcn.01001020]
test eax, eax
jne 0x1002801
cmp dword [ebp - 0x10], 1
jne 0x10025ea
mov eax, dword [ebp - 4]
cmp eax, 2
jbe 0x10025ea
shr eax, 1
cmp word [edi + eax*2 - 2], bx
jne 0x10025ea
push dword [ebp + 0x18]
call dword [fcn.01001028]
cmp dword [ebp - 0x14], ebx
jne 0x1002836
cmp dword [ebp + 0x10], ebx
jne 0x1002836
lea eax, [ebp + 0x18]
push eax
push 0x20019
push ebx
push 0x10014a0
push 0x80000001
call dword [fcn.01001024]
test eax, eax
je 0x10036e4
cmp word [edi], bx
jne 0x100284b
push edi
call dword [fcn.01001180]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x18
mov esi, edi
mov dword [ebp + 0xc], esi
cmp dword [ebp + 0x1c], ebx
je 0x1003765
mov esi, dword [0x10010a0]
push 0x10028e0
push dword [ebp + 8]
mov dword [ebp + 0x10], ebx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1002895
push 0x10022d0
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x100288e
push 0x10022b4
push edi
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1002895
mov dword [ebp + 0x10], 1
mov eax, edi
cmp word [eax], bx
jne 0x1002a5a
cmp dword [ebp + 0x10], ebx
je 0x100374e
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
jmp 0x100283b
cmp word [edi], bx
je 0x10025b4
cmp word [edi], 0x2c
je 0x10025f8
inc edi
inc edi
jmp 0x1002a5a
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [eax + 4]
test eax, eax
je 0x401010
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x402060
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebp + 8]
mov byte [ebp - 1], 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x402106
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp dword [ebp - 0x20], 1
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], eax
je 0x402100
push edi
mov edi, 0x3e8
mov eax, dword [ebp - 0xc]
push 0xa
xor edx, edx
pop ecx
div ecx
cmp eax, edi
mov ecx, eax
ja 0x4020af
mov ecx, edi
mov edx, 0x2710
cmp ecx, edx
jae 0x4020c0
cmp eax, edi
ja 0x4020c2
mov eax, edi
jmp 0x4020c2
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4020f9
cmp dword [ebp - 0x10], ebx
jbe 0x4020e9
call esi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4020f3
call esi
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
ja 0x4020f9
cmp dword [ebp - 0x20], 1
jne 0x40209d
cmp dword [ebp - 0x20], 1
pop edi
jne 0x402104
mov byte [ebp - 1], 1
pop esi
pop ebx
mov al, byte [ebp - 1]
leave
ret 4
Function at 0x4023da
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42780b
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x4362ec]
xor eax, esp
mov dword [esp + 0x294], eax
push ebx
push esi
mov eax, dword [0x4362ec]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x2c]
mov esi, ecx
push eax
xor ebx, ebx
push esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x40246d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
mov esi, dword [esp + 0x14]
push str.GetDiskFreeSpaceEx_on___s__failed__Error___d
add esi, 0x3c
call fcn.00406a39
add esp, 0xc
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], eax
and dword [esp + 0x10], 0x80000000
and eax, 0x7fffffff
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
fild qword [esp + 0x1c]
mov dword [esp + 0xc], ebx
fild qword [esp + 0xc]
fchs
faddp st(1)
fmul qword [0x42f478]
call fcn.00423b36
mov esi, dword [ebp + 0x10]
cmp esi, edx
mov dword [edi], eax
mov dword [edi + 4], edx
jb 0x4025d7
ja 0x4024c6
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi]
jbe 0x4025d7
push 0x28
lea eax, [esp + 0x48]
push ebx
push eax
call fcn.00414b10
add esp, 0xc
push 0x14
lea eax, [esp + 0x48]
push eax
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_StrFormatByteSizeW]
call esi
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
call fcn.00407b20
mov dword [esp + 0x2b0], ebx
push 0x28
lea eax, [esp + 0x70]
push ebx
push eax
call fcn.00414b10
add esp, 0xc
push 0x14
lea eax, [esp + 0x70]
push eax
push dword [edi + 4]
push dword [edi]
call esi
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
call fcn.00407b20
mov byte [esp + 0x2b0], 1
mov dword [esp + 0x18], ebx
mov byte [esp + 0x2b0], 2
push 0x104
lea eax, [esp + 0x98]
push eax
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x402572
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x1c]
call fcn.00407b20
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x14]
push str.Data_migration_requires__s_of_disk_space_on_drive__s_but_only__s_is_available.
