joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010584
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10171b0]
push esi
mov esi, ecx
cmp dword [esi + 0x44], 0
mov dword [ebp - 4], eax
push edi
je 0x101060f
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x430
push dword [esi + 0x40]
call edi
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
lea edx, [ebp - 0x210]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
je 0x10105da
xor eax, eax
jmp 0x1010612
lea eax, [ebp - 0x210]
push eax
push 0xff3
push dword [esi + 0x40]
call edi
push eax
call fcn.0101001f
lea eax, [ebp - 0x210]
push eax
push 0
push 0x478
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0101208b
leave
ret

Function at 0x1011666
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x20
push ebp
push esi
push 1
xor ebp, ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebp
jne 0x1011688
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push edi
push 0x14
push 0x100216c
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
mov edi, eax
call ebx
cmp edi, ebp
jne 0x10116b4
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10116d4
push edi
call ebx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x18], 4
jne 0x10116e5
push edi
call ebx
xor eax, eax
jmp 0x1011798
push ebp
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1011702
push edi
call ebx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
xor ebp, ebp
add esi, 0x15f90
inc ebp
mov dword [esp + 0x10], 0x435
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1011787
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x101177f
cmp eax, 3
je 0x101177f
cmp eax, 4
je 0x101177a
cmp eax, 5
jbe 0x1011748
cmp eax, 7
jbe 0x101177f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jae 0x101177f
mov eax, dword [esp + 0x2c]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x101176f
mov ecx, 0x2710
cmp eax, ecx
jbe 0x1011771
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1011781
and dword [esp + 0x10], 0
xor ebp, ebp
test ebp, ebp
jne 0x101171b
jmp 0x1011791
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
push edi
call ebx
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x101208b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10171b0]
jne 0x1012094
ret
jmp 0x1012099
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x10171b0]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x1017304]
test eax, eax
je 0x10120bd
call eax
cmp dword [0x1017308], 0
je 0x1012104
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x1017308]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.0101208b
add ebp, 0x2a8
leave
ret
Function at 0x1012197
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xb0
mov eax, dword [0x10171b0]
and word [ebp - 0x34], 0
push ebx
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [ebp - 0x40], 0
push 0x27
pop ecx
mov dword [ebp + 0x6c], eax
xor eax, eax
lea edi, [ebp - 0x32]
rep stosd dword es:[edi], eax
push 0x50
pop ebx
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x23
mov edi, 0x400
push edi
call esi
test eax, eax
je 0x101226b
xor eax, eax
cmp word [ebp - 0x34], 0x30
sete al
test eax, eax
mov dword [ebp - 0x38], eax
je 0x1012211
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x1005
push edi
call esi
test eax, eax
je 0x101226b
xor eax, eax
cmp word [ebp - 0x34], 0x31
sete al
mov dword [ebp - 0x40], eax
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x25
push edi
call esi
test eax, eax
je 0x101226b
xor eax, eax
cmp word [ebp - 0x34], 0x31
push ebx
sete al
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x34]
push eax
push 0x1e
push edi
call esi
xor esi, esi
cmp eax, esi
je 0x101226b
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [ebp + 0x7c]
xor ecx, ecx
cmp dword [ebp - 0x3c], esi
setne cl
add eax, ecx
mov ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
and ecx, 3
lea eax, [eax + ecx + 4]
cmp eax, ebx
jbe 0x1012267
xor eax, eax
cmp eax, esi
jne 0x101227e
push dword [ebp + 0x7c]
push 0x10021f4
push dword [ebp + 0x78]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x10122ec
cmp dword [ebp - 0x38], esi
mov edi, dword [ebp + 0x78]
mov word [edi], si
je 0x10122a3
cmp dword [ebp - 0x40], esi
je 0x101229b
push ebx
push 0x10021ec
push edi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push ebx
mov ebx, 0x10021e8
