joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a9fe
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4a8de8
call fcn.0047b633
push 1
call fcn.0047aee1
pop ecx
test al, al
jne 0x47a8b5
push 7
call fcn.0047b3f5
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0047aeac
mov byte [ebp - 0x24], al
mov eax, dword [0x4c5dec]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x47a8ae
test eax, eax
jne 0x47a91f
mov dword [0x4c5dec], ecx
push 0x48056c
push 0x480554
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x47a902
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x47a9f8
push 0x480550
push 0x4804cc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4c5dec], 2
jmp 0x47a924
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0047b04e
pop ecx
call fcn.0047b3e9
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x47a954
push esi
call fcn.0047afc4
pop ecx
test al, al
je 0x47a954
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0047b62d
call esi
call fcn.0047b3ef
mov esi, eax
cmp dword [esi], edi
je 0x47a972
push esi
call fcn.0047afc4
pop ecx
test al, al
je 0x47a972
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0047b50b
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0047b53e
test al, al
jne 0x47a99d
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x47a9a6
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0047b06b
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x47a9f8
call fcn.0047b678
ret
call fcn.0047a73c
jmp 0x47a896

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x30c0bd4
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1be570f9
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4d1141
Capabilities:
Query environment variable

Disassembly:
jmp 0x65a097
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x65a0ab
xor edi, edi
jmp 0x65a0ef
push ebx
push esi
call fcn.00659f90
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.004d41c0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x65a0dc
push ebx
push esi
push edi
call fcn.004d4558
add esp, 0xc
push 2
push 0
call fcn.004d3743
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x4d39a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x6718b0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x6d3038], 1
jge 0x67191f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x6718f5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x6718f5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x6718d2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x67190b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x671912
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x671a0f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x6719e0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x6719d5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x6719c9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x6719d0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x671a0f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x671a0a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x6719f3
mov eax, dword [ebx + 8]
jmp 0x671a0f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x671a01
xor eax, eax
jmp 0x671a0f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x67193f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4010f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x820
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.00414fa0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x824]
push 0x410
push 0x410
push eax
call fcn.004010e0
push dword [eax + 4]
push dword [eax]
call fcn.0041b2ef
add esp, 0x20
cmp word [ebp - 0x824], 0
je 0x40115c
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412b32
mov esp, ebp
pop ebp
ret
Function at 0x403220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x403251
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x403240
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x409180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
mov edx, ecx
push ebx
push esi
push edi
je 0x40919a
cmp dword [edx + 4], 0xffffffff
mov ebx, 1
jne 0x40919c
xor ebx, ebx
mov esi, dword [edx + 0xc]
test ebx, ebx
je 0x409209
test esi, esi
je 0x409209
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x409209
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x409209
mov eax, dword [eax + esi + 0x98]
test eax, eax
je 0x409209
lea edi, [eax + esi]
test edi, edi
je 0x409209
lea eax, [edi + 8]
test eax, eax
je 0x409209
cmp byte [eax], 0x30
lea ecx, [eax + 1]
jne 0x409209
mov al, byte [ecx]
inc ecx
mov dword [ebp - 4], ecx
cmp al, 0x82
jne 0x409209
mov eax, dword [ebp - 4]
movzx ecx, byte [ecx]
shl ecx, 8
movzx eax, byte [eax + 1]
add eax, 0x13
add eax, ecx