push dword [esp + 0x3c]
call fcn.00407b07
add esp, 0x14
mov byte [esp + 0x2b0], 1
cmp dword [esp + 0x18], ebx
je 0x4025a6
lea ecx, [esp + 0x18]
call fcn.00407ca7
mov byte [esp + 0x2b0], bl
cmp dword [esp + 0x1c], ebx
je 0x4025bc
lea ecx, [esp + 0x1c]
call fcn.00407ca7
or dword [esp + 0x2b0], 0xffffffff
cmp dword [esp + 0xc], ebx
je 0x4025d3
lea ecx, [esp + 0xc]
call fcn.00407ca7
xor al, al
jmp 0x4025d9
mov al, 1
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x294]
xor ecx, esp
call fcn.004147c2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40266a
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4277bc
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x4362ec]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push esi
push edi
mov eax, dword [0x4362ec]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x34]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x1c
mov edi, ecx
push ebx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
jl 0x4027aa
mov dword [esp + 0x10], ebx
mov dword [esp + 0x250], ebx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
call fcn.00407b20
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push str._sGroove_NetworksGroove_
push eax
call fcn.00407b07
add esp, 0xc
lea eax, [esp + 0x17]
push eax
push dword [esp + 0x14]
mov ecx, edi
mov byte [esp + 0x1f], bl
call fcn.004053a8
test al, al
je 0x402793
push ebx
push ebx
push 3
lea ecx, [esp + 0x2c]
call fcn.0040a343
mov byte [esp + 0x250], 1
push 0x20006
lea edi, [esp + 0x24]
call fcn.0040a614
test eax, eax
jne 0x402783
push 0x42aecc
push dword [esp + 0x14]
call fcn.0040a9e7
test eax, eax
jne 0x402783
push dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
push str.Found_mulitple_id.xss_in_speculative_UserRoot___s_
add esi, 0x3c
call fcn.00406a39
pop ecx
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
call fcn.00407b20
mov byte [esp + 0x250], bl
jmp 0x402870
mov byte [esp + 0x250], bl
lea ecx, [esp + 0x20]
call fcn.0040a3e3
or dword [esp + 0x250], 0xffffffff
cmp dword [esp + 0x10], ebx
je 0x4027aa
lea ecx, [esp + 0x10]
call fcn.00407ca7
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 0x26
push ebx
call esi
test eax, eax
jl 0x402890
mov dword [esp + 0x10], ebx
mov dword [esp + 0x250], 2
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
call fcn.00407b20
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push str._sGrooveData_
push eax
call fcn.00407b07
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea eax, [esp + 0x17]
push eax
push dword [esp + 0x14]
mov byte [esp + 0x1f], bl
call fcn.004053a8
test al, al
je 0x402879
push ebx
push ebx
push 3
lea ecx, [esp + 0x2c]
call fcn.0040a343
mov byte [esp + 0x250], 3
push 0x20006
lea edi, [esp + 0x24]
call fcn.0040a614
test eax, eax
jne 0x402868
push 0x42aee4
push dword [esp + 0x14]
call fcn.0040a9e7
test eax, eax
jne 0x402868
push dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
push str.Found_mulitple_id.xss_in_speculative_UserRoot___s_
add esi, 0x3c
call fcn.00406a39
pop ecx
pop ecx
push dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
call fcn.00407b20
mov byte [esp + 0x250], 2
lea ecx, [esp + 0x20]
call fcn.0040a3e3
or dword [esp + 0x250], 0xffffffff
cmp dword [esp + 0x10], ebx
je 0x402890
lea ecx, [esp + 0x10]
call fcn.00407ca7
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.004147c2
mov esp, ebp
pop ebp
ret 4
Function at 0x40433b
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push 3
push dword [ebp + 0xc]
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x404378
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x50
jne 0x404396
