joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402500
Capabilities:
Enumerate gui resources
Set current directory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x98
mov dword [0x41ae60], eax
call fcn.00402650
test eax, eax
jne 0x402521
add esp, 0x98
ret 0x10
push 0x104
push 0x41a940
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x41a940
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x41a940
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
call fcn.00402960
test eax, eax
jne 0x402557
call fcn.00402a40
push edi
mov edi, dword [esp + 0xa8]
mov eax, edi
call fcn.004027f0
test eax, eax
je 0x40257b
call fcn.00402790
xor eax, eax
pop edi
add esp, 0x98
ret 0x10
lea ecx, [esp + 4]
push ecx
push 0x402890
mov dword [esp + 0xc], 1
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 4]
test eax, eax
je 0x40256a
mov eax, edi
call fcn.00405680
test eax, eax
jne 0x40256a
push 0x41a940
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor eax, eax
push 0x404820
mov dword [esp + 0x40], 0
mov ecx, 0x17
lea edi, [esp + 0x44]
push 0x385
lea edx, [esp + 0x44]
rep stosd dword es:[edi], eax
call fcn.00402b40
push 0x404d30
push 0x387
lea edx, [esp + 0x7c]
call fcn.00402b40
xor eax, eax
mov ecx, 0xc
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], eax
add esp, 0x10
lea eax, [esp + 8]
lea edx, [esp + 0x3c]
push eax
mov dword [esp + 0xc], 0x34
mov dword [esp + 0x10], 0xa8
mov dword [esp + 0x24], 2
mov dword [esp + 0x2c], edx
call dword [sym.imp.COMCTL32.dll_PropertySheetA]
call fcn.00402790
mov eax, 1
pop edi
add esp, 0x98
ret 0x10

Function at 0x402960
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea eax, [esp + 0x18]
xor edi, edi
push eax
mov dword [0x41a924], edi
call esi
push 0x416b2c
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 8]
push edx
push 0x20019
push edi
lea eax, [esp + 0x20]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402a30
mov eax, dword [esp + 8]
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0x41aa48
lea edx, [esp + 0x1c]
push edx
push edi
push str.UninstallString
push eax
mov dword [0x41a924], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov al, byte [0x41aa48]
mov bl, 0x22
cmp al, bl
jne 0x4029fd
push 0x41aa49
push 0x41aa48
call esi
jmp 0x4029ff
mov bl, 0x20
mov eax, 0x41aa48
call fcn.00402b10
test eax, eax
pop ebx
je 0x402a25
cmp byte [eax], 0x5c
je 0x402a1c
mov cl, byte [eax - 1]
dec eax
cmp cl, 0x5c
jne 0x402a13
mov byte [eax + 1], 0
mov edi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 0x110
ret
Function at 0x402a40
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x420b98]
sub esp, 0x94
test eax, eax
push esi
mov esi, dword [0x41a91c]
jne 0x402a86
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402a81
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
imul eax, eax, 0x64
add eax, ecx
mov dword [0x420b98], eax
jmp 0x402a86
mov eax, dword [0x420b98]
cmp eax, 0x1f4
jb 0x402abb
push str.SHGetFolderPathA
push str.shell32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402abb
push 0x41aa48
push 0
push esi
push 0x26
push 0
call eax
cmp eax, 1
jne 0x402ae0
push 0x104
push 0x41aa48
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [0x41aa49], 0x3a
jne 0x402af4
push str.Program_Files
push 0x41aa4a
jmp 0x402aee
test eax, eax
jge 0x402af4
push 0x416b18
push 0x41aa48
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.CLaunch_
push 0x41aa48
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop esi
add esp, 0x94
ret

