joyce8/EMBER2024-capa huggingface dataset:
Function at 0x669c8b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x669ca1
xor esi, esi
jmp 0x669ca4
and esi, 0x10
mov ecx, dword [esp + 8]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, esi
pop esi
ret

Function at 0x669cb4
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xc
mov eax, 0x69efe0
call fcn.0049be25
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00474f38
push eax
lea ecx, [ebp - 0x10]
call fcn.00451c1b
mov byte [ebp - 4], 1
call fcn.00474f38
push eax
lea ecx, [ebp - 0x14]
call fcn.00451c1b
mov byte [ebp - 4], 2
cmp dword [esi + 8], 3
jne 0x669d1f
lea eax, [ebp + 0xc]
push eax
call fcn.00670d99
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00451d78
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
push 0x1b
push str._uninstall__SessionType_URS
jmp 0x669d6e
cmp dword [esi + 8], 1
je 0x669d42
cmp dword [esi + 8], 2
je 0x669d42
push dword [ebp + 0xc]
push str.Invalid_type_received__d
call fcn.006778de
mov edi, dword [ebp - 0x10]
pop ecx
pop ecx
jmp 0x669e13
lea eax, [ebp + 0xc]
push eax
call fcn.00670dea
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00451d78
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
push 0x1e
push str._uninstall__SessionType_ASSIST
lea ecx, [ebp - 0x14]
call fcn.00452145
call fcn.00474f38
push eax
lea ecx, [ebp + 0xc]
call fcn.00451c1b
mov byte [ebp - 4], 5
lea eax, [ebp + 0xc]
mov edi, dword [ebp - 0x10]
push edi
push dword [ebp + 8]
push 0x751814
push eax
call fcn.00452465
mov esi, dword [ebp + 0xc]
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x669de7
cmp dword [esi - 4], 1
jle 0x669dc2
push dword [esi - 0xc]
lea ecx, [ebp + 0xc]
call fcn.00451ca4
mov esi, dword [ebp + 0xc]
push 1
xor dl, dl
mov ecx, esi
call fcn.0068a223
pop ecx
test al, al
jne 0x669de7
push esi
push str.AppInstaller::DeleteService
push str._s::Ignoring_app_launch_due_to_signature_of_exe_dll_is_not_valid___app_path:_s
call fcn.006778de
add esp, 0xc
jmp 0x669e0b
push 1
push dword [ebp + 8]
push dword [ebp - 0x14]
push edi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
push str.Uninstall_service_called__d
call fcn.006778de
pop ecx
pop ecx
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
lea ecx, [edi - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0044ec01
mov al, bl
call fcn.0049bdee
ret 8
Function at 0x669f75
Capabilities:
Get logon sessions