push dword [ebp + 0xc]
push esi
push str.Target_already_exisited_for_MoveFile_of___s__to___s_
lea esi, [edi + 0x3c]
call fcn.00406a39
add esp, 0xc
xor ebx, ebx
push dword [ebp + 0xc]
lea esi, [edi + 0x3c]
push dword [ebp + 8]
push str.Moved___s__to___s_
call fcn.00406a39
add esp, 0xc
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
cmp ebx, 5
jne 0x4043a5
push edi
mov ebx, esi
call fcn.004043c0
mov ebx, eax
test ebx, ebx
je 0x404378
push ebx
push dword [ebp + 0xc]
push esi
push str.MoveFile_of___s__to___s__failed__Error___d
lea esi, [edi + 0x3c]
call fcn.00406a39
add esp, 0x10
jmp 0x40438e

Function at 0x40505f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
mov edi, eax
push str._Classes
call fcn.00407920
test al, al
je 0x40507c
mov al, 1
jmp 0x4050e2
push esi
mov esi, str..DEFAULT
mov edx, edi
call fcn.004072fb
test eax, eax
je 0x4050b8
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x4050a0
xor al, al
jmp 0x4050e1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x48]
cmp eax, ebx
je 0x4050bc
push dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4050bc
mov al, 1
jmp 0x4050e1
xor esi, esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
jne 0x4050d4
inc esi
cmp esi, 0x3d
jbe 0x4050be
jmp 0x4050d6
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x4053a8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x427576
mov eax, dword fs:[0]
push eax
sub esp, 0xa88
mov eax, dword [0x4362ec]
xor eax, esp
mov dword [esp + 0xa80], eax
push ebx
push esi
push edi
mov eax, dword [0x4362ec]
xor eax, esp
push eax
lea eax, [esp + 0xa98]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
and dword [esp + 0x14], 0
lea eax, [esp + 0x67c]
push eax
mov dword [esp + 0x1c], ecx
call fcn.004061e7
and dword [esp + 0xaa0], 0
push ebx
push 0x42cfec
lea ecx, [esp + 0x684]
call fcn.0040999d
pop ecx
pop ecx
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x680]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x405480
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
or dword [esp + 0xaa0], 0xffffffff
lea eax, [esp + 0x67c]
push eax
call fcn.0040133f
mov al, bl
mov ecx, dword [esp + 0xa98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa80]
xor ecx, esp
call fcn.004147c2
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x1c]
and esi, 0x10
je 0x40550f
mov eax, 0x42bf8c
lea ecx, [esp + 0x48]
call fcn.004073b0
test al, al
jne 0x40550f
mov eax, 0x42bf90
lea ecx, [esp + 0x48]
call fcn.004073b0
test al, al
jne 0x40550f
lea eax, [esp + 0x26c]
push eax
call fcn.004061e7
mov byte [esp + 0xaa0], 1
lea eax, [esp + 0x48]
push eax
push ebx
push 0x42bf98
lea ecx, [esp + 0x278]
call fcn.0040999d
mov ecx, dword [esp + 0x24]
add esp, 0xc
push edi
push dword [esp + 0x270]
call fcn.004053a8
test al, al
jne 0x40557c
mov byte [esp + 0xaa0], al
lea eax, [esp + 0x26c]
push eax
call fcn.0040133f
jmp 0x40552c
test esi, esi
jne 0x40552c
mov esi, str.id.xss
lea edx, [esp + 0x48]
call fcn.004072fb
test eax, eax
jne 0x40552c
cmp byte [edi], al
jne 0x4055a2
mov byte [edi], 1
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405562
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
mov dword [esp + 0x14], eax
je 0x405562
mov esi, dword [esp + 0x18]
push eax
push str.FindNextFile_failed__Error___d
add esi, 0x3c
call fcn.00406a39
pop ecx
pop ecx
cmp dword [esp + 0x14], 0
je 0x405480
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x405441
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [esp + 0xaa0], 0
lea eax, [esp + 0x26c]
push eax
call fcn.0040133f
mov bl, 1
jmp 0x405443
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40559b