joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eb220
Capabilities:
Enumerate gui resources
Find taskbar

Disassembly:
mov eax, 0x11c6c
call fcn.004ebaf0
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x11c68], eax
push ebx
push 0
mov ebx, ecx
call fcn.004eb9a0
test eax, eax
jne 0x4eb25e
pop ebx
mov ecx, dword [esp + 0x11c68]
xor ecx, esp
call fcn.004ebadf
add esp, 0x11c6c
ret 4
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
push 4
push edi
call esi
test eax, eax
je 0x4eb282
push 4
push eax
mov edi, eax
call esi
test eax, eax
jne 0x4eb277
mov eax, dword [0x62271c]
mov ecx, dword fs:[0x2c]
lea esi, [eax*4]
mov eax, dword [esi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x4eb2ad
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [esi + ecx]
mov ecx, ebx
push ebp
mov eax, dword [eax + 0x29c]
add eax, 0x58
push eax
push edi
call fcn.004eb7e0
mov ebp, dword fs:[0x2c]
test eax, eax
je 0x4eb2db
mov eax, dword [esi + ebp]
mov dword [eax + 0x218c], 0
lea ecx, [esp + 0x10]
call fcn.004e8500
cmp byte [esp + 0x11c80], 0
je 0x4eb302
mov eax, dword [esi + ebp]
mov byte [esp + 0x183d], 0
cmp dword [eax + 0x218c], 0
je 0x4eb30a
mov byte [esp + 0x183d], 1
mov ecx, dword [esi + ebp]
mov eax, dword [ecx + 0x2190]
mov dword [esp + 0x184c], eax
mov eax, dword [ecx + 0x218c]
mov dword [esp + 0x1850], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x10]
push eax
push 0x4eb660
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1844]
pop ebp
test eax, eax
je 0x4eb41b
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
call fcn.004e9bf0
push dword [esp + 0x1844]
call fcn.004eb8a0
mov ecx, dword fs:[0x2c]
add esp, 8
mov eax, dword [esi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x4eb38c
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov ecx, dword [esi + ecx]
mov eax, dword [ecx + 0x29c]
cmp dword [eax + 0x64], 0xffffffff
jle 0x4eb467
cmp byte [ecx + 0x2198], 0
jne 0x4eb3ad
call fcn.004ebad3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword fs:[0x2c]
mov edx, dword [esi + ecx]
cmp dword [edx + 0x250], eax
je 0x4eb3ee
cmp byte [edx + 0x2198], 0
jne 0x4eb3da
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [esi + ecx]
mov eax, dword [eax + 0x29c]
push dword [eax + 0x64]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4eb467
cmp byte [edx + 0x2198], 0
jne 0x4eb403
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [esi + ecx]
push 1
mov eax, dword [eax + 0x29c]
push dword [eax + 0x64]
call fcn.00415b90
add esp, 8
jmp 0x4eb467
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
mov ecx, dword [eax + 0x218c]
test ecx, ecx
je 0x4eb451
mov dword [eax + 0x218c], 0
cmp ecx, 1
jle 0x4eb467
push edi
call fcn.004eb8a0
add esp, 4
mov ecx, ebx
push 0
call fcn.004eb220
jmp 0x4eb467
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call fcn.004e9bf0
add esp, 4
mov ecx, dword [esp + 0x11c74]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x11c6c
ret 4
Function at 0x15b0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.015b01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x15b007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15b006a
add dl, dl
jne 0x15b0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15b00dc
xor eax, eax
add dl, dl
jne 0x15b0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15b017d
add dl, dl
jne 0x15b00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15b00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15b00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15b00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x15b00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x15b0075
mov eax, 1
add dl, dl
jne 0x15b00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15b00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15b00e1
sub eax, ebx
mov ebx, 1
jne 0x15b0128
mov ecx, 1
add dl, dl
jne 0x15b010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15b0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15b0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15b0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x15b013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15b014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15b0136
cmp eax, 0x7d00
jae 0x15b016d
cmp eax, 0x500
jb 0x15b0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15b0075
cmp eax, 0x7f
ja 0x15b0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15b0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x15b019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x15b0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x421580
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ffa57
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x134]
call fcn.00418240
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00418240
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x134]
call fcn.0041a3d0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.0041a3d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.0041ad00
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.0041ad00
mov byte [ebp - 0x1bd], 0
lea ecx, [ebp - 0xac]
call fcn.0044dd50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.0044ddd0
movzx edx, al
test edx, edx
je 0x42165e
lea ecx, [ebp - 0x1bc]
call fcn.00419650
push eax
lea ecx, [ebp - 0x134]
call fcn.00419650
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
jmp 0x42173c
lea ecx, [ebp - 0x134]
call fcn.004183d0
test eax, eax
jg 0x421680
lea ecx, [ebp - 0x1bc]
call fcn.004183d0
test eax, eax
jle 0x421713
lea ecx, [ebp - 0x24c]
call fcn.00418240
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00418240
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.004217b0
add esp, 8
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.004217b0
add esp, 8
lea ecx, [ebp - 0x2d4]
call fcn.00418ce0
push eax
lea ecx, [ebp - 0x24c]
call fcn.00418ce0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dl
mov byte [ebp - 0x1bd], dl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00418350
