joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414757
Capabilities:
Copy file

Disassembly:
mov eax, 0x604ed0
call fcn.00465b38
sub esp, 0x2c
mov eax, dword [0x69df28]
push ebx
test eax, eax
mov ebx, ecx
jne 0x414910
mov eax, dword [ebx + 0x190]
cmp dword [eax - 8], 0
jne 0x414787
xor eax, eax
jmp 0x414910
push esi
push edi
call fcn.004d8300
test eax, eax
mov eax, dword [0x682534]
jne 0x414809
mov dword [ebp - 0x14], eax
mov edi, str.DtFrame32.dll
and dword [ebp - 4], 0
push edi
mov esi, 0x66b78c
push dword [ebx + 0x190]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.005e20b1
mov eax, dword [0x682534]
add esp, 0x10
mov dword [ebp - 0x10], eax
push 1
pop ebx
push edi
mov byte [ebp - 4], bl
call fcn.004e07d0
push eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.005e20b1
add esp, 0x10
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
mov dword [0x69df28], ebx
call fcn.005ecd91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
jmp 0x414904
mov dword [ebp - 0x24], eax
mov edi, str.DtFrame32.dll
mov esi, 0x66b78c
push edi
lea eax, [ebp - 0x24]
push dword [ebx + 0x190]
mov dword [ebp - 4], 2
push esi
push eax
call fcn.005e20b1
mov eax, dword [0x682534]
add esp, 0x10
mov dword [ebp - 0x20], eax
push str.DtFrame64.dll
lea eax, [ebp - 0x20]
push dword [ebx + 0x190]
mov byte [ebp - 4], 3
push esi
push eax
call fcn.005e20b1
mov eax, dword [0x682534]
add esp, 0x10
mov dword [ebp - 0x1c], eax
push edi
push str.SysWow64
mov byte [ebp - 4], 4
call fcn.004e0320
push eax
mov esi, 0x66cc2c
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.005e20b1
mov eax, dword [0x682534]
add esp, 0x14
mov dword [ebp - 0x18], eax
push str.DtFrame64.dll
push str.System32
mov byte [ebp - 4], 5
call fcn.004e0320
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.005e20b1
add esp, 0x14
lea ecx, [ebp - 0x38]
call fcn.00455c23
push 1
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
pop ebx
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
call esi
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call esi
lea ecx, [ebp - 0x38]
mov dword [0x69df28], ebx
call fcn.00455c5c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.005ecd91
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.005ecd91
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.005ecd91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.005ecd91
mov eax, dword [0x69df28]
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4152dd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x605018
call fcn.00465b38
sub esp, 0x38
push esi
call fcn.004e07d0
push eax
lea ecx, [ebp - 0x10]
call fcn.005ece05
and dword [ebp - 4], 0
push str.TSDFmt32.dll
lea ecx, [ebp - 0x10]
call fcn.005ed182
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41531c
xor esi, esi
jmp 0x415359
lea ecx, [ebp - 0x44]
call fcn.004091e3
lea eax, [ebp - 0x44]
push 0
push eax
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
call fcn.004ee4a0
add esp, 0xc
test eax, eax
je 0x41534b
cmp dword [ebp - 0x40], 0x70000
jne 0x41534b
push 1
pop esi
jmp 0x41534d
xor esi, esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00409264
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.005ecd91
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x415374
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov eax, 0x605034
call fcn.00465b38
sub esp, 0x454
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.004152dd
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4153e1
lea eax, [ebp - 0x18]
push eax
push str.OEAServer
call fcn.004da680
pop ecx
test eax, eax
pop ecx
je 0x41542a
push dword [0x66b7d4]
call fcn.00411ffd
mov edi, eax
pop ecx
cmp edi, esi
je 0x41542a
lea eax, [ebp - 0x14]
push eax
call fcn.00415108
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41542a
mov ecx, 0x10b
xor eax, eax
lea edi, [ebp - 0x45c]
mov dword [ebp - 0x460], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x460]
push 0x430
push eax
call fcn.004388ae
pop ecx
test eax, eax
pop ecx
je 0x41542a
lea eax, [ebp - 0x450]
push eax
call fcn.00465c4f