jmp 0x10122a9
push ebx
mov ebx, 0x10021e4
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push ebx
push edi
call esi
cmp dword [ebp - 0x3c], 0
je 0x10122c0
push dword [ebp + 0x7c]
push ebx
push edi
call esi
push dword [ebp + 0x7c]
lea eax, [ebp - 0x34]
push eax
push edi
call esi
push dword [ebp + 0x7c]
push 0x10021dc
push edi
call esi
cmp dword [ebp - 0x38], 0
je 0x10122ec
cmp dword [ebp - 0x40], 0
jne 0x10122ec
push dword [ebp + 0x7c]
push 0x10021d4
push edi
call esi
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
pop ebx
call fcn.0101208b
add ebp, 0x70
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x930050
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x930056
pop ebp
sub ebp, 6
sub ebp, 0x530050
jmp 0x9300b4
jmp 0x9300bd
mov eax, 0x530050
add eax, ebp
add eax, 0x93
mov ecx, 0x641
mov edx, 0xa840111a
xor byte [eax], dl
inc eax
dec ecx
jne 0x9300d4
jmp 0x9300e7
jo 0x930143
jb 0x930105
or bl, byte [edx]
sbb dh, byte [edx + 0x1a]
salc
sbb bl, byte ss:[ebx + 0x7de758ea]
push ss
wait
ljmp 0xda29
pop ebx
push ebx
sbb cl, byte [edx - 0x6f]
xlatb
xchg ecx, eax
xchg ebx, eax
sbb bl, byte es:[edx]
sbb bl, byte [edx]
sbb bl, byte [ebx + 0x1a1ae2db]
sbb bl, byte [ecx]
xlatb
mov byte [0x1a1a1a1c], al
mov al, byte [0x1a1a1a32]
in eax, dx
clc
sbb edx, edx
xchg ecx, eax
wait
push ss
sbb bl, byte [edx]
sbb bl, byte [ecx]
fisttp word [edx + 0x72]
xchg ecx, eax
das
adc ebx, dword [edx]
jb 0x930116
rcl byte [ebx + 0x1a]
sbb esi, dword [esi]
jb 0x930159
sbb bl, byte [edx]
sbb dh, dl
pop ds
sbb bl, byte [edx]
sbb dh, bl
xor bl, byte [edx]
sbb bl, byte [edx]
dec edi
dec esi
inc edi
xchg ecx, eax
lahf
adc bl, byte [edx]
sbb bl, byte [edx]
xchg ecx, eax
invalid
sbb bl, byte [edx]
xchg ecx, eax
xchg edi, eax
or bl, byte [edx]
sbb bl, byte [edx]
fcomi st(3)
sbb byte [ebx], ch
sbb byte [ecx + 0x15531ed8], bl
lahf
out dx, al
in eax, 0xe5
push ds
push ebx
adc eax, 0xe5e5ee9f
in eax, 0x47
fcom dword [esi]
sbb dl, byte [ecx + 0x1a1e3e96]
sbb bl, byte [edx]
jb 0x93010e
das
adc ebx, dword [edx]
jb 0x930161
rcl byte [ebx + 0x1a]
sbb esi, dword [esi]
dec ebx
dec ebx
pop ds
sbb bl, byte [edx]
sbb dh, bl
push edi
sbb byte [edx], bl
sbb cl, byte [edi - 0x69]
jbe 0x9301d5
sbb ah, ch
outsd dx, dword [esi]
push ss
in eax, 0x6f
adc dh, dl
sbb bl, byte fs:[edx]
sbb dl, byte [ecx + 0x1a1a12a7]
sbb bl, byte [ebx - 0x51156815]
sbb dword [ebx - 0x51156815], ebx
sbb dword [ecx], ebp
rcr dword [ebx + 0x4a2bf9e8], cl
xor byte [ebx + 0x4a2bf9e8], bl
xor byte [ecx], ch
enter 0xfffffffffffff299, 0x1f
push edx
adc eax, 0x1a1a549e
sbb dl, byte [0x1a1a5292]
sbb bh, byte [ecx + edx*4 + 6]
jl 0x930168
push es
and ebx, dword [edx - 0x61ea0d1f]
add byte [edx], bl
sbb bl, byte [edx]
lcall 0x1a0b, 0x9e15f3e1
sbb bl, byte [edx]
jl 0x930188
loope 0x9301d4
aas
adc eax, 0x1a1a0f9e
sbb bl, byte [ebx - 0xd]
salc
in eax, 0xe5
in eax, 0x33
push esi
and ebx, dword [ebx]
cdq
fistp dword [edi]
cdq
push ds
repe cmpsd dword [esi], dword es:[edi]
in eax, 0xe5
in eax, 0x33
dec esi
and ebx, dword [eax]
cdq
fistp dword [ecx + ebx*4]
invalid
Function at 0x401cd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4820b8], 0
jne 0x401cef
cmp dword [0x4820bc], 0
jne 0x401cef
mov eax, 1
jmp 0x401d80
push 0
push 0
push 1
push 0
call dword [0x4898a4]
mov dword [0x487df8], eax
cmp dword [0x487df8], 0
je 0x401d7e
push 0
push 0
push 1
push 0
call dword [0x4898a4]
mov dword [0x487dfc], eax
cmp dword [0x487dfc], 0
je 0x401d67
push 0
push 0
push 0
push 0x401e00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x487df4], eax
cmp dword [0x487df4], 0
je 0x401d51
mov eax, 1
jmp 0x401d80
mov eax, dword [0x487dfc]
push eax
call dword [0x48988c]
mov dword [0x487dfc], 0
mov ecx, dword [0x487df8]
push ecx
call dword [0x48988c]
mov dword [0x487df8], 0
xor eax, eax
pop ebp
ret
Function at 0x403230
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
cmp dword [0x48967c], 0
jne 0x403249
xor eax, eax
xor edx, edx
jmp 0x40342f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
jle 0x403278
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x403286
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0x10], 0
jle 0x4032bb
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x54], eax
jmp 0x4032c9
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
jle 0x4032fe
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x40330c