and eax, 0xffffff8
je 0x409209
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], edi
jmp 0x409211
mov edi, dword [edx + 0x18]
xor ebx, ebx
mov eax, dword [edx + 0x14]
add edi, eax
test ebx, ebx
je 0x409294
mov eax, dword [edx + 0x10]
add eax, esi
cmp edi, eax
jae 0x409294
xor ebx, ebx
cmp dword [edi], 0x74636159
sete bl
test ebx, ebx
je 0x409289
movzx ecx, byte [edi + 4]
mov eax, 0x100
imul ecx, eax
movzx eax, byte [edi + 5]
inc ax
add cx, ax
mov eax, dword [ebp + 8]
movzx ecx, cx
mov esi, ecx
mov eax, dword [eax]
test eax, eax
jne 0x409269
mov eax, dword [ebp + 0xc]
push esi
mov dword [eax], esi
call fcn.00412ba9
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x409289
push esi
push 0
push eax
call fcn.00414fa0
push esi
lea eax, [edi + 6]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00414a20
add esp, 0x18
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x2a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push 0
mov ecx, 0x23
mov eax, 0x1c
cmovne eax, ecx
mov ebx, edx
push 0
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40b965
push 0x27
lea eax, [ebp - 0x9c]
push eax
lea eax, [esi + 0x8c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
js 0x40b965
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x9c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [ebp - 0x4c]
push edx
push str._d._d._d._d
push 0x24
push eax
call fcn.0040b520
add esp, 0x1c
test eax, eax
js 0x40b965
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2a4]
push eax
push str._lsApplicationsCache_lsv_ls.msi
push edi
call fcn.0040e130
add esp, 0x14
test eax, eax
js 0x40b965
push 1
push 1
push dword [edi]
push ebx
call fcn.0040ed30
test eax, eax
jns 0x40b965
cmp dword [ebp + 8], 1
jne 0x40b965
push edi
push 0
mov edx, ebx
mov ecx, esi
call fcn.0040b880
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412b32
mov esp, ebp
pop ebp
ret

Function at 0x40b980
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x2a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push 0
mov ecx, 0x23
mov eax, 0x1c
cmovne eax, ecx
mov ebx, edx
push 0
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40ba65
push 0x27
lea eax, [ebp - 0x9c]
push eax
lea eax, [esi + 0x8c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
js 0x40ba65
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x9c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [ebp - 0x4c]
push edx
push str._d._d._d._d
push 0x24
push eax
call fcn.0040b520
add esp, 0x1c
test eax, eax
js 0x40ba65
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2a4]
push eax
push str._lsApplicationsCache_lsv_ls.mst
push edi
call fcn.0040e130
add esp, 0x14
test eax, eax
js 0x40ba65
push 1
push 1
push dword [edi]
push ebx
call fcn.0040ed30
test eax, eax
jns 0x40ba65
cmp dword [ebp + 8], 1
jne 0x40ba65
push edi
push 0
mov edx, ebx
mov ecx, esi
call fcn.0040b980
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412b32
mov esp, ebp
pop ebp
ret
Function at 0x40e8c0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], 0
push 0
mov dword [ebp - 0xc], 0
call fcn.0040e9d0
mov esi, eax
test esi, esi
js 0x40e9be
push edi
push 0
push 0x80
push dword [ebp + 0x10]
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40e954
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40e938
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0xe7
push str.c:_buildagentwork1198dd0165ef29c7projects_third_partydutil_resrutil.cpp
call fcn.0040fa20
jmp 0x40e9a8
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 1
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40e9a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40e987
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0xed
push str.c:_buildagentwork1198dd0165ef29c7projects_third_partydutil_resrutil.cpp
call fcn.0040fa20
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test esi, esi
jns 0x40e9bc
cmp dword [ebp - 0xc], 0
je 0x40e9bc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40ebb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x220], eax
mov esi, 0x80004005
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x21c], eax
or edi, 0xffffffff
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40ec3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40ec28
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x40ec3f
push esi
push 0x4be
push str.c:_buildagentwork1198dd0165ef29c7projects_third_partydutil_fileutil.cpp
call fcn.0040fa20
jmp 0x40ed0c
push ebx
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x40ecd4
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push ebx
push dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push str._s_s_05d._s
push eax
call fcn.0040e130
mov esi, eax
add esp, 0x18
test esi, esi
