joyce8/EMBER2024-capa huggingface dataset:
Function at 0x680406
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x10
mov eax, 0x6a1ce7
call fcn.0049be25
xor ebx, ebx
call fcn.006803a7
test al, al
je 0x6805bf
call fcn.00474f38
push eax
lea ecx, [ebp - 0x14]
call fcn.00451c1b
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
call fcn.0066fec3
mov esi, eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00689cdf
mov byte [ebp - 4], 2
push dword [esi]
push dword [eax]
lea eax, [ebp - 0x14]
push 0x751814
push eax
call fcn.00452465
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0044ec01
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x6804ad
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x6804ad
push str.CJoinSessionApp::PreUpdateHandling
push str._s_::_Delete_temp_file_failed
call fcn.00677869
pop ecx
pop ecx
push 3
pop ecx
call fcn.006889c8
push ecx
lea eax, [ebp - 0x18]
push eax
call fcn.00670e20
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
push ecx
add eax, 0xfffffff0
mov edi, esp
mov dword [ebp - 0x1c], edi
push eax
mov dword [ebp - 0x1c], eax
call fcn.0045207b
add eax, 0x10
pop ecx
mov dword [edi], eax
call fcn.0068b295
pop ecx
push 4
pop ecx
call fcn.006889c8
cmp eax, 1
je 0x68050e
cmp eax, 0x424
je 0x68050e
push 6
pop ecx
call fcn.006889c8
push str.CJoinSessionApp::PreUpdateHandling
push str._s_::_Service_is_running__so_skipping_app_update
call fcn.00677869
pop ecx
pop ecx
jmp 0x680598
push 5
pop ecx
call fcn.006889c8
push ecx
mov ecx, esp
mov edi, str.agent.exe
push edi
call fcn.004514db
mov ecx, ebx
call fcn.00688fa4
pop ecx
test eax, eax
je 0x68054e
push ecx
mov ecx, esp
push edi
call fcn.004514db
xor ecx, ecx
inc ecx
call fcn.00688fa4
pop ecx
test eax, eax
je 0x68057f
push 7
pop ecx
call fcn.006889c8
push ecx
mov edi, esp
mov dword [ebp - 0x10], edi
mov eax, dword [0x7af264]
add eax, 0xfffffff0
push eax
call fcn.0045207b
add eax, 0x10
push ecx
lea ecx, [ebp - 0xe]
mov dword [edi], eax
call fcn.0067be26
mov ecx, eax
call fcn.0067b705
test al, al
je 0x6805a2
push 9
jmp 0x6805a4
push str.CJoinSessionApp::PreUpdateHandling
push str._s_::_Not_able_to_stop_agent
call fcn.00677869
pop ecx
pop ecx
push 8
pop ecx
call fcn.006889c8
push 0xd
pop ecx
call fcn.006889c8
jmp 0x6805ad
push 0xa
pop ecx
call fcn.006889c8
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x1c]
call fcn.0044ec01
lea ecx, [esi - 0x10]
call fcn.0044ec01
jmp 0x6805d0
push str.CJoinSessionApp::PreUpdateHandling
push str._s_::_Update_not_needed__components_up_to_date
call fcn.00677869
pop ecx
pop ecx
mov al, bl
call fcn.0049bdee
ret
Function at 0x683375
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x6a23ae
call fcn.0049be25
mov dword [ebp - 0x20], ecx
call fcn.00474f38
push eax
lea ecx, [ebp - 0x18]
call fcn.00451c1b
and dword [ebp - 4], 0
call fcn.00474f38
push eax
lea ecx, [ebp - 0x14]
call fcn.00451c1b
push str.agent.exe
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [0x7af264]
push 0x751814
push eax
call fcn.00452465
mov esi, dword [ebp - 0x14]
add esp, 0x10
cmp byte [0x7af25d], 0
mov ebx, str.CJoinSessionDlg::DownloadAndExtractFiles
je 0x6833ff
cmp byte [0x7af234], 0
jne 0x68340c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete byte [0x7af234]
test eax, eax
jne 0x6833ff
push ebx
push str._s_:_Integrated_App_:_Required_files_not_available__proceed_to_download_now.