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
jle 0x403341
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x64], edx
jmp 0x40334f
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 8
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x48], 0
xor edx, edx
mov word [ebp - 0x44], dx
mov word [ebp - 0x44], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0x48], esp
and esp, 0xfffffff0
push 0x33
call 0x4033b0
add dword [esp], 5
retf
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x403440
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
je 0x403460
cmp dword [ebp + 0xc], 0
jne 0x40345a
cmp dword [ebp + 0x10], 0
je 0x403460
cmp dword [ebp + 0x14], 0
jne 0x403462
jmp 0x4034b5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.00403475
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4034c0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
cmp dword [ebp + 8], 0
je 0x4034e0
cmp dword [ebp + 0xc], 0
jne 0x4034da
cmp dword [ebp + 0x10], 0
je 0x4034e0
cmp dword [ebp + 0x14], 0
jne 0x4034e4
xor al, al
jmp 0x403548
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.004034fb
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403550
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.0040356b
Function at 0x405f40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
xor eax, eax
mov word [ebp - 0x208], ax
push 0x206
push 0
lea ecx, [ebp - 0x206]
push ecx
call fcn.00421fe0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x406102
xor eax, eax
mov word [ebp - 0x410], ax
push 0x206
push 0
lea ecx, [ebp - 0x40e]
push ecx
call fcn.00421fe0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x406102
xor eax, eax
mov word [ebp - 0x618], ax
push 0x206
push 0
lea ecx, [ebp - 0x616]
push ecx
call fcn.00421fe0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x618]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x406102
xor eax, eax
mov word [ebp - 0x820], ax
push 0x206
push 0
lea ecx, [ebp - 0x81e]
push ecx
call fcn.00421fe0
add esp, 0xc
lea edx, [ebp - 0x410]
push edx
push 0x431a58
push 0x104
lea eax, [ebp - 0x820]
push eax
call fcn.0042205a
add esp, 0x10
xor ecx, ecx
mov word [ebp - 0xc30], cx
push 0x206
push 0
lea edx, [ebp - 0xc2e]
push edx
call fcn.00421fe0
add esp, 0xc
lea eax, [ebp - 0x618]
push eax
push 0x431a78
push 0x104
lea ecx, [ebp - 0xc30]
push ecx
call fcn.0042205a
add esp, 0x10
xor edx, edx
mov word [ebp - 0xa28], dx
push 0x206
push 0
lea eax, [ebp - 0xa26]
push eax
call fcn.00421fe0
add esp, 0xc
lea ecx, [ebp - 0x618]
push ecx
push 0x431a98
push 0x104
lea edx, [ebp - 0xa28]
push edx
call fcn.0042205a
add esp, 0x10
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [0x489c30]
test eax, eax
je 0x4060fb
lea edx, [ebp - 0xc30]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [0x489c30]
test eax, eax
je 0x4060fb
lea ecx, [ebp - 0xa28]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [0x489c30]
test eax, eax
jne 0x406102
mov eax, 1
jmp 0x406104
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x406260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40634b
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406341
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406337
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [0x4898ac]
test eax, eax
je 0x40632d
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40632d
mov edx, dword [ebp - 8]
push edx
push str._sexplorer.exe
push 0x7fff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042205a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40632d
mov eax, dword [ebp - 4]
push eax
call dword [0x4898a0]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x4898a0]
mov edx, dword [ebp - 0xc]
push edx
call dword [0x4898a0]
mov eax, 1
jmp 0x40634d
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4898a0]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x4898a0]
mov edx, dword [ebp - 4]
push edx
call dword [0x4898a0]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x406360
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40644b
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406441
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406437
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [0x4898ac]
test eax, eax
je 0x40642d
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40642d
