joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416ba2
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
xor ebx, ebx
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ebp + 0xc], ebx
jne 0x416c29
push ebx
lea eax, [ebp - 8]
push eax
push 1
push str.D:_A__GA___SY__A__GA___BA__A__GRGW0x00100000___WD_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x416c19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x416bf0
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x416bf7
mov esi, 0x80004005
push esi
push 0x116
push str.c:_agent_work36_swix_src_burnenginepipe.cpp
call fcn.004013b3
push str.Failed_to_create_the_security_descriptor_for_the_connection_event_and_pipe.
push esi
call fcn.004453e7
pop ecx
pop ecx
jmp 0x416d65
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push dword [edi]
push str..pipe_ls
push eax
call fcn.004029f6
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x416c5a
push dword [edi]
push str.Failed_to_allocate_full_name_of_pipe:__ls
push esi
call fcn.004453e7
add esp, 0xc
jmp 0x416d65
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
neg eax
sbb eax, eax
and eax, ecx
push eax
push 1
mov eax, 0x10000
push eax
push eax
push 1
push ebx
push 0x80003
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x416cc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x416c9f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x416ca6
mov esi, 0x80004005
push esi
push 0x126
push str.c:_agent_work36_swix_src_burnenginepipe.cpp
call fcn.004013b3
push dword [ebp - 4]
push str.Failed_to_create_pipe:__ls
jmp 0x416c4c
cmp dword [ebp + 0xc], 0
je 0x416d56
push dword [edi]
lea eax, [ebp - 4]
push str..pipe_ls.Cache
push eax
call fcn.004029f6
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x416cec
push dword [edi]
push str.Failed_to_allocate_full_name_of_cache_pipe:__ls
jmp 0x416d44
push 0
push 1
mov eax, 0x10000
push eax
push eax
push 1
push 0
push 0x80003
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
jne 0x416d59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x416d25
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x416d2c
mov esi, 0x80004005
push esi
push 0x132
push str.c:_agent_work36_swix_src_burnenginepipe.cpp
call fcn.004013b3
push dword [ebp - 4]
push str.Failed_to_create_pipe:__ls
push esi
call fcn.004453e7
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x416d65
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], ebx
and dword [eax], 0
cmp dword [ebp - 4], 0
je 0x416d73
push dword [ebp - 4]
call fcn.00403136
cmp dword [ebp - 8], 0
je 0x416d82
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41aa40
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov eax, 0x20000004
push esi
push edi
mov edi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 8], ebx
je 0x41aad2
lea eax, [ebp - 4]
push eax
push 0x1a
call fcn.00419e44
mov esi, eax
test esi, esi
jns 0x41aa83
push str.Failed_to_allocate_administrator_SID.
push esi
call fcn.004453e7
mov edi, dword [ebp - 4]
pop ecx
pop ecx
jmp 0x41aafb
push 2
push 8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x41aaca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41aaac
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41aab3
mov esi, 0x80004005
push esi
push 0x622
push str.c:_agent_work36_swix_src_burnenginecache.cpp
call fcn.004013b3
push str.Failed_to_initialize_ACL.
jmp 0x41aa76
mov edi, dword [ebp - 4]
mov eax, 0x20000005
push 0x7d0
push 3
push ebx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push edi
push eax
push 1
push dword [ebp + 0xc]
call fcn.00448c8c
push 0x80
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test edi, edi
je 0x41ab05
push edi
call fcn.004051ae
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x41b79f
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x46e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
lea eax, [ebp - 0x254]
push 0x250
push esi
push eax
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x25c], esi
call fcn.00430ec0
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push str..unverified
push dword [ebp + 8]
call fcn.0041c095
test eax, eax
js 0x41b801
push 7
push dword [ebp - 0x258]
call fcn.00401700
cmp dword [ebp + 8], esi
jne 0x41b8e6
push esi
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 0xc]
call fcn.00419ef0
test eax, eax
js 0x41b8e6
lea eax, [ebp - 0x260]
push eax
push 0x44e62c
push dword [ebp - 0x258]
call fcn.004047cb
test eax, eax
js 0x41b8e6
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41b8e6
test byte [ebp - 0x254], 0x10
jne 0x41b8cd
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jbe 0x41b8a5
push 0x2e
pop ecx
cmp cx, word [ebp + eax*2 - 0x22c]
jne 0x41b8a5
movzx eax, word [ebp + eax*2 - 0x22a]
push 0x52
pop ecx
cmp cx, ax
je 0x41b8cd
push 0x72
pop ecx
cmp cx, ax
je 0x41b8cd
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x258]
call fcn.004047cb
test eax, eax
js 0x41b8cd
push dword [ebp - 0x25c]
call fcn.0040383e
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41b85f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x25c], 0
pop esi
je 0x41b8fb
push dword [ebp - 0x25c]
call fcn.00403136
cmp dword [ebp - 0x260], 0
je 0x41b90f
push dword [ebp - 0x260]
call fcn.00403136
cmp dword [ebp - 0x258], 0
je 0x41b923
push dword [ebp - 0x258]
call fcn.00403136
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430093
leave
ret 8
Function at 0x41ef01
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x30]
push esi
mov esi, dword [ebp + 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x34]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x60], ecx
xor ecx, ecx
push ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
push ecx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x34]
push eax
push 0x41ca2f
push ecx
push ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x41efd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41efb0
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41efb7
mov esi, 0x80004005
push esi
push 0x465
push str.c:_agent_work36_swix_src_burnengineelevation.cpp
call fcn.004013b3
push str.Failed_to_create_elevated_cache_thread.