call fcn.006778de
pop ecx
pop ecx
cmp byte [0x7af234], 0
je 0x683583
push ebx
push str._s_:_Update_required__proceed_to_download
call fcn.006778de
pop ecx
pop ecx
call fcn.00474f38
push eax
lea ecx, [ebp - 0x10]
call fcn.00451c1b
cmp dword [ebp + 8], 1
mov byte [ebp - 4], 2
jne 0x68344d
lea eax, [ebp - 0x1c]
push eax
call fcn.00670e3b
mov byte [ebp - 4], 3
push dword [eax]
push dword [0x7af264]
push str._s_s.7z
jmp 0x68346d
cmp dword [ebp + 8], 0
jne 0x683488
lea eax, [ebp - 0x1c]
push eax
call fcn.00670e3b
mov byte [ebp - 4], 4
push dword [eax]
push dword [0x7af264]
push str._s_s.zip
lea eax, [ebp - 0x10]
push eax
call fcn.00452465
mov byte [ebp - 4], 2
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0044ec01
push ecx
mov edi, esp
mov dword [ebp - 0x1c], edi
mov eax, dword [0x7af264]
add eax, 0xfffffff0
push eax
call fcn.0045207b
add eax, 0x10
pop ecx
mov dword [edi], eax
call fcn.0068604f
pop ecx
test eax, eax
jne 0x6834fb
mov ecx, dword [0x7af264]
mov edi, 0x7af264
cmp dword [ecx - 4], 1
jle 0x6834cd
push dword [ecx - 0xc]
mov ecx, edi
call fcn.00451ca4
mov ecx, dword [0x7af264]
call fcn.00689239
mov eax, dword [0x7af264]
cmp dword [eax - 4], 1
jle 0x6834ec
push dword [eax - 0xc]
mov ecx, edi
call fcn.00451ca4
mov eax, dword [0x7af264]
push eax
push ebx
push str._s_:_Directory_created_:__s
call fcn.006778de
add esp, 0xc
push ecx
mov edi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x24], edi
mov ebx, dword [ebp - 0x10]
add ebx, 0xfffffff0
push ebx
call fcn.0045207b
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 5
mov edi, esp
mov eax, dword [0x7af218]
add eax, 0xfffffff0
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x28], edi
call fcn.0045207b
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 6
mov edi, esp
mov eax, dword [0x7af224]
add eax, 0xfffffff0
mov dword [ebp - 0x28], edi
push eax
call fcn.0045207b
mov edx, dword [ebp - 0x20]
add eax, 0x10
pop ecx
mov ecx, dword [ebp + 8]
mov dword [edi], eax
mov byte [ebp - 4], 2
call fcn.006851dc
add esp, 0xc
mov ecx, ebx
mov edi, eax
call fcn.0044ec01
lea ecx, [esi - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, edi
jmp 0x683596
lea ecx, [esi - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
call fcn.0049bdee
ret 4
Function at 0x684fef
Capabilities:
Check if file exists

Disassembly:
push 0x28
mov eax, 0x6a2724
call fcn.0049be90
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
xor ebx, ebx
inc ebx
push 0x1c
mov byte [ebp - 4], bl
call fcn.00474bfc
pop ecx
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x68502d
mov ecx, eax
call fcn.0067fef3
mov esi, eax
jmp 0x68502f
xor esi, esi
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.0067f5b4
push ecx
mov ecx, esp
test eax, eax
je 0x685047
push str.SOFTWAREWOW6432NodeMicrosoftNET_Framework_SetupNDP_v4Full1033
jmp 0x68504c
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Full1033
call fcn.004514db
mov ecx, esi
call fcn.004547b1
push 0
lea eax, [ebp - 0x1c]
push eax
push 4
push ecx
mov ecx, esp
push str.Release
call fcn.004514db
mov ecx, esi
call fcn.0067f739
mov esi, dword [ebp - 0x1c]
push esi
push str.Available_.Net_version:__d
mov byte [ebp - 0x11], al
call fcn.00677869
cmp byte [ebp - 0x11], 0
pop ecx
pop ecx
je 0x6851b8
cmp esi, 0x80ea8
jl 0x6851b8
push str.Dotnet_for_running_new_viewer_UI_is_available
call fcn.00677869
pop ecx
call fcn.00474f38
push eax
lea ecx, [ebp - 0x18]
call fcn.00451c1b
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.0067003d
mov byte [ebp - 4], 4
mov esi, 0x751814
push dword [eax]
lea eax, [ebp - 0x18]
push dword [0x7af264]
push esi
push eax
call fcn.00452465
mov byte [ebp - 4], 3
add esp, 0x10
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
push dword [ebp - 0x18]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
dec eax
neg eax
sbb al, al
inc al
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00670022
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x18]
push dword [0x7af264]
push esi
push eax
call fcn.00452465
mov byte [ebp - 4], 3
add esp, 0x10
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
push dword [ebp - 0x18]
call edi
dec eax
neg eax
sbb al, al
inc al
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00670007
mov byte [ebp - 4], 6
push dword [eax]
lea eax, [ebp - 0x18]
push dword [0x7af264]
push esi
push eax
call fcn.00452465
mov byte [ebp - 4], 3