Function at 0x402d80
Capabilities:
Check if file exists
Create directory

Disassembly:
cmp byte [edi + 1], 0x3a
jne 0x402ddd
cmp byte [edi + 2], 0x5c
jne 0x402ddd
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
push esi
lea esi, [edi + 3]
push ebx
cmp byte [esi], 0
je 0x402db8
lea ecx, [ecx]
xor eax, eax
mov al, byte [esi]
cmp al, 0x5c
je 0x402dc1
push eax
call ebp
test eax, eax
je 0x402db0
inc esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x402da0
pop ebx
pop esi
mov eax, 1
pop ebp
ret
mov bl, byte [esi + 1]
inc esi
mov eax, edi
mov byte [esi], 0
call fcn.00402df0
test eax, eax
je 0x402dd7
mov byte [esi], bl
jmp 0x402d98
pop ebx
pop esi
xor eax, eax
pop ebp
ret
mov eax, edi
jmp fcn.00402df0
Function at 0x402df0
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x410
push esi
mov esi, eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRootA]
test eax, eax
je 0x402e11
mov eax, 1
pop esi
add esp, 0x410
ret
push edi
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402ef1
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x402f9f
mov eax, dword [0x41afc0]
test eax, eax
jne 0x402e5d
mov eax, dword [0x41ae60]
push 0x104
lea ecx, [esp + 0x318]
push ecx
push 0x38f
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x318]
push eax
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x41b390]
add esp, 0xc
xor esi, esi
test eax, eax
je 0x402ea3
mov esi, eax
jmp 0x402eba
mov edx, dword [0x41ae64]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x402eba
mov esi, dword [0x41ae64]
mov eax, dword [0x41ae64]
mov edi, dword [0x41b390]
push 0x10
push 0x416b2c
lea ecx, [esp + 0x114]
push ecx
push esi
mov dword [0x41b390], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x41b390], edi
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
push 0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x402f9f
mov eax, dword [0x41afc0]
test eax, eax
jne 0x402f14
mov eax, dword [0x41ae60]
push 0x208
lea ecx, [esp + 0x110]
push ecx
push 0x390
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x41b390]
xor esi, esi
test eax, eax
je 0x402f4f
mov esi, eax
jmp 0x402f66
mov ecx, dword [0x41ae64]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x402f66
mov esi, dword [0x41ae64]
mov edx, dword [0x41ae64]
mov edi, dword [0x41b390]
push 0x10
push 0x416b2c
lea eax, [esp + 0x114]
push eax
push esi
mov dword [0x41b390], edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x41b390], edi
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
Function at 0x402fb0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x118
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x104
push 0x41aa48
xor esi, esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x403029
cmp byte [esp + 0x1d], 0x3a
jne 0x403029
cmp byte [esp + 0x1e], 0x5c
jne 0x403029
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x33], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x403029
mov eax, dword [esp + 0x10]
mul dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edi
push ecx
push edx
push eax
call fcn.00410880
mov esi, eax
mov edi, edx
mov edx, edi
pop edi
mov eax, esi
pop esi
add esp, 0x118
ret
Function at 0x403a10
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x248
push ebx
push ebp
mov ebp, dword [esp + 0x258]
push edi
xor eax, eax
mov dword [esp + 0x10], 0
mov ecx, 0x4f
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
push 0x41a940
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x258]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ecx
lea edx, [esp + 0x154]
push edx
call ebx
push str..
lea eax, [esp + 0x154]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x403b60
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x416a8c
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x403b3d
push 0x416a88
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x403b3d
test byte [esp + 0x10], 0x10
jne 0x403b3d
mov edx, dword [esi]
mov ecx, dword [ebp]
lea eax, [edx*4 + 4]
push eax
push ecx
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
mov dword [ebp], eax
je 0x403b60
push 0x208
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esi]
mov ecx, dword [ebp]
mov dword [ecx + edx*4], eax
mov edx, dword [esi]
mov eax, dword [ebp]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x403b3d
mov ecx, dword [esp + 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esi]
mov eax, dword [ebp]
mov ecx, dword [eax + edx*4]
push 0x416ae8
push ecx
call ebx
mov eax, dword [esi]
mov ecx, dword [ebp]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [ecx + eax*4]
push edx
call ebx
inc dword [esi]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403a95
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebp
pop ebx
add esp, 0x248
ret
Function at 0x403b70
Capabilities:
Copy file
Set file attributes

