joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009c01c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2abf
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x100e03e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.10003ab7
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.100244bf
or dword [ebp - 0x250], 0xffffffff
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
push 0x22c
push 0
lea eax, [ebp - 0x24c]
push eax
call fcn.10070f00
add esp, 0xc
mov dword [ebp - 0x24c], 0x22c
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.dll_Process32FirstW
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x10]
call fcn.10030416
push eax
call fcn.1006ea20
pop ecx
pop ecx
test eax, eax
je 0x1009c0f0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x258], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003b22
mov eax, dword [ebp - 0x258]
jmp 0x1009c1c5
xor eax, eax
inc eax
je 0x1009c1a7
push 0x22c
push 0
lea eax, [ebp - 0x24c]
push eax
call fcn.10070f00
add esp, 0xc
mov dword [ebp - 0x24c], 0x22c
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1009c135
or dword [ebp - 0x250], 0xffffffff
jmp 0x1009c1a7
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x254]
call fcn.10003ab7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x254]
call fcn.100244bf
lea ecx, [ebp - 0x254]
call fcn.10030416
push eax
lea ecx, [ebp - 0x10]
call fcn.10030416
push eax
call fcn.1006ea20
pop ecx
pop ecx
test eax, eax
je 0x1009c193
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.10003b22
jmp 0x1009c1a7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.10003b22
jmp 0x1009c0f0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x25c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003b22
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1006e261
leave
ret 4
Function at 0x1009c1de
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x100fe008
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1009c29c
push 0x100c5218
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1009c29c
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x1003af28
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 8
call fcn.1006dfcd
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1009c24a
mov ecx, dword [ebp - 0x18]
call fcn.100370bc
mov dword [ebp - 0x1c], eax
jmp 0x1009c24e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
push 0x100fe218
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.10003b4c
push 0x100fe42c
push 0
push dword [ebp - 0x10]
push 0x1009a77e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1009c29c
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x1009c29e
xor eax, eax
leave
ret

Function at 0x1009c476
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e03e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x118], ecx
and word [ebp - 0x110], 0
push 0xfe
push 0
lea eax, [ebp - 0x10e]
push eax
call fcn.10070f00
add esp, 0xc
push 0x80
lea eax, [ebp - 0x110]
push eax
push 0x100c4b94
call dword [sym.imp.ole32.dll_StringFromGUID2]
and dword [ebp - 4], 0
lea ecx, [ebp - 8]
call fcn.1001f937
push 0x2001f
push 0x100c4ce4
push SysReAllocString
lea ecx, [ebp - 8]
call fcn.100098a5
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 8]
call fcn.10009b42
mov ecx, dword [ebp - 0x118]
add ecx, 0x84
call fcn.10030367
movzx eax, al
test eax, eax
jne 0x1009c529
mov ecx, dword [ebp - 0x118]
add ecx, 0x84
call fcn.10030416
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x114], 1
lea ecx, [ebp - 8]
call fcn.10009917
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e261
leave
ret

Function at 0x1009c54d
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CRemoteInjectLauncher.0
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10030367
movzx eax, al
test eax, eax
jne 0x1009c585
push 4
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10030416
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10003b22
mov ecx, dword [ebp - 4]
call fcn.1003611a
leave
ret
Function at 0x1009c59a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b30c2
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100e03e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10001713
mov byte [ebp - 4], 1
mov eax, dword [0x100ca558]
mov dword [ebp - 0x30], eax
push dword [0x100ca558]
push 0x5c
lea ecx, [ebp - 0x2c]
call fcn.100371ca
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [0x100ca558]
je 0x1009c64a
push dword [ebp - 0x30]
push 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100018ee
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2c]
call fcn.10001760
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.1000174b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
lea eax, [ebp - 0x2c]
push eax
call fcn.10001713
call fcn.1009c59a
add esp, 0x1c
push 0
lea ecx, [ebp + 8]
call fcn.10004c91
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1009c66c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009c686
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.1000174b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000174b
jmp 0x1009c69e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.1000174b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000174b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e261
leave
ret
Function at 0x1009c74f
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3112
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100e03e0]
xor eax, ebp
mov dword [ebp - 0x34], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x1009c784
xor eax, eax
jmp 0x1009c8da
call fcn.10020aa4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1009c79e
and dword [ebp - 0x44], 0
jmp 0x1009c7e4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x1009c7ba