add esp, 0x10
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov esi, dword [ebp - 0x18]
push esi
call edi
dec eax
neg eax
sbb al, al
inc al
cmp byte [ebp - 0x24], 0
je 0x68519f
cmp byte [ebp - 0x28], 0
je 0x68519f
test al, al
je 0x68519f
push str.New_viewer_UI_dependencies_available
call fcn.006778de
jmp 0x6851ab
push str.New_viewer_UI_dependencies_not_available
call fcn.006778de
xor bl, bl
pop ecx
lea ecx, [esi - 0x10]
call fcn.0044ec01
mov al, bl
jmp 0x6851c5
push str.Dotnet_for_running_new_viewer_UI_is_not_available
call fcn.00677869
pop ecx
xor al, al
call fcn.0049bdee
ret
Function at 0x68604f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x686065
xor esi, esi
jmp 0x686068
and esi, 0x10
mov ecx, dword [esp + 8]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, esi
pop esi
ret

Function at 0x686447
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x6a2ab8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x79b544]
xor eax, ebp
mov dword [ebp + 0x208], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 4], esi
push dword [ebp + 0x214]
push str.DeleteFolderWithContents_:_Going_to_delete__s_folder
call fcn.006777f4
mov eax, dword [ebp + 0x214]
pop ecx
pop ecx
cmp dword [eax - 4], 1
jle 0x6864b5
push dword [eax - 0xc]
lea ecx, [ebp + 0x214]
call fcn.00451ca4
mov eax, dword [ebp + 0x214]
push eax
lea eax, [ebp]
push 0x104
push eax
call fcn.005145bf
lea ecx, [ebp]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x6864cd
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
cmp ecx, 0x208
jae 0x68657c
xor eax, eax
mov dword [ebp - 0x1a], esi
mov word [ebp + ecx], ax
lea eax, [ebp]
mov dword [ebp - 0x24], eax
mov eax, 0x414
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x16], esi
mov dword [ebp - 0x12], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x20], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x686536
push eax
push str.DeleteFolderWithContents_:_SHFileOperation_Failure._Errorcode:__d
call fcn.00677869
jmp 0x686549
push dword [ebp + 0x214]
xor esi, esi
push str.DeleteFolderWithContents:_Successfully_deleted_..__s
inc esi
call fcn.006777f4
pop ecx
pop ecx
mov ecx, dword [ebp + 0x214]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0049b511
add ebp, 0x20c
leave
ret
call fcn.0049bba2
int3
Function at 0x687af6
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x79b544]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.00506c70
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x687b51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetOsFamily_:_Unable_to_find_the_OSVersion___Errorcode__d__n
call fcn.00677763
xor eax, eax
pop ecx
inc eax
jmp 0x687bcd
cmp dword [ebp - 0x118], 2
jne 0x687bc0
mov ecx, dword [ebp - 0x124]
push 4
pop eax
cmp ecx, eax
jbe 0x687bc0
cmp ecx, 6
jne 0x687b92
mov ecx, dword [ebp - 0x120]
test ecx, ecx
jne 0x687b7b
push 2
pop eax
jmp 0x687bce
cmp ecx, 1
jne 0x687b84
push 3
jmp 0x687b78
cmp ecx, 2
je 0x687bce
cmp ecx, 3
jne 0x687bbc
push 5
jmp 0x687b78
cmp ecx, 0xa
jne 0x687ba4
cmp dword [ebp - 0x120], 0
jne 0x687bbc
push 6
jmp 0x687b78
cmp ecx, 5
jne 0x687bbc
xor eax, eax
cmp dword [ebp - 0x120], eax
je 0x687bce
inc eax
cmp dword [ebp - 0x120], eax
jae 0x687bce
push 7
jmp 0x687b78
push str.GetOsFamily_:The_windows_is_unable_to_found_.__n
call fcn.00677763
or eax, 0xffffffff
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b511
leave
ret

Function at 0x687bda
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x118]
sub esp, 0x118
push 0xffffffffffffffff
push 0x6a2f30
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x79b544]
xor eax, ebp
mov dword [ebp + 0x114], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor edi, edi
lea eax, [ebp]
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
push eax
mov dword [ebp], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x750660
mov ecx, ebx
call fcn.004514db
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], 1
cmp esi, 5
jne 0x687cf6
push str.XP_OS
call fcn.00677763
pop ecx
mov dword [ebp - 0x14], edi
call fcn.00474f38
push eax
lea ecx, [ebp - 0x10]
call fcn.00451c1b
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.0067fef3
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
call fcn.00452465
mov edi, dword [ebp - 0x10]
pop ecx
mov esi, esp
add edi, 0xfffffff0
push edi
mov dword [ebp - 0x1c], esi
call fcn.0045207b