test eax, eax
pop ecx
je 0x41542a
push 4
lea eax, [ebp - 0x450]
push esi
push eax
call ebx
mov edi, 0x69dd10
mov ecx, edi
call fcn.0041b7bf
test eax, eax
jne 0x415450
mov ecx, edi
call fcn.0041b74d
mov ecx, edi
call fcn.0041b2c0
mov ecx, dword [ebp - 0x10]
call fcn.0041d172
lea ecx, [ebp - 0x30]
call fcn.005e65fe
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
mov dword [ebp - 4], esi
call fcn.004011aa
mov eax, dword [eax]
lea ecx, [ebp - 0x30]
push ecx
push eax
mov byte [ebp - 4], 1
call fcn.004e91c0
and byte [ebp - 4], 0
pop ecx
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00480a70
cmp dword [ebp - 0x28], 0
jle 0x4154b9
mov eax, dword [ebp - 0x2c]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 0x2c]
and al, 0xfe
push eax
mov ecx, dword [ecx + esi*4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x2c]
push 4
push 0
mov eax, dword [eax + esi*4]
push eax
call ebx
inc esi
cmp esi, dword [ebp - 0x28]
jl 0x41548a
call fcn.0041ea52
mov eax, dword [ebp - 0x10]
push dword [eax + 0x1c0]
call fcn.00404c54
mov esi, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x30]
call fcn.005e6631
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4159e1
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x415a6b
push ebx
push edi
lea edi, [esi + 1]
push edi
call fcn.005ed45a
mov ebx, eax
pop ecx
test ebx, ebx
je 0x415a62
push edi
push 0
push ebx
call fcn.00466010
add esp, 0xc
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x415a62
lea eax, [ebp - 8]
mov dword [ebp + 8], esi
push eax
lea eax, [ebp + 8]
push eax
push str.StringFileInfo040904b0Comments
push ebx
mov dword [ebp - 8], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x415a62
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00466bdc
add esp, 0xc
test eax, eax
jne 0x415a62
mov dword [ebp - 4], 1
push ebx
call fcn.005ed483
pop ecx
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x4162a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x60515b
call fcn.00465b38
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
push 0x69dc58
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x2c], ebx
call fcn.00480200
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.0048f4d0
mov edi, 0x20019
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0048f5f0
test eax, eax
je 0x416321
lea eax, [ebp - 0x18]
push ebx
push eax
lea ecx, [ebp - 0x28]
call fcn.0048fc20
push dword [eax]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00480d50
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.005ecd91
lea ecx, [ebp - 0x28]
call fcn.0048f640
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0048f570
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x4163eb
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4163e3
cmp dword [ebp + 0xc], ebx
je 0x4163eb
lea ecx, [ebp - 0x34]
call fcn.0048f4d0
push edi
push str.SOFTWAREMicrosoftInternet_Explorer
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.0048f5f0
test eax, eax
je 0x4163d5
lea eax, [ebp - 0x18]
push str.Version
push eax
lea ecx, [ebp - 0x34]
call fcn.0048fc20
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.0048f640
mov eax, dword [ebp - 0x18]
cmp dword [eax - 8], ebx
je 0x4163c9
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0x66d3ac
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00466068
movzx eax, word [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
add esp, 0x18
mov dword [ecx], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.005ecd91
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.0048f570
jmp 0x4163eb
lea ecx, [ebp - 0x10]
call fcn.00480790
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0047fff0
mov dword [ebp - 0x2c], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00480a70
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x418200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push edi
mov ebx, 0x20019
xor edi, edi
push eax
push ebx
push edi
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x41834a
push dword [ebp + 8]
mov word [ebp - 0x218], di
mov ecx, 0x82