Disassembly:
push 0x30
mov eax, 0x69f072
call fcn.0049be90
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
test eax, eax
jne 0x669fdd
mov esi, ebx
cmp esi, dword [ebp - 0x24]
jae 0x669fcf
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
mov eax, dword [ebp - 0x1c]
lea eax, [eax + esi*8]
push eax
call dword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
test eax, eax
je 0x669fe5
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], ebx
je 0x669fd2
push dword [ebp - 0x18]
call dword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x669fdd
push ebx
call dword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
call fcn.0049bdee
ret 4
mov eax, dword [ebp - 0x18]
push dword [eax + 0x2c]
lea eax, [ebp - 0x20]
push eax
call fcn.00669e3b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
push dword [eax + 0x10]
call fcn.004514db
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x20]
cmp dword [eax - 0xc], 0
je 0x66a071
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x24], 2
jne 0x66a071
push ecx
add eax, 0xfffffff0
mov edi, esp
push eax
mov dword [ebp - 0x2c], edi
call fcn.0045207b
add eax, 0x10
pop ecx
mov dword [edi], eax
call fcn.00669eec
test al, al
je 0x66a071
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x34]
call fcn.00452929
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 3
call fcn.004556ef
push eax
add eax, 0x10
push eax
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
call fcn.00455763
lea ecx, [ebp - 0x34]
call fcn.00450c8e
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
inc esi
jmp 0x669fa0
Function at 0x66bfd8
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ecx
push ebp
push edi
mov edi, dword [esp + 0x10]
mov ebp, ecx
mov dword [esp + 8], edx
test edi, edi
jne 0x66bff0
xor eax, eax
jmp 0x66c117
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jns 0x66c01b
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x66bffe
sub esi, ecx
jmp 0x66c019
movzx eax, byte [edi]
push eax
call fcn.00514c82
pop ecx
test eax, eax
je 0x66c01d
inc edi
dec esi
test esi, esi
jg 0x66c009
push ebx
lea ebx, [esi - 1]
add ebx, edi
jmp 0x66c035
movzx eax, byte [ebx]
push eax
call fcn.00514c82
pop ecx
test eax, eax
je 0x66c039
dec ebx
dec esi
cmp ebx, edi
jae 0x66c025
mov eax, esi
and eax, 0x80000003
jns 0x66c049
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x66c112
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
imul eax, eax, 3
inc eax
cmp eax, dword [esp + 0x10]
jg 0x66c112
mov ecx, ebp
jmp 0x66c104
mov al, byte [edi]
sub esi, 4
cmp al, 0x80
jae 0x66c112
movzx eax, al
mov dl, byte [eax + 0x757720]
cmp dl, 0xff
je 0x66c112
mov al, byte [edi + 1]
cmp al, 0x80
jae 0x66c112
movzx eax, al
mov bl, byte [eax + 0x757720]
movsx eax, bl
cmp eax, 0xffffffff
je 0x66c112
sar eax, 4
and al, 3
shl dl, 2
or al, dl
mov byte [ecx], al
inc ecx
mov al, byte [edi + 2]
cmp al, 0x3d
jne 0x66c0bf
cmp byte [edi + 3], al
je 0x66c10c
cmp al, 0x80
jae 0x66c112
movzx eax, al
mov dl, byte [eax + 0x757720]
movsx eax, dl
cmp eax, 0xffffffff
je 0x66c112
sar eax, 2
and al, 0xf
shl bl, 4
or al, bl
mov byte [ecx], al
inc ecx
mov al, byte [edi + 3]
cmp al, 0x3d
je 0x66c10c
cmp al, 0x80
jae 0x66c112
movzx eax, al
add edi, 4
mov al, byte [eax + 0x757720]
cmp al, 0xff
je 0x66c112
shl dl, 6
or dl, al
mov byte [ecx], dl
inc ecx
test esi, esi
jg 0x66c06f
sub ecx, ebp
mov eax, ecx
jmp 0x66c115
or eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
pop ecx
ret
Function at 0x66dc85
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x14
mov eax, 0x69f888
call fcn.0049be25
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x66dcbc
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x10]
call fcn.0044ec01
xor al, al
jmp 0x66dde8
test al, 1
je 0x66dddc
cmp byte [edi + 8], bl
je 0x66ddc0
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
push edi
call fcn.0045207b
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push 0x5c
push esi
mov byte [ebp - 4], 1
call fcn.00504dd1
add esp, 0xc
test eax, eax
je 0x66dd09
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x66dd09
inc eax
lea ecx, [ebp - 0x14]
push eax
push ebx
call fcn.004563e3
mov esi, dword [ebp - 0x14]
push str._is_read_olny._Do_you_want_delete_it_
lea ecx, [ebp - 0x18]
call fcn.004514db
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004512d9
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
push 0x23
push str.Warning
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
dec eax
sub eax, 1
je 0x66ddf0
sub eax, 4
je 0x66dd8e
sub eax, 1
je 0x66dd74
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
lea ecx, [esi - 0x10]
call fcn.0044ec01
jmp 0x66dddf
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0x10]
call fcn.0044ec01
lea ecx, [esi - 0x10]
call fcn.0044ec01
mov ecx, edi
jmp 0x66dcb0
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x66dda2
mov bl, 1
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
lea ecx, [esi - 0x10]
call fcn.0044ec01
mov ecx, edi
call fcn.0044ec01
mov al, bl
jmp 0x66dde8
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x66ddd4
mov bl, 1
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
jmp 0x66ddb7
lea edi, [esi - 0x10]
mov ecx, edi
call fcn.0044ec01
mov al, 1
call fcn.0049bdee
ret 4
mov eax, dword [ebp - 0x1c]
push 8
mov byte [eax + 0xa], 1
call fcn.00474bfc
pop ecx
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x66de14
push ebx
mov ecx, eax
call fcn.0066f169
mov ebx, eax
push 0x790648
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x1c], ebx
call fcn.00506dca
int3