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x3c]
mov dword [esi], eax
call fcn.004547b1
push 0xa
push str.CSDVersion
lea ecx, [ebp - 0x24]
call fcn.00452145
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0067f45a
mov esi, eax
mov ecx, ebx
push esi
call fcn.00451d59
push dword [ebx]
push esi
push str._s:_s
call fcn.006778de
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.004547e0
mov ecx, edi
call fcn.0044ec01
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x114]
xor ecx, ebp
call fcn.0049b511
add ebp, 0x118
leave
ret
Function at 0x687e84
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x6a2ff0
call fcn.0049be90
xor esi, esi
mov dword [ebp - 4], esi
cmp byte [0x7af257], 0
je 0x687efc
push esi
push esi
push esi
push 0x686582
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x687ecd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MaliciousFileDetectionThreadSpawner
push str._s_:_MaliciousFileDetectionThread_creation_failed_with_error:_d
call fcn.006778de
add esp, 0xc
jmp 0x687efc
push str.MaliciousFileDetectionThreadSpawner
push str._s_:_MaliciousFileDetectionThread_started
call fcn.006778de
pop ecx
xor esi, esi
pop ecx
inc esi
jmp 0x687efc
mov eax, esi
call fcn.0049bdee
ret
Function at 0x6883ff
Capabilities:
Move file

Disassembly:
push 0x18
mov eax, 0x6a3129
call fcn.0049be90
and dword [ebp - 4], 0
or dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0x10]
cmp dword [eax - 0xc], 0
jne 0x688476
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1c
pop edx
lea ecx, [ebp - 0x20]
call fcn.0068a4ce
pop ecx
pop ecx
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
call fcn.00670e3b
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp + 0x10]
push dword [ebp - 0x20]
push 0x751814
push eax
call fcn.00452465
mov ecx, dword [ebp - 0x24]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov esi, 0x7516bc
lea eax, [ebp + 0x10]
push esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00451281
add esp, 0xc
lea ecx, [ebp + 8]
mov byte [ebp - 4], 6
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004512d9
add esp, 0xc
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
push esi
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00451281
add esp, 0xc
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 9
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004512d9
add esp, 0xc
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov esi, dword [ebp - 0x14]
cmp dword [esi - 4], 1
jle 0x6884fc
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00451ca4
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp dword [eax - 4], 1
jle 0x688513
push dword [eax - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00451ca4
mov eax, dword [ebp - 0x18]
push esi
push eax
call fcn.00512407
mov esi, dword [ebp - 0x14]
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x1c], edi
cmp dword [esi - 4], 1
jle 0x688538
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00451ca4
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp dword [eax - 4], 1
jle 0x68854f
push dword [eax - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00451ca4
mov eax, dword [ebp - 0x18]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.On_RenameConnect____File_rename__d__d____s_into_____s
call fcn.006778de
mov ecx, dword [ebp - 0x14]
add esp, 0x14
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
jmp 0x688592
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov eax, edi
call fcn.0049bdee
ret
Function at 0x688cd4
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x44
mov eax, 0x6a32ca
call fcn.0049be25
mov dword [ebp - 0x14], edx
mov ebx, ecx
mov dword [ebp - 4], 2
lea ecx, [ebp + 8]
xor edi, edi
mov dword [ebp - 0x50], 0x3c
push edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], str.runas
call fcn.00451c69
push edi
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x40], eax
call fcn.00451c69
push edi
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
call fcn.00451c69
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call fcn.00474f38
push eax
lea ecx, [ebp - 0x10]
call fcn.00451c1b
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0x751814
push eax
call fcn.00452465
mov esi, dword [ebp - 0x10]
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x688da2
cmp dword [esi - 4], 1
jle 0x688d77