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
push str._sConnection
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 8]
xor edi, edi
push eax
push ebx
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp + 8], edi
push dword [ebp - 8]
call esi
test eax, eax
jne 0x418341
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 4]
push eax
push edi
push str.MediaSubType
mov ebx, 0x104
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 1
call esi
test eax, eax
jne 0x4182c2
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x218]
mov dword [eax], ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 4]
push eax
push edi
push str.PnpInstanceID
push dword [ebp + 8]
call esi
test eax, eax
jne 0x418331
mov esi, 0x66dfdc
push esi
call fcn.00465c4f
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00465b57
mov ecx, dword [ebp + 0x10]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
jne 0x418331
mov esi, 0x66dfd4
push esi
call fcn.00465c4f
push eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00465b57
mov ecx, dword [ebp + 0x14]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418352
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov eax, 0x60533c
call fcn.00465b38
sub esp, 0x4a8
push ebx
push esi
lea eax, [ebp - 0x4b4]
push edi
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor ebx, ebx
cmp eax, ebx
jne 0x418430
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x117]
mov byte [ebp - 0x118], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push esi
push eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x418422
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x14]
push eax
call fcn.005ece5a
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], ebx
call fcn.005eced8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.005ecd91
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x418422
mov eax, dword [eax + 0xc]
xor edx, edx
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, eax
mov dl, ah
and ecx, 0xff
mov dword [ebp + 0xc], eax
shl ecx, 8
add ecx, edx
xor edx, edx
mov dl, byte [ebp + 0xe]
shl ecx, 8
add ecx, edx
shl ecx, 8
shr eax, 0x18
add ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x418425
mov dword [ebp - 0x10], ebx
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp dword [ebp - 0x10], ebx
jne 0x418434
xor eax, eax
jmp 0x418471
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x322]
mov word [ebp - 0x324], bx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x324]
push esi
push eax
call fcn.00418482
pop ecx
test eax, eax
pop ecx
je 0x41846f
mov ecx, dword [ebp + 0x10]
push 1
pop ebx
lea eax, [ebp - 0x324]
push eax
call fcn.005ecf28
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x418482
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
lea eax, [esi + esi]
push eax
push edi
push dword [ebp + 8]
call fcn.00466010
add esp, 0xc
mov dword [ebp + 0xc], edi
push 0x41
push edi
push 1
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov ebx, eax
cmp ebx, edi
je 0x418507
push 0x31
mov word [ebp - 0xcc], di
pop ecx
xor eax, eax
lea edi, [ebp - 0xca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xcc]
push eax
push 0x418579
push ebx
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push ebx
call dword [sym.imp.USER32.dll_CloseDesktop]
lea eax, [ebp - 0xcc]
push eax
call fcn.00465c4f
cmp eax, esi
pop ecx
jae 0x418505
lea eax, [ebp - 0xcc]
jmp 0x418550
xor edi, edi
push 0x31
mov word [ebp - 0xcc], di
pop ecx
xor eax, eax
lea edi, [ebp - 0xca]
mov dword [ebp - 4], 0x64
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x41855d
lea eax, [ebp - 0xcc]
push eax
call fcn.00465c4f
cmp eax, esi
pop ecx
jae 0x418571
lea eax, [ebp - 0xcc]
push eax
push dword [ebp + 8]
call fcn.00466936
pop ecx
pop ecx
jmp 0x41856a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x418571
mov dword [ebp + 0xc], 1
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419d50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
and dword [ebp - 0x58], 0
push 0x40
mov esi, ecx
pop ebx
xor eax, eax
push 0xf
lea edi, [ebp - 0x54]
pop ecx