Function at 0x66de6f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
jne 0x66de9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x66de97
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x66dea7
xor esi, esi
jmp 0x66dea7
test al, 0x10
je 0x66dea4
push 2
pop esi
jmp 0x66dea7
xor esi, esi
inc esi
mov ecx, dword [esp + 8]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, esi
pop esi
ret 4
Function at 0x66e422
Capabilities:
Copy file

Disassembly:
push 0xc
mov eax, 0x69f9f7
call fcn.0049be25
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov edx, edi
mov esi, eax
mov dword [ebp - 0x14], esi
cmp byte [ebx + 9], dl
jne 0x66e4b1
push ecx
mov esi, esp
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.0045207b
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.0066deb9
test al, al
je 0x66e4a8
push ecx
mov esi, esp
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.0045207b
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x10]
pop ecx
push eax
call fcn.0066def2
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.00451d78
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0044ec01
jmp 0x66e448
mov eax, dword [ebp + 8]
xor edx, edx
mov esi, dword [ebp - 0x14]
inc edx
push edx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x66e504
cmp byte [ebp + 0x10], 0
je 0x66e4e7
push ecx
mov esi, esp
mov dword [ebp + 0x10], esi
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
push edi
call fcn.0045207b
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.0066ef05
jmp 0x66e4ea
lea edi, [esi - 0x10]
mov ecx, edi
call fcn.0044ec01
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
call fcn.0049bdee
ret 0xc
push 8
call fcn.00474bfc
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x66e529
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0066f169
mov edi, eax
push 0x790648
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 1
push eax
mov dword [ebp + 0x10], edi
call fcn.00506dca
int3
Function at 0x66ef05
Capabilities:
Delete directory
Delete file

Disassembly:
push 0x34
mov eax, 0x69fc08
call fcn.0049be25
mov dword [ebp - 0x18], ecx
xor ebx, ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.00475526
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x1c], eax
call fcn.0045207b
mov dword [ebp - 0x14], eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
mov edi, esp
push eax
mov dword [ebp - 0x20], edi
call fcn.0045207b
add eax, 0x10
pop ecx
mov dword [edi], eax
call fcn.0066de6f
cmp eax, 1
jne 0x66ef9e
push ecx
mov edi, esp
mov dword [ebp - 0x20], edi
push dword [ebp - 0x14]
call fcn.0045207b
add eax, 0x10
pop ecx
mov dword [edi], eax
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.0066dc85
test al, al
jne 0x66ef8d
mov byte [edi + 0xa], 1
mov ecx, dword [ebp - 0x14]
jmp 0x66f0a4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x66f0c1
jmp 0x66ef85
lea eax, [ebp - 0x10]
push eax
call fcn.0066de2a
push 0x760700
lea ecx, [ebp - 0x10]
call fcn.00454ba8
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
push ebx
push esi
call fcn.004757a5
test eax, eax
je 0x66f04d
mov ebx, dword [ebp - 0x18]
lea ecx, [ebp - 0x40]
call fcn.00475952
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x20], eax
call fcn.00475cf5
test eax, eax
jne 0x66f045
mov edx, dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
push 0x10
call dword [edx + 0x38]
test eax, eax
je 0x66f034
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x40]
call fcn.00475a4e
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00451d78
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0044ec01
push ecx
mov edi, esp
mov dword [ebp - 0x24], edi
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
push eax
call fcn.0045207b
add eax, 0x10
pop ecx
mov dword [edi], eax
jmp 0x66f03e
push ecx
push esp
lea ecx, [ebp - 0x40]
call fcn.00475a4e
mov ecx, ebx
call fcn.0066ef05
cmp dword [ebp - 0x20], 0
jne 0x66efcc
xor ebx, ebx
lea ecx, [ebp - 0x40]
call fcn.0047574b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x66f0a1
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0xa], 0
jne 0x66f0a1
push 8
call fcn.00474bfc
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x66f090
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0066f169
mov ebx, eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
push 0x790648
jmp 0x66f0f5
lea ecx, [esi - 0x10]
call fcn.0044ec01
lea ecx, [ebp - 0x40]
call fcn.004756d2
mov ecx, dword [ebp - 0x1c]
call fcn.0044ec01
call fcn.0049bdee
ret 4
push 8
call fcn.00474bfc
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x66f0e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0066f169
mov ebx, eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push 0x790648
push eax
call fcn.00506dca
int3
Function at 0x671247
Capabilities:
Enumerate processes