Disassembly:
sub esp, 0x514
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x41a940
lea eax, [esp + 0x114]
push eax
call edi
mov esi, dword [esp + 0x524]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea ecx, [esp + 0x114]
push ecx
call ebx
push 0x41aa48
lea edx, [esp + 0x10]
push edx
call edi
push esi
lea eax, [esp + 0x10]
push eax
call ebx
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, eax
test ebx, ebx
je 0x403bf4
push 0x80
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x514
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x403cb9
lea ecx, [esp + 0xc]
push ecx
call fcn.00403d80
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x403c29
push esi
call fcn.00403b70
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x403d69
mov eax, dword [0x41afc0]
test eax, eax
jne 0x403c37
mov eax, dword [0x41ae60]
push 0x104
lea edx, [esp + 0x218]
push edx
push 0x391
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x218]
push ecx
lea edx, [esp + 0x320]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x41b390]
add esp, 0xc
xor esi, esi
test eax, eax
je 0x403c7d
mov esi, eax
jmp 0x403c93
mov eax, dword [0x41ae64]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x403c93
mov esi, dword [0x41ae64]
mov ecx, dword [0x41ae64]
mov edi, dword [0x41b390]
push 0x10
push 0x416b2c
lea edx, [esp + 0x320]
mov dword [0x41b390], ecx
push edx
jmp 0x403d5c
cmp eax, 0x50
jne 0x403ccf
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
add esp, 0x514
ret
mov eax, dword [0x41afc0]
test eax, eax
jne 0x403cdd
mov eax, dword [0x41ae60]
push 0x104
lea ecx, [esp + 0x218]
push ecx
push 0x392
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x320]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x41b390]
add esp, 0xc
xor esi, esi
test eax, eax
je 0x403d26
mov esi, eax
jmp 0x403d3d
mov edx, dword [0x41ae64]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x403d3d
mov esi, dword [0x41ae64]
mov eax, dword [0x41ae64]
mov edi, dword [0x41b390]
push 0x10
push 0x416b2c
lea ecx, [esp + 0x320]
mov dword [0x41b390], eax
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x41b390], edi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x514
ret

Function at 0x403d80
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x104
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp]
push ecx
push 0
push 0x416a84
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x108]
lea ecx, [esp]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
add esp, 0x104
ret
Function at 0x403de0
Capabilities:
Create shortcut via ishelllink
Delete file

Disassembly:
sub esp, 0x418
push ebx
push esi
lea ebx, [esp + 0x114]
call fcn.00402be0
mov eax, dword [esp + 0x424]
add esp, 4
test eax, eax
pop ebx
jne 0x403e18
lea eax, [esp + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x418
ret
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x403f23
lea ecx, [esp]
push ecx
push 0x415290
push 1
push 0
push 0x4152a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x403f1d
push 0x41aa48
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x420]
test eax, eax
mov eax, str.ClAdmin.exe
jne 0x403e6f
mov eax, dword [str.CLaunch.exe]
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [esp]
mov ecx, dword [eax]
push 0x41aa48
push eax
call dword [ecx + 0x24]
cmp esi, 7
jne 0x403eac
mov eax, dword [esp]
mov edx, dword [eax]
push 0x41ac58
push eax
call dword [edx + 0x2c]
jmp 0x403ebf
cmp esi, 0x10
jne 0x403ebf
mov eax, dword [esp]
mov ecx, dword [eax]
push 0x41ad5c
push eax
call dword [ecx + 0x2c]
mov eax, dword [esp]
mov edx, dword [eax]
lea ecx, [esp + 4]
push ecx
push 0x4152b0
push eax
call dword [edx]
test eax, eax
jl 0x403f14
push 0x104
lea edx, [esp + 0x214]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x118]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x214]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp]
mov edx, dword [eax]
push eax
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
add esp, 0x418
ret
Function at 0x403f70
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x310
push esi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404098
push edi
push 0x41aa48
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.ClAdmin.exe
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0x104
lea eax, [esp + 0x11c]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
call edi
push 0
push 0
push 0x104
lea edx, [esp + 0x220]
push edx
push 0xffffffffffffffff
push 0x41ac58
push 0
push 0
call edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0xc]
push eax
push 0x18c
push str._Task_version_1.2__xmlns_http:__schemas.microsoft.com_windows_2004_02_mit_task___RegistrationInfo__Author_Pyonkichi__Author___RegistrationInfo__Principals__Principal_id_Author___LogonType_InteractiveToken__LogonType__RunLevel_HighestAvailable__RunLevel___Principal___Principals__Triggers__LogonTrigger__Enabled_true__Enabled___LogonTrigger___Triggers__Actions_Context_Author___Exec__Command__
push esi
call edi
lea eax, [esp + 0x110]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x404022
push 0
sub eax, ecx
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x11c]
push edx
push esi
call edi
push 0
lea eax, [esp + 0xc]
push eax
push 0x16
push str.___Command__Arguments_
push esi
call edi
lea eax, [esp + 0x214]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404060
push 0
lea ecx, [esp + 0xc]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x220]
push edx
push esi
call edi
push 0
lea eax, [esp + 0xc]
push eax
push 0x2b2
push str.__Arguments___Exec___Actions__Settings__RunOnlyIfIdle_false__RunOnlyIfIdle__IdleSettings__StopOnIdleEnd_false__StopOnIdleEnd___IdleSettings__DisallowStartIfOnBatteries_false__DisallowStartIfOnBatteries__StopIfGoingOnBatteries_false__StopIfGoingOnBatteries__WakeToRun_false__WakeToRun__RunOnlyIfNetworkAvailable_false__RunOnlyIfNetworkAvailable__AllowStartOnDemand_true__AllowStartOnDemand__StartWhenAvailable_true__StartWhenAvailable__RestartOnFailure__Interval_PT1M__Interval__Count_10__Count___RestartOnFailure__ExecutionTimeLimit_PT0S__ExecutionTimeLimit__AllowHardTerminate_false__AllowHardTerminate__Enabled_true__Enabled__Hidden_false__Hidden__Priority_2__Priority___Settings___Task_
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x310
ret
Function at 0x4040a0
Capabilities:
Create process on windows
Schedule task via schtasks