push esi
call fcn.004453e7
pop ecx
pop ecx
jmp 0x41f020
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x41e48f
push dword [ebp + 0xc]
call fcn.00416e6a
mov esi, eax
test esi, esi
jns 0x41f000
push str.Failed_to_pump_messages_in_child_process.
push esi
call fcn.004453e7
pop ecx
pop ecx
jmp 0x41f019
push dword [ebp - 8]
push edi
call fcn.0041ebe5
mov ecx, dword [ebp + 0x38]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x38
Function at 0x4202cb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push 1
push edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x420333
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x420310
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x420317
mov esi, 0x80004005
push esi
push 0x39
push str.c:_agent_work36_swix_src_burnengine_splashscreen.cpp
call fcn.004013b3
push str.Failed_to_create_modal_event.
push esi
call fcn.004453e7
pop ecx
pop ecx
jmp 0x4203a6
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x420050
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
test eax, eax
jne 0x420397
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42037c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x420383
mov esi, 0x80004005
push esi
push 0x42
push str.c:_agent_work36_swix_src_burnengine_splashscreen.cpp
call fcn.004013b3
push str.Failed_to_create_UI_thread.
jmp 0x420329
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], edi
je 0x4203b9
push dword [ebp - 8]
call esi
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
je 0x4203c3
push dword [ebp - 0xc]
call esi
pop edi
pop esi
leave
ret 0xc
Function at 0x4206f8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [ebp - 0x14]
xor eax, eax
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
mov esi, ebx
push ebx
push ebx
push 1
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x420762
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42073c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x420743
mov esi, 0x80004005
push esi
push 0x33
push str.c:_agent_work36_swix_src_burnengineuithread.cpp
call fcn.004013b3
push str.Failed_to_create_initialization_event.
push esi
call fcn.004453e7
mov eax, dword [ebp - 4]
pop ecx
pop ecx
jmp 0x4207da
mov edi, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0x420436
push ebx
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4207bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4207a2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4207a9
mov esi, 0x80004005
push esi
push 0x3c
push str.c:_agent_work36_swix_src_burnengineuithread.cpp
call fcn.004013b3
push str.Failed_to_create_the_UI_thread.
jmp 0x420755
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebp - 4]
mov dword [edi + 0x3e4], eax
mov eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4207ea
push eax
call edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x4207f4
push dword [ebp - 8]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x42330d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
or dword [edi + 0x3c], 0xffffffff
lea eax, [edi + 0x1c]
push eax
call fcn.00402c72
mov esi, eax
test esi, esi
jns 0x423339
push str.Failed_to_copy_file_name.
jmp 0x423425
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x24], eax
test eax, eax
jne 0x423385
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x423364
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x42336b
mov esi, 0x80004005
push esi
push 0x8c
push str.c:_agent_work36_swix_src_burnenginecabextract.cpp
call fcn.004013b3
push str.Failed_to_create_begin_operation_event.
jmp 0x423425
push ebx
push ebx
push 1
push ebx
call esi
mov dword [edi + 0x28], eax
test eax, eax
jne 0x4233c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4233aa
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4233b1
mov esi, 0x80004005
push esi
push 0x8f
push str.c:_agent_work36_swix_src_burnenginecabextract.cpp
call fcn.004013b3
push str.Failed_to_create_operation_complete_event.
jmp 0x423425
push ebx
push ebx
push edi
push 0x422cca
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x20], eax
test eax, eax
jne 0x423414
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4233f6
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4233fd
mov esi, 0x80004005
push esi
push 0x93
push str.c:_agent_work36_swix_src_burnenginecabextract.cpp
call fcn.004013b3
push str.Failed_to_create_extraction_thread.
jmp 0x423425
push edi
call fcn.004230b0
mov esi, eax
test esi, esi
jns 0x42342d
push str.Failed_to_wait_for_operation_complete.
push esi
call fcn.004453e7
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42877b
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x46e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 7
pop ecx
lea edi, [ebp - 0x20]
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4287e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4287c4
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4287cb
mov esi, 0x80004005
push esi
push 0x1fc
push str.c:_agent_work36_swix_src_burnenginemsuengine.cpp
call fcn.004013b3
push str.Failed_to_stop_wusa_service.