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00418350
jmp 0x42173c
lea ecx, [ebp - 0x1bc]
call fcn.00418ce0
push eax
lea ecx, [ebp - 0x134]
call fcn.00418ce0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
movzx ecx, byte [ebp - 0x1bd]
test ecx, ecx
jne 0x421755
cmp dword [ebp + 0x10], 0
je 0x421755
mov ecx, dword [ebp + 0x10]
call fcn.00435890
mov dl, byte [ebp - 0x1bd]
mov byte [ebp - 0x2d5], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.0044ddb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00418350
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.00418350
mov al, byte [ebp - 0x2d5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dbd73
mov esp, ebp
pop ebp
ret
Function at 0x4218e0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ffadc
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.00418240
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a3d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0041ad00
lea ecx, [ebp - 0x134]
call fcn.0044dd50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x134]
call fcn.0044ddd0
movzx ecx, al
test ecx, ecx
je 0x4219a8
lea ecx, [ebp - 0x94]
call fcn.00419650
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne dl
mov byte [ebp - 0x255], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044ddb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418350
mov al, byte [ebp - 0x255]
jmp 0x421b7b
lea ecx, [ebp - 0x94]
call fcn.004183d0
cmp eax, 0x104
jle 0x421aae
lea ecx, [ebp - 0x1bc]
call fcn.00418240
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.00421210
add esp, 8
lea ecx, [ebp - 0x24c]
call fcn.00418240
mov byte [ebp - 4], 3
push 0x64d69c
lea ecx, [ebp - 0x24c]
call fcn.00419e90
lea ecx, [ebp - 0x1bc]
call fcn.0041a0b0
push eax
lea ecx, [ebp - 0x24c]
call fcn.00419e90
lea ecx, [ebp - 0x24c]
call fcn.00418ce0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x421a4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x421a4f
mov dword [ebp - 0x1c0], 1
cmp dword [ebp - 0x1c0], 0
setne dl
mov byte [ebp - 0x256], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00418350
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.00418350
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044ddb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418350
mov al, byte [ebp - 0x256]
jmp 0x421b7b
lea ecx, [ebp - 0x94]
call fcn.00418ce0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x421b21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
cmp dword [ebp + 0xc], 0
je 0x421b0e
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00435930
lea ecx, [ebp - 0x94]
call fcn.0041a0b0
push eax
push str.failedToDeleteFilepath
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
cmp dword [ebp - 0x254], 2
jne 0x421b21
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
setne cl
mov byte [ebp - 0x257], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044ddb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418350
mov al, byte [ebp - 0x257]
jmp 0x421b7b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005dbd73
mov esp, ebp
pop ebp
ret
Function at 0x422b50
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ffc91
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.004183d0
test eax, eax
jne 0x422bbb
cmp dword [ebp + 0x14], 0
je 0x422bb4
push str.GetAttributes:_filename_is_empty
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x422d24
lea ecx, [ebp - 0x94]
call fcn.00418240
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a3d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0041ad00
lea ecx, [ebp - 0x94]
call fcn.004183d0
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x134]
call fcn.0044dd50
mov byte [ebp - 4], 1
cmp dword [ebp - 0x138], 0x104
jge 0x422c6c
lea ecx, [ebp - 0x94]
call fcn.00419330
movzx ecx, al
test ecx, ecx
jne 0x422c3b
lea ecx, [ebp - 0x134]
call fcn.0044ddd0
movzx edx, al
test edx, edx
je 0x422c6c
lea ecx, [ebp - 0x94]
call fcn.00419650
push eax
call fcn.004249c0
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x422c67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x422cec
cmp dword [ebp - 0x138], 0
jle 0x422cc2
lea ecx, [ebp - 0x1c4]
call fcn.00418240
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.004217b0
add esp, 8
lea ecx, [ebp - 0x1c4]
call fcn.00418d00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00418350
jmp 0x422cd9
lea ecx, [ebp - 0x94]
call fcn.00418d00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x422cec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [edx], 0xffffffff
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044ddb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418350
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005dbd73
mov esp, ebp
pop ebp
ret
Function at 0x4230e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ffc3c
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x13c]
call fcn.00418240
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x13c]
call fcn.0041a3d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x13c]
call fcn.0041ad00
lea ecx, [ebp - 0xac]
call fcn.0044dd50
mov byte [ebp - 4], 1
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xac]
call fcn.0044ddd0
movzx ecx, al
test ecx, ecx
je 0x423184
push 0
lea ecx, [ebp - 0x13c]
call fcn.00419650
push eax
call fcn.00424980
add esp, 8
mov dword [ebp - 0xb0], eax
jmp 0x4231fd
lea ecx, [ebp - 0x13c]
call fcn.004183d0
test eax, eax
jle 0x4231e3
lea ecx, [ebp - 0x1c4]
call fcn.00418240
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x13c]
push eax
call fcn.004217b0
add esp, 8
push 0
lea ecx, [ebp - 0x1c4]
call fcn.00418ce0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00418350
jmp 0x4231fd
push 0
lea ecx, [ebp - 0x13c]
call fcn.00418ce0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x423253
cmp dword [ebp + 0xc], 0
je 0x423253
lea ecx, [ebp - 0x1ec]
call fcn.0041d9d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1ec]