Disassembly:
sub esp, 0x2f0
push edi
mov edi, eax
mov eax, dword [0x420b98]
test eax, eax
jne 0x4040e2
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4040dd
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
imul eax, eax, 0x64
add eax, ecx
mov dword [0x420b98], eax
jmp 0x4040e2
mov eax, dword [0x420b98]
cmp eax, 0x258
jb 0x404224
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.SCHTASKS
lea ecx, [esp + 0xf4]
push ecx
call esi
mov eax, dword [esp + 0x2fc]
dec eax
cmp eax, 3
ja case.default.0x404114
jmp dword [eax*4 + 0x40422c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__Create__TN__CLaunch___F__XML
lea edx, [esp + 0xf4]
push edx
call esi
push edi
lea eax, [esp + 0xf4]
push eax
call esi
jmp case.default.0x404114
push str.__Delete__TN__CLaunch___F
lea ecx, [esp + 0xf4]
push ecx
jmp 0x404199
push 0x4165c8
lea edx, [esp + 0xf4]
push edx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__C_SCHTASKS__Query__TN__CLaunch___XML_ONE____
lea eax, [esp + 0xf4]
push eax
call esi
push edi
lea ecx, [esp + 0xf4]
push ecx
call esi
push 0x416594
lea edx, [esp + 0xf4]
push edx
call esi
jmp case.default.0x404114
push str.__Run__TN__CLaunch___I
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
push 0x400
push ecx
push ecx
push ecx
mov dword [esp + 0x34], ecx
mov word [esp + 0x68], cx
lea ecx, [esp + 0x110]
push ecx
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0xc]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x404208
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x404223
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 8]
push edx
call esi
pop esi
pop edi
add esp, 0x2f0
ret
Function at 0x404500
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40452d
xor eax, eax
pop esi
pop ecx
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jne 0x40454a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov edx, dword [esp + 0x10]
lea ecx, [edi + 2]
push ecx
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebx], eax
je 0x40453d
push ebp
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
pop ebp
jne 0x40459c
mov edx, dword [ebx]
mov eax, dword [esp + 0x10]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov dword [ebx], 0
xor eax, eax
pop esi
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x405940
Capabilities:
Delete file
Move file

Disassembly:
mov eax, dword [0x41afc0]
sub esp, 0x104
test eax, eax
jne 0x405954
mov eax, dword [0x41ae60]
push esi
push 0
push 0x4060d0
push 0
push 0x389
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x104
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
push 0
lea ecx, [esp + 0xc]
push ecx
call esi
test edi, edi
je 0x4059bc
mov eax, dword [0x41afc0]
test eax, eax
je 0x4059ab
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x41afc0], 0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4059bc
push 4
push eax
push edi
call esi
pop esi
add esp, 0x104
ret