mov edx, dword [ebp - 8]
push edx
push str._s_svchost.exe
push 0x7fff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042205a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40642d
mov eax, dword [ebp - 4]
push eax
call dword [0x4898a0]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x4898a0]
mov edx, dword [ebp - 0xc]
push edx
call dword [0x4898a0]
mov eax, 1
jmp 0x40644d
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4898a0]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x4898a0]
mov edx, dword [ebp - 4]
push edx
call dword [0x4898a0]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x406460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40654b
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406541
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406537
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40652d
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40652d
mov edx, dword [ebp - 8]
push edx
push 0x431afc
push 0x7fff
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042205a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40652d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x40654d
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x409fd0
Capabilities:
Create directory
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov dword [ebp - 0x10], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a320
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40a1e9
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x40a01f
call dword [0x4898f4]
cmp eax, 0xb7
jne 0x40a1d9
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40a1d9
mov eax, dword [ebp + 8]
add eax, 0x270
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x43225c
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40a1c9
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x220]
push edx
call fcn.0041b090
add esp, 8
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x40a1c9
mov dword [ebp - 0x22c], 0xffffffff
push 0
push 0x80
push 1
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x22c], eax
call dword [0x4898f4]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x40a0ff
cmp dword [ebp - 0x230], 0x50
jne 0x40a1b3
cmp dword [ebp - 0x230], 0x50
jne 0x40a10c
jmp 0x40a16b
push 0
lea ecx, [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x234]
cmp edx, dword [ebp - 0x224]
jne 0x40a193
mov eax, dword [ebp - 0x22c]
push eax
call dword [0x48988c]
mov dword [ebp - 0x22c], 0xffffffff
cmp dword [ebp - 0x22c], 0xffffffff
je 0x40a16b
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [0x48988c]
mov edx, dword [ebp - 0x228]
push edx
call dword [0x4898a0]
mov eax, dword [ebp - 0x14]
push eax
call dword [0x4898a0]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x4898a0]
mov eax, 1
jmp 0x40a1eb
cmp dword [ebp - 0x22c], 0xffffffff
je 0x40a1a9
mov edx, dword [ebp - 0x22c]
push edx
call dword [0x48988c]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x228], 0
je 0x40a1c9
mov ecx, dword [ebp - 0x228]
push ecx
call dword [0x4898a0]
cmp dword [ebp - 0x14], 0
je 0x40a1d9
mov edx, dword [ebp - 0x14]
push edx
call dword [0x4898a0]
cmp dword [ebp - 0xc], 0
je 0x40a1e9
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4898a0]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40a410
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x436830
call dword [0x489c48]
test eax, eax
jne 0x40a4ff
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40a4f5
mov ecx, dword [ebp + 8]
add ecx, 0x5c4a
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x432278
push 0x7fff
mov eax, dword [ebp - 8]
push eax
call dword [0x489c38]
add esp, 0x14
test eax, eax
jle 0x40a4eb
call fcn.0040a900
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40a4eb
mov dword [ebp - 0x18], 0xc
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x40a4b6
call dword [0x4898f4]
cmp eax, 0xb7
jne 0x40a4db
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x4898a0]
mov edx, dword [ebp - 8]
push edx
call dword [0x4898a0]
mov eax, dword [ebp - 4]
push eax
call dword [0x489c64]
mov eax, 1
jmp 0x40a501
cmp dword [ebp - 0xc], 0
je 0x40a4eb
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x4898a0]
mov edx, dword [ebp - 8]
push edx
call dword [0x4898a0]
mov eax, dword [ebp - 4]
push eax
call dword [0x489c64]
xor eax, eax
mov esp, ebp
pop ebp
ret