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00451ca4
mov esi, dword [ebp - 0x10]
push 1
xor dl, dl
mov ecx, esi
call fcn.0068a223
pop ecx
test al, al
jne 0x688da2
push esi
push str.RunAsShellExcute
push str._s::Ignoring_app_launch_due_to_signature_of_exe_dll_is_not_valid___app_path:_s
call fcn.006778de
add esp, 0xc
mov dword [ebx], 0x570
jmp 0x688de4
cmp dword [ebp - 0x14], 1
jne 0x688dbb
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
cmp edi, 1
jne 0x688de4
jmp 0x688dd7
push 1
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 8]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x688de1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
jmp 0x688de4
xor edi, edi
inc edi
lea ecx, [esi - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0044ec01
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, edi
call fcn.0049bdee
ret
Function at 0x688fa4
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x230]
sub esp, 0x230
push 0xffffffffffffffff
push 0x6a333c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x79b544]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
xor esi, esi
push esi
push 2
mov dword [ebp - 4], esi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x6890bd
lea eax, [ebp]
mov dword [ebp], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x689018
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x10], eax
push esi
lea ecx, [ebp + 0x238]
call fcn.00451c69
lea ecx, [ebp + 0x24]
push ecx
push eax
call fcn.00511f3c
pop ecx
pop ecx
test eax, eax
jne 0x6890a8
mov eax, dword [ebp - 0x10]
cmp dword [ebp + 8], eax
je 0x6890a8
push dword [ebp + 8]
xor ebx, ebx
push esi
inc ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x6890a8
cmp dword [ebp - 0x14], esi
je 0x6890a8
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp + 0x238]
cmp dword [eax - 4], ebx
jle 0x689095
push dword [eax - 0xc]
lea ecx, [ebp + 0x238]
call fcn.00451ca4
mov eax, dword [ebp + 0x238]
push eax
push str.CheckMeetingInstances
push str._s_::_Process_killed____s
call fcn.006778de
add esp, 0xc
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x689021
mov esi, ebx
mov ecx, dword [ebp + 0x238]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.0049b511
add ebp, 0x230
leave
ret

Function at 0x689233
Capabilities:
Create directory

Disassembly:
mov eax, dword [0x7af240]
ret
Function at 0x689239
Capabilities:
Create directory

Disassembly:
sub esp, 0x4c4
mov eax, dword [0x79b544]
xor eax, esp
mov dword [esp + 0x4c0], eax
push ebx
push ebp
push esi
xor ebx, ebx
lea esi, [esp + 0x274]
push edi
mov edi, ecx
mov dword [esp + 0x10], ebx
mov ecx, ebx
mov edx, edi
sub esi, edi
movzx eax, word [edx]
mov word [esi + edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x689266
lea esi, [esp + 0x278]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x68927f
sub esi, edx
mov dword [esp + 0x1c], ebx
sar esi, 1
test esi, esi
jle 0x68931d
mov edx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ebx, [esp + 0x278]
lea eax, [esp + 0x20]
mov dword [esp + 0x18], edx
sub ebx, eax
cmp esi, 0x12c
jge 0x68931d
lea eax, [esp + 0x20]
lea eax, [eax + ecx*2]
movzx ebp, word [ebx + eax]
mov dword [esp + 0x14], eax
cmp ebp, 0x5c
je 0x6892d2
cmp ebp, 0x2f
jne 0x689308
cmp ecx, 0x12c
jae 0x68933d
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x20]
push ecx
push eax
call edx
test eax, eax
je 0x6892fc
lea eax, [esp + 0x20]
push eax
push str._nDirectory__s_Created
call fcn.0045b4cd
pop ecx
pop ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov word [eax], bp
inc ecx
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
cmp eax, esi
jl 0x6892b1
push edi
call fcn.0051621b
pop ecx
mov ecx, dword [esp + 0x4d0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049b511
add esp, 0x4c4
ret
call fcn.0049bba2
int3

Function at 0x689343
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x79b544]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x6893a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsAdminPrivileges
push str._s_:_AllocateAndInitializeSid_Status_:__d
call fcn.006778de
add esp, 0xc
xor eax, eax
jmp 0x6893da
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x6893ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsAdminPrivileges
push str._s_:_CheckTokenMembership_Status_:__d
call fcn.006778de
add esp, 0xc
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0049b511
leave
ret