call fcn.00420c80
lea ecx, [ebp - 0x1ec]
call fcn.004b5930
push eax
push str.errorMsg
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1ec]
call fcn.0041dda0
cmp dword [ebp - 0xb0], 0
setne cl
mov byte [ebp - 0x1ed], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.0044ddb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00418350
mov al, byte [ebp - 0x1ed]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dbd73
mov esp, ebp
pop ebp
ret
Function at 0x4232b0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ffc91
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.00418240
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a3d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0041ad00
push 0
push 1
lea ecx, [ebp - 0x94]
push ecx
call fcn.00421ba0
add esp, 0xc
lea ecx, [ebp - 0x134]
call fcn.0044dd50
mov byte [ebp - 4], 1
mov dword [ebp - 0x138], 0
lea ecx, [ebp - 0x134]
call fcn.0044ddd0
movzx edx, al
test edx, edx
je 0x42336f
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x94]
call fcn.00419650
push eax
call fcn.004249a0
add esp, 8
movzx ecx, al
mov dword [ebp - 0x138], ecx
jmp 0x4233ec
lea ecx, [ebp - 0x94]
call fcn.004183d0
test eax, eax
jle 0x4233d0
lea ecx, [ebp - 0x1c4]
call fcn.00418240
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.004217b0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.00418ce0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00418350
jmp 0x4233ec
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x94]
call fcn.00418ce0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044ddb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418350
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005dbd73
mov esp, ebp
pop ebp
ret

Function at 0x4249a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
pop ebp
ret
Function at 0x429b60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call fcn.00434630
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x429c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x429bd4
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x140], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004329c0
push str.Failed_to_start_thread
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
mov edx, dword [eax + 0x14]
call edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [edx + 0x28]
call eax
xor al, al
jmp 0x429c27
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004329c0
push str.Task_started_in_background_thread.
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 4]
push ecx
push str.createThread
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004353e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
mov edx, dword [eax + 0x28]
call edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x431a90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x600ef2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6e8da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ClsBgTask.0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 9], 1
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xa], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00438a40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x28], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00418240
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xb8
call fcn.00403900
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xd8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xe0
call fcn.00434850
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1a8
call fcn.00477f90
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x434640
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c4], 0x190
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x1c0]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x434681
mov byte [ebp - 0x1c0], 0
lea edx, [ebp - 0x1c0]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041cdf0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005dbd73
mov esp, ebp
pop ebp
ret

Function at 0x4346c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x6e8da0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x84], 0x76
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x434701
mov byte [ebp - 0x80], 0
lea edx, [ebp - 0x80]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041cdf0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dbd73
mov esp, ebp
pop ebp
ret
Function at 0x43f030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
cmp dword [ebp + 0xc], 0
je 0x43f054
cmp dword [ebp + 8], 0
jne 0x43f073
cmp dword [ebp + 0x18], 0
je 0x43f06c
push str.NULL_buf_or_bufSize
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x18]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x43f16d
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0xffffffff
je 0x43f0e9
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43f0d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26
jne 0x43f0b9
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov al, 1
jmp 0x43f16d
cmp dword [ebp + 0x18], 0
je 0x43f0cb
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00435930
xor al, al
jmp 0x43f16d
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x43f0e2
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov al, 1
jmp 0x43f16d
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x43f153
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.005e26b6
add esp, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
cmp eax, dword [ebp + 0xc]
jne 0x43f120
mov al, 1
jmp 0x43f16d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call fcn.005e24cb
add esp, 4
test eax, eax
je 0x43f147
cmp dword [ebp + 0x18], 0
je 0x43f141
mov ecx, dword [ebp + 0x18]
call fcn.00435890
xor al, al
jmp 0x43f16d
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov al, 1
jmp 0x43f16d
cmp dword [ebp + 0x18], 0
je 0x43f16b
push str.No_file_is_open.
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x18]
mov eax, dword [edx + 0x14]
call eax
xor al, al
mov esp, ebp
pop ebp
ret 0x14