Disassembly:
push 0x250
mov eax, 0x6a0323
call fcn.0049bec7
and dword [ebp - 4], 0
xor edi, edi
push edi
xor esi, esi
mov byte [ebp - 4], 1
push 2
mov dword [ebp - 0x25c], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x228
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x244]
push edi
push eax
call fcn.00506c70
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x67136a
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.0045207b
mov dword [ebp - 0x258], eax
add eax, 0x10
pop ecx
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x254]
call fcn.004514db
lea ecx, [ebp - 0x250]
push ecx
push eax
call fcn.00456dc7
pop ecx
pop ecx
mov ecx, dword [ebp - 0x254]
mov bl, al
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp - 0x258]
mov byte [ebp - 4], 1
call fcn.0044ec01
test bl, bl
je 0x671357
mov edi, dword [ebp - 0x240]
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x671338
push edi
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
and dword [ebp - 4], 0
test esi, esi
je 0x671393
push dword [ebp + 8]
push str.GetProcessHandleByName
push str._s::Handle_for_process__s_aquired_successfully
call fcn.00677869
add esp, 0xc
jmp 0x6713af
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x6712ae
jmp 0x671318
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push str.GetProcessHandleByName
push str._s::Failed_to_aquire_handle_for_process__s_:_error_d
call fcn.00677869
add esp, 0x10
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov eax, esi
call fcn.0049be14
ret

Function at 0x6713c2
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x79b544]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
mov ebp, dword [esp + 0x228]
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x230]
mov ebx, ecx
push edi
push eax
xor edi, edi
mov dword [esp + 0x18], ebx
push edi
push edi
push 0x1c
push edi
mov dword [esp + 0x28], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [esi], eax
test eax, eax
jne 0x67140d
inc edi
jmp 0x67141a
push eax
push str.SHGetFolderPath_returned_error_:__d
call fcn.00677763
pop ecx
pop ecx
lea eax, [esp + 0x18]
mov dword [ebp], edi
push eax
mov ecx, ebx
call fcn.004514db
mov ecx, dword [esp + 0x224]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049b511
add esp, 0x21c
ret
Function at 0x67184d
Capabilities:
Get hostname

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x6a0454
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x79b544]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov ax, word [0x750660]
xor esi, esi
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.00506c70
add esp, 0xc
mov dword [ebp - 0x14], 0x208
lea eax, [ebp - 0x14]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x671921
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [edi], eax
mov esi, 0x208
xor eax, eax
push esi
push eax
lea eax, [ebp]
push eax
call fcn.00506c70
add esp, 0xc
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x67191e
mov ecx, dword [ebp - 0x18]
push eax
push 0x750660
call fcn.00452145
call ebx
mov dword [edi], eax
jmp 0x67195a
mov ebx, dword [ebp - 0x18]
lea ecx, [ebp]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x671929
sub ecx, edx
lea eax, [ebp]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00452145
jmp 0x67195a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0049b511
add ebp, 0x20c
leave
ret
Function at 0x672cb9
Capabilities:
Create thread