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.00419d0c
xor edi, edi
mov dword [esi + 0x1cc], eax
cmp eax, edi
jne 0x419e34
push dword [esi + 0x1c0]
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0045045d
add esp, 0xc
test eax, eax
je 0x419e34
cmp dword [ebp - 8], edi
jne 0x419dd6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x54], 1
push eax
call fcn.0045b9cc
push dword [esi + 0x1c0]
fld qword [eax]
lea eax, [ebp - 0x58]
push ebx
fstp qword [ebp - 0x48]
push eax
call fcn.004505e1
add esp, 0xc
jmp 0x419e0c
cmp dword [ebp - 0x54], edi
je 0x419e09
lea eax, [ebp - 0x18]
push eax
call fcn.0045b9cc
fld qword [eax]
fld qword [ebp - 0x48]
fcomp st(1)
fnstsw ax
sahf
fstp st(0)
ja 0x419e09
lea eax, [ebp - 0x18]
mov dword [ebp - 0x54], 1
push eax
call fcn.0045b9cc
fld qword [eax]
fstp qword [ebp - 0x48]
jmp 0x419e0c
mov dword [ebp - 0x54], edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x50], edi
call esi
push 1
mov dword [ebp - 0x4c], eax
call fcn.00444e4b
pop ecx
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
push eax
call fcn.00444d84
pop ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0xc], edi
call fcn.004387c1
add esp, 0xc
test eax, eax
je 0x419e9c
push dword [ebp - 4]
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00493470
add esp, 0xc
cmp dword [ebp - 0xc], eax
jne 0x419e9c
call fcn.00444e45
test eax, eax
jne 0x419e7f
cmp dword [ebp - 0x50], edi
je 0x419e7f
lea eax, [ebp - 0x58]
push eax
call fcn.00444d84
pop ecx
call fcn.00444e2f
test eax, eax
jne 0x419e9c
cmp dword [ebp - 0x50], edi
jne 0x419e92
cmp dword [ebp - 0x54], edi
je 0x419e9c
lea eax, [ebp - 0x58]
push eax
call fcn.00444d84
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41a5c2
Capabilities:
Query environment variable

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
ret 0xc
Function at 0x41aa34
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov eax, 0x6055af
call fcn.00465b38
sub esp, 0x28
and dword [ebp - 0x20], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
test ebx, ebx
push edi
mov esi, ecx
je 0x41ac3d
push ebx
call fcn.00465c4f
test eax, eax
pop ecx
je 0x41ac3d
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
call edi
cmp eax, 0xffffffff
jne 0x41aa84
mov ecx, dword [ebp + 8]
push 0x69dc58
call fcn.005ece05
jmp 0x41ac4a
lea eax, [ebp - 0x18]
push ebx
push eax
mov ecx, esi
call fcn.00417d1d
push 1
lea eax, [ebp - 0x28]
pop ebx
lea ecx, [ebp - 0x18]
push 4
push eax
mov dword [ebp - 4], ebx
call fcn.005e1bd3
push 0x66ae34
push dword [eax]
call fcn.00466804
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x28]
setne byte [ebp - 0xd]
call fcn.005ecd91
cmp byte [ebp - 0xd], 0
je 0x41aadb
mov ecx, dword [ebp + 8]
push 0x69dc58
call fcn.005ece05
mov dword [ebp - 0x20], ebx
jmp 0x41ac2f
push 0
call fcn.00403d84
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
call fcn.004042c5
lea eax, [ebp - 0x18]
add esi, 0x184
push eax
lea eax, [ebp - 0x14]
push esi
push eax
mov byte [ebp - 4], 2
call fcn.005ecfd0
push dword [ebp - 0x14]
mov byte [ebp - 4], 3
call edi
cmp eax, 0xffffffff
je 0x41abcb
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x14]
call edi
cmp eax, 0xffffffff
je 0x41abcb
push 0x2e
lea ecx, [ebp - 0x18]
call fcn.005e1d1b
cmp eax, 0xffffffff
mov dword [ebp - 0x2c], eax
je 0x41aba1
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x18]
call fcn.005e1c4f
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
call fcn.005e1b1a
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x14]
push dword [ebp - 0x28]
push dword [esi]
push str._s_s__d__s
push eax
call fcn.005e20b1
add esp, 0x18
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.005ecd91
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.005ecd91
jmp 0x41abbe
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push dword [ebp - 0x18]
push dword [esi]
push str._s_s__d_
push eax
call fcn.005e20b1
add esp, 0x14
cmp dword [ebp - 0x1c], 0x3e8
jl 0x41ab1a
push dword [ebp - 0x14]
push dword [ebp + 0xc]
call fcn.0043c0f5
pop ecx
test eax, eax
pop ecx
jne 0x41abeb