push esi
call fcn.004453e7
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00430093
leave
ret 4
Function at 0x42b7db
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov eax, dword [ebx + 4]
mov edi, 0x44e568
mov dword [ebp - 4], esi
test eax, eax
je 0x42b7fa
mov edx, dword [eax]
jmp 0x42b807
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x42b805
mov edx, dword [ecx]
jmp 0x42b807
mov edx, edi
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42b810
mov edi, dword [ecx]
test eax, eax
je 0x42b822
xor eax, eax
test ecx, ecx
setne al
add eax, 0x20000150
jmp 0x42b831
mov eax, dword [ebx + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [ebp + 0xc]
push str.copy
push edi
push edx
push eax
push 2
call fcn.004072c6
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
add esp, 0x18
push eax
push edi
call fcn.00403b2c
test eax, eax
je 0x42b8af
mov eax, dword [ebp - 4]
test al, 1
je 0x42b8af
and eax, 0xfffffffe
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x42b8af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42b887
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x42b88e
mov esi, 0x80004005
push esi
push 0x538
push str.c:_agent_work36_swix_src_burnengine_apply.cpp
call fcn.004013b3
push edi
push str.Failed_to_clear_readonly_bit_on_payload_destination_path:__ls
push esi
call fcn.004453e7
add esp, 0xc
jmp 0x42b92d
push esi
lea eax, [ebx + 0x20]
push eax
push ebx
push fcn.0042b6b4
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x42b92d
cmp dword [ebx + 0x20], esi
je 0x42b8ed
mov esi, 0x80070642
push esi
push 0x542
push str.c:_agent_work36_swix_src_burnengine_apply.cpp
call fcn.004013b3
push edi
push dword [ebp + 0xc]
push str.BA_aborted_copy_of_payload_from:__ls_to:__ls.
jmp 0x42b924
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42b904
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x42b90b
mov esi, 0x80004005
push esi
push 0x546
push str.c:_agent_work36_swix_src_burnengine_apply.cpp
call fcn.004013b3
push edi
push dword [ebp + 0xc]
push str.Failed_attempt_to_copy_payload_from:__ls_to:__ls.
push esi
call fcn.004453e7
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43c2af
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x46e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x43c2fa
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0043c44e
test al, al
jne 0x43c2f4
sub edx, 2
cmp edx, edi
jne 0x43c2da
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x43c31c
lea eax, [edi + 2]
cmp edx, eax
je 0x43c31c
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0043c1fb
add esp, 0x10
jmp 0x43c416
push esi
lea ecx, [ebp - 0x255]
call fcn.0043c44e
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43c35f
push dword [ebp - 0x25c]
jmp 0x43c30c
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x43c39c
cmp word [ebp - 0x226], 0
je 0x43c3bd
cmp word [ebp - 0x226], ax
jne 0x43c39c
cmp word [ebp - 0x224], 0
je 0x43c3bd
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0043c1fb
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x43c409
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x43c376
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x43c3f1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x43c416
push 0x43c02b
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004408e0
add esp, 0x10
jmp 0x43c3e6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430093
leave
ret

Function at 0x43dbf5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46674c
push 0x466744
push str.FlsAlloc
push 0x1e
call fcn.0043db32
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43dc29
push dword [ebp + 8]
mov ecx, esi
call dword [0x44e3d4]
call esi
jmp 0x43dc2f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x43dc73
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46675c
push 0x466754
push str.FlsGetValue
push 0x20
call fcn.0043db32
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43dcaa
push dword [ebp + 8]
mov ecx, esi
call dword [0x44e3d4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x444e59
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46f748
push str.AdvApi32.dll
call fcn.004013b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x444e9c
push str.SystemFunction040
push dword [0x46f748]
call edi
push str.SystemFunction041
push dword [0x46f748]
mov dword [0x46f738], eax
call edi
mov dword [0x46f73c], eax
jmp 0x444ea1
mov eax, dword [0x46f73c]
cmp dword [0x46f738], 0
je 0x444eb2
test eax, eax
jne 0x444f59
push 0x46f74c
push str.Crypt32.dll
call fcn.004013b6
mov esi, eax
test esi, esi
js 0x444f63
push str.CryptProtectMemory
push dword [0x46f74c]
call edi
cmp dword [0x46f738], 0
mov dword [0x46f740], eax
jne 0x444f17
test eax, eax
jne 0x444f17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444f01
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444f08
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work36_swix_srclibsdutilcryputil.cpp
call fcn.004013b3
jmp 0x444f63
push str.CryptUnprotectMemory
push dword [0x46f74c]
call edi
cmp dword [0x46f73c], 0
mov dword [0x46f744], eax
jne 0x444f59
test eax, eax
jne 0x444f59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444f4d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444f54
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x444f0b
mov dword [0x46f750], 1
pop edi
mov eax, esi
pop esi
ret