Disassembly:
test ecx, ecx
je 0x672ccb
push str.server_name_is_empty
call fcn.006778de
pop ecx
xor al, al
ret
xor eax, eax
push eax
push eax
push eax
push 0x672d05
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x672ce8
push str.ParseProxyPacTimer_:_thread_handle_is_null
jmp 0x672cc2
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x672cff
push str.ParseProxyPacTimer_Thread_did_not_stop_on_its_own
jmp 0x672cc2
mov al, byte [0x7aeee7]
ret
Function at 0x673d92
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x274
mov eax, dword [0x79b544]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
push 0x118
xor ebp, ebp
lea eax, [esp + 0x44]
push ebp
push eax
call fcn.00506c70
add esp, 0xc
mov dword [esp + 0x3c], 0x11c
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x14]
mov dword [esp + 0x10], ebp
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], ebp
push eax
call fcn.00673d54
push 3
pop ebx
test al, al
je 0x673e02
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x44], eax
jmp 0x673e62
cmp dword [esp + 0x40], 6
jne 0x673e62
cmp dword [esp + 0x44], 2
jne 0x673e62
push 1
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0x11c
mov edi, eax
mov esi, edx
lea eax, [esp + 0x160]
push ebp
push eax
call fcn.00506c70
add esp, 0xc
mov dword [esp + 0x15c], 0x11c
lea eax, [esp + 0x15c]
mov dword [esp + 0x164], ebx
push esi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x673e62
mov dword [esp + 0x44], ebx
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x673e82
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [esp + 0x18]
push ecx
call eax
mov eax, dword [esp + 0x40]
cmp eax, 0xa
jne 0x673ea7
xor ebx, ebx
cmp byte [esp + 0x156], 1
setne bl
add ebx, 0xd
jmp 0x673f42
cmp eax, 6
jne 0x673f09
mov eax, dword [esp + 0x44]
cmp eax, ebx
jne 0x673ec6
xor ebx, ebx
cmp byte [esp + 0x156], 1
setne bl
add ebx, 0xb
jmp 0x673f42
cmp eax, 2
jne 0x673edd
xor ebx, ebx
cmp byte [esp + 0x156], 1
setne bl
add ebx, 9
jmp 0x673f42
cmp eax, 1
jne 0x673ef3
xor ebx, ebx
cmp byte [esp + 0x156], al
setne bl
add ebx, 7
jmp 0x673f42
test eax, eax
jne 0x673f40
xor ebx, ebx
cmp byte [esp + 0x156], 1
setne bl
add ebx, 5
jmp 0x673f42
cmp eax, 5
jne 0x673f40
mov eax, dword [esp + 0x44]
cmp eax, 2
jne 0x673f2d
cmp byte [esp + 0x156], 1
jne 0x673f42
cmp word [esp + 0x18], 9
jne 0x673f42
push 4
jmp 0x673f34
cmp eax, 1
jne 0x673f37
push 2
pop ebx
jmp 0x673f42
test eax, eax
jne 0x673f40
xor ebx, ebx
inc ebx
jmp 0x673f42
mov ebx, ebp
cmp ebx, dword [esp + 0x288]
mov ecx, dword [esp + 0x280]
pop edi
pop esi
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.0049b511
add esp, 0x274
ret 4
Function at 0x673f6b
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x6a0d06
call fcn.0049be25
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
lea eax, [eax*2 + 0x14]
push eax
push 1
call fcn.0050e2b0
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
mov esi, eax
cmp dword [ecx - 4], 1
jle 0x673fac
push dword [ecx - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov ecx, dword [ebp + 8]
mov edx, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x673fae
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push 0x674002
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x7aee84], eax
test eax, eax
jne 0x673ff1
push str.Unable_to_start_autoproxy_detection_thread
call fcn.00677869
pop ecx
test esi, esi
je 0x673ff1
push esi
call fcn.00512434
pop ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
call fcn.0049bdee
ret