mov ecx, dword [ebp + 8]
push 0x69dc58
call fcn.005ece05
jmp 0x41ac15
push 0x66b1c4
push dword [ebp - 0x14]
call fcn.004eb5e0
pop ecx
test eax, eax
pop ecx
jne 0x41ac09
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41abdc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.005ecafe
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 2
call fcn.005ecd91
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.004042e8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.005ecd91
jmp 0x41ac4a
mov ecx, dword [ebp + 8]
push 0x69dc58
call fcn.005ece05
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x41ac5e
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41acc1
push esi
call fcn.00465c4f
test eax, eax
pop ecx
je 0x41acc1
cmp dword [ebp + 0xc], 0
je 0x41acc1
push dword [ebp + 0xc]
call fcn.00465c4f
test eax, eax
pop ecx
je 0x41acc1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41acc1
push 0
call fcn.00403d84
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.004042c5
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004042e8
mov eax, esi
jmp 0x41acc3
xor eax, eax
pop esi
leave
ret 8
Function at 0x41b367
Capabilities:
Copy file

Disassembly:
mov eax, 0x605642
call fcn.00465b38
sub esp, 0x14
mov eax, dword [0x6a3388]
and dword [ebp - 0x1c], 0
push esi
push edi
test eax, eax
mov dword [ebp - 0x20], ecx
mov edi, str.TIjtDrv
mov esi, 0x6a2af4
je 0x41b3a1
push str.COEAViewerApp::SetupInjectDrv_TIjtDrv_1
push edi
push 0xffffffffffffffff
push esi
call fcn.004cdcb0
add esp, 0x10
push ebx
call fcn.004d83e0
test eax, eax
je 0x41b4a0
and dword [ebp - 0x10], 0
mov ebx, str.TIjtDrv32.sys
call fcn.004d8300
test eax, eax
je 0x41b3eb
push 0x14
mov ebx, str.TIjtDrv64.sys
call fcn.005ed45a
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x41b3e2
mov ecx, eax
call fcn.00455c23
jmp 0x41b3e4
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [0x6a3388], 0
je 0x41b409
push dword [ebp - 0x10]
push ebx
push str.COEAViewerApp::SetupInjectDrv_TIjtDrv_11___s____08x_
push edi
push 0xffffffffffffffff
push esi
call fcn.004cdcb0
add esp, 0x18
mov eax, dword [0x682534]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], eax
push ebx
mov byte [ebp - 4], 2
call fcn.004e0320
push eax
lea eax, [ebp - 0x18]
push str._sWindowsdrivers_s
push eax
call fcn.005e20b1
mov eax, dword [ebp - 0x20]
add esp, 0x10
push ebx
push dword [eax + 0x190]
lea eax, [ebp - 0x14]
push 0x66b78c
push eax
call fcn.005e20b1
add esp, 0x10
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [0x6a3388], 0
je 0x41b47b
push eax
push str.COEAViewerApp::SetupInjectDrv_TIjtDrv_13___d_
push edi
push 0xffffffffffffffff
push esi
call fcn.004cdcb0
add esp, 0x14
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x41b488
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.005ecd91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.005ecd91
call fcn.00458866
test eax, eax
je 0x41b514
cmp dword [0x6a3388], 0
je 0x41b4c3
push str.COEAViewerApp::SetupInjectDrv_TIjtDrv_2
push edi
push 0xffffffffffffffff
push esi
call fcn.004cdcb0
add esp, 0x10
push 0
push 1
pop ebx
push ebx
call fcn.004589c6
pop ecx
test eax, eax
pop ecx
je 0x41b514
cmp dword [0x6a3388], 0
je 0x41b4ee
push str.COEAViewerApp::SetupInjectDrv_TIjtDrv_3
push edi
push 0xffffffffffffffff
push esi
call fcn.004cdcb0
add esp, 0x10
call fcn.004589f5
test eax, eax
je 0x41b514
cmp dword [0x6a3388], 0
je 0x41b511
push str.COEAViewerApp::SetupInjectDrv_TIjtDrv_4
push edi
push 0xffffffffffffffff
push esi
call fcn.004cdcb0
add esp, 0x10
mov dword [ebp - 0x1c], ebx
cmp dword [0x6a3388], 0
pop ebx
je 0x41b52f
push str.COEAViewerApp::SetupInjectDrv_TIjt
push edi
push 0xffffffffffffffff
push esi
call fcn.004cdcb0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41b7bf
Capabilities:
Check mutex on windows

Disassembly:
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_AGENT
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x41b7e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
neg eax
sbb eax, eax
inc eax
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
ret