and dword [ebp - 0x48], 0
jmp 0x1009c7de
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.100801c0
mov dword [ebp - 0x4c], esp
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
shl eax, 1
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x4c]
call fcn.10023ab2
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.1006e1c0
pop ecx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.10036c93
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x38]
push eax
call fcn.100aaf82
pop ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
and dword [ebp - 4], 0
push str.TxdlService.dat
push dword [ebp - 0x54]
lea eax, [ebp - 0x28]
push eax
call fcn.100105fb
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10003b22
lea ecx, [ebp - 0x28]
call fcn.10030416
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009c85f
lea ecx, [ebp - 0x28]
call fcn.10030416
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 0x24], 0
push 0x100c45cc
lea ecx, [ebp - 0x28]
call fcn.10030416
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10073b07
add esp, 0xc
cmp dword [ebp - 0x24], 0
je 0x1009c8c8
push dword [ebp - 0x24]
push 1
push 4
lea eax, [ebp - 0x18]
push eax
call fcn.10073cb6
add esp, 0x10
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push 1
push dword [ebp - 0x10]
call fcn.10073cb6
add esp, 0x10
push dword [ebp - 0x24]
call fcn.10073daa
pop ecx
mov dword [ebp - 0x3c], 1
lea ecx, [ebp - 0x28]
call fcn.10003b22
mov eax, dword [ebp - 0x3c]
jmp 0x1009c8da
mov dword [ebp - 0x40], 1
lea ecx, [ebp - 0x28]
call fcn.10003b22
mov eax, dword [ebp - 0x40]
lea esp, [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.1006e261
leave
ret
Function at 0x1009c8f4
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b314a
mov eax, dword fs:[0]
push eax
mov eax, 0x8440
call fcn.100877d0
mov eax, dword [0x100e03e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x844c], ecx
mov eax, dword [ebp - 0x844c]
cmp dword [eax + 0x70], 0
je 0x1009cb46
and word [ebp - 0x8444], 0
push 0x208
push 0
lea eax, [ebp - 0x8442]
push eax
call fcn.10070f00
add esp, 0xc
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x8444]
push eax
call fcn.10071573
add esp, 0xc
lea eax, [ebp - 0x8444]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x8444]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1009c99d
push 0
lea eax, [ebp - 0x8444]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.1001901b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.1003795b
push 0x100c44f4
lea ecx, [ebp - 0x10]
call fcn.100378aa
and word [ebp - 0x8234], 0
push 0x208
push 0
lea eax, [ebp - 0x8232]
push eax
call fcn.10070f00
add esp, 0xc
push 0x104
lea eax, [ebp - 0x8234]
push eax
call fcn.1009a6de
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x10]
call fcn.10030416
push eax
lea eax, [ebp - 0x8234]
push eax
push 0x100c4500
push 0x100c4518
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
and word [ebp - 0x401c], 0
push 0x4002
push 0
lea eax, [ebp - 0x401a]
push eax
call fcn.10070f00
add esp, 0xc
and word [ebp - 0x8024], 0
push 0x4002
push 0
lea eax, [ebp - 0x8022]
push eax
call fcn.10070f00
add esp, 0xc
push section.Downlaod
call fcn.1006e24b
pop ecx
push eax
push section.Downlaod
push 0x2002
lea eax, [ebp - 0x401c]
push eax
call fcn.1009a688
add esp, 0x10
push 0x10101008
call fcn.1006e24b
pop ecx
push eax
push 0x10101008
push 0x2002
lea eax, [ebp - 0x8024]
push eax
call fcn.1009a688
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.10030416
push eax
lea eax, [ebp - 0x8024]
push eax
push 0x100c452c
push 0x100c453c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x10]
call fcn.10030416
push eax
lea eax, [ebp - 0x401c]
push eax
push 0x100c4550
push 0x100c4564
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x8448]
call fcn.10010348
mov byte [ebp - 4], 1
push dword [0x10105014]
push 0x100c4578
lea eax, [ebp - 0x8448]
push eax
call fcn.10015c92
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.10030416
push eax
lea ecx, [ebp - 0x8448]
call fcn.10030416
push eax
push 0x100c4580
push 0x100c458c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8448]
call fcn.10003b22
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1002cc97
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006e261
leave
ret 4
Function at 0x1009cb62
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b317a
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100e03e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
call fcn.100ab0b0
pop ecx
and dword [ebp - 4], 0
push 0x100c4490
lea ecx, [ebp - 0x10]
call fcn.10009c79
lea ecx, [ebp - 0x10]
call fcn.10030416
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and word [ebp - 0x30], 0
xor eax, eax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.10030416
test eax, eax
je 0x1009cc3b
mov ecx, dword [ebp - 0x38]
add ecx, 0x44
call fcn.10030416
mov dword [ebp - 0x3c], eax
push 0
push 0x100c44c4
push dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0x14], eax
push 0xa
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x14]
call fcn.1007294a
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.10030416
push eax
lea eax, [ebp - 0x30]
push eax
push 0x100c44cc
push 0x100c44d8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x16
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.10070f00
add esp, 0xc
mov dword [ebp - 0x34], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003b22
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1006e261
leave
ret
Function at 0x1009d4ec
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 4], esp
push dword [ebp + 8]
call fcn.100016dd
call fcn.1009c59a
add esp, 0x1c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1009d51c
xor eax, eax
inc eax
jmp 0x1009d51e
xor eax, eax
leave
ret

Function at 0x1009d743
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push edi
call fcn.1005b2b4
movzx eax, al
test eax, eax
je 0x1009d772
push section.DLLShare
push str.EntryPoint__g_szCmdline_s
push 0xd2
push 0x100c4d90
call fcn.1005b143
add esp, 0x10
push section.DLLShare
call fcn.1006e24b
pop ecx
test eax, eax
jne 0x1009d7a6
call fcn.1005b2b4
movzx eax, al
test eax, eax
je 0x1009d7a4
push str.EntryPoint__g_szCmdline_is_empty
push 0xd2
push 0x100c4e38
call fcn.1005b143
add esp, 0xc
jmp 0x1009d815
and dword [ebp - 0x60], 0
push 0x40
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.10070f00
add esp, 0xc
and dword [ebp - 0x10], 0
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x81
and word [ebp - 0x30], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push section.DLLShare
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1009d815
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
leave
ret 0x10
Function at 0x1009dcfa
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CServiceLauncher.0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe8], 0
je 0x1009dd5e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x74], 0
je 0x1009dd49
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.10004a56
movzx eax, al
test eax, eax
jne 0x1009dd49
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.10004c91
push eax
call fcn.100aa197
pop ecx
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10004c91
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0xcc
call fcn.1000174b
mov ecx, dword [ebp - 4]
add ecx, 0xb0
call fcn.1000174b
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.1000174b
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.1000174b
mov ecx, dword [ebp - 4]
call fcn.100364d6
leave
ret

Function at 0x1009de7a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.Txdl::CQQExternalShellLauncher.0
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10004a56
movzx eax, al
test eax, eax
jne 0x1009decf
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10004c91
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1009decf
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.10004c91
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10004a56
movzx eax, al
test eax, eax
jne 0x1009def9
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.10004c91
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x94
call fcn.1000174b
mov ecx, dword [ebp - 4]
add ecx, 0x78
call fcn.1000174b
mov ecx, dword [ebp - 4]
call fcn.100362c8
leave
ret
Function at 0x1009df1c
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3918
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x100e03e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x228]
call fcn.1001f937
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.1001f937
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.10010348
mov byte [ebp - 4], 2
cmp dword [ebp + 8], 0
je 0x1009dfbe
push 0x100c4738
lea ecx, [ebp - 0x228]
call fcn.1000aaf9
push eax
push dword [0x100f8148]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp + 8]
call dword [eax + 0x14]
push 0x100c4760
lea ecx, [ebp - 0x230]
call fcn.1000aaf9
push eax
push dword [0x100f8144]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp + 8]
call dword [eax + 0x14]
lea ecx, [ebp - 0x228]
call fcn.10030416
push eax
lea ecx, [ebp - 0x22c]
call fcn.10003b4c
push 0x100c4770
lea ecx, [ebp - 0x22c]
call fcn.10009c79
lea ecx, [ebp - 0x230]
call fcn.10030416
push eax
lea ecx, [ebp - 0x22c]
call fcn.10009c79
and word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.10070f00
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.10030416
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x20a
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.10070f00
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x22c]
call fcn.10030416
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1009e0af
push 0
push 0x100c4774
lea eax, [ebp - 0x224]
push eax
push 0x277e
push dword [0x100fc264]
call fcn.1009cd8b
add esp, 0x14
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.10003b22
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.1000a713
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.1000a713
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e261
leave
ret
Function at 0x1009eb26
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3f07
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x100e03e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x448], ecx
push 0x100c4e98
lea ecx, [ebp - 0x440]
call fcn.100016dd
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x448]
add eax, 4
push eax
lea ecx, [ebp - 0x440]
call fcn.10001776
push 0x100c4e9c
lea ecx, [ebp - 0x440]
call fcn.10004c0a
push 0x100c4ea0
lea ecx, [ebp - 0x440]
call fcn.10004c0a
push dword [ebp + 8]
lea ecx, [ebp - 0x440]
call fcn.10004c0a
lea ecx, [ebp - 0x440]
call fcn.10004c91
push eax
push 0x208
push section.DLLShare
call fcn.10072001
add esp, 0xc
and word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.10070f00
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [0x100fc264]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x100c4ea4
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.10073e26
add esp, 0xc
and word [ebp - 0x424], 0
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.10070f00
add esp, 0xc
push 0x104
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.rundll32.exe
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.100a77df
add esp, 0x14
mov dword [ebp - 0x444], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.1000174b
mov eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e261
leave
ret 4