js 0x40ed0b
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40ecc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40ecb7
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070050
jne 0x40ecc3
xor esi, esi
jmp 0x40ecc7
test esi, esi
js 0x40ed0b
inc ebx
cmp ebx, 0x3e8
jl 0x40ec42
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40ece3
mov dword [eax], edi
or edi, 0xffffffff
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x40ecff
mov eax, dword [ebp - 0x210]
mov dword [ecx], eax
mov dword [ebp - 0x210], 0
cmp edi, 0xffffffff
je 0x40ed0b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x40ed1c
push eax
call fcn.0040e720
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00412b32
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ed30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
setne al
mov ecx, eax
or ecx, 2
cmp dword [ebp + 0x14], esi
cmove ecx, eax
push ecx
push ebx
push dword [ebp + 8]
mov dword [ebp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40ee38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test edi, edi
jne 0x40ed8d
cmp esi, 0x50
je 0x40ed7f
cmp esi, 0xb7
jne 0x40ed8d
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
cmp esi, 3
jne 0x40ee2b
movzx eax, word [ebx]
xor edi, edi
mov ecx, ebx
test ax, ax
je 0x40ee1d
mov edx, eax
cmp dx, 0x5c
mov eax, ecx
cmovne eax, edi
add ecx, 2
mov edi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x40eda4
test edi, edi
je 0x40ee1d
xor eax, eax
push eax
push ebx
mov word [edi], ax
call fcn.0040f8e0
mov esi, eax
mov eax, 0x5c
mov word [edi], ax
test esi, esi
js 0x40ee38
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40ee38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40ee02
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x40ee38
push esi
push 0x42e
push str.c:_buildagentwork1198dd0165ef29c7projects_third_partydutil_fileutil.cpp
call fcn.0040fa20
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
mov esi, 0x80070003
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
test esi, esi
jle 0x40ee38
movzx esi, si
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40f5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40f608
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f606
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40f61a
add edi, dword [ebp - 4]
cmp edi, ebx
jb 0x40f5d1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push 0x356
push str.c:_buildagentwork1198dd0165ef29c7projects_third_partydutil_fileutil.cpp
call fcn.0040fa20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40f7a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40f897
add byte [eax], al
cmp eax, 0x104
jae 0x40f897
lea eax, [ebp - 0x414]
push eax
push 0
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40f822
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f810
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0x53
jmp 0x40f8b9
mov ecx, dword [ebp + 0x10]
xor eax, eax
test ecx, ecx
je 0x40f833
cmp ecx, 0x7fffffff
jbe 0x40f838
mov eax, 0x80070057
test eax, eax
js 0x40f8c5
test ecx, ecx
je 0x40f86e
mov edx, 0x7ffffffe
lea edi, [ebp - 0x414]
sub edx, ecx
sub edi, esi
lea eax, [edx + ecx]
test eax, eax
je 0x40f86e
movzx eax, word [edi + esi]
test ax, ax
je 0x40f86e
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x40f853
test ecx, ecx
lea eax, [esi - 2]
pop edi
cmovne eax, esi
xor edx, edx
test ecx, ecx
pop esi
mov word [eax], dx
mov eax, 0x8007007a
cmovne eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412b32
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f8ac
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0x4e
push str.c:_buildagentwork1198dd0165ef29c7projects_third_partydutildirutil.cpp
call fcn.0040fa20
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00412b32
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f8e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40f9db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f913
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
cmp eax, 3
je 0x40f928
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f928
test al, 0x10
jne 0x40f909
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x40f9c5
mov edx, eax
nop dword [eax + eax]
cmp dx, 0x5c
mov eax, ecx
cmovne eax, ebx
add ecx, 2
mov ebx, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x40f940
test ebx, ebx
je 0x40f9c5
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.0040f8e0
mov esi, eax
mov eax, 0x5c
mov word [ebx], ax
test esi, esi
js 0x40f9da
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40f9ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x40f9a4
pop ebx
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
test esi, esi
jle 0x40f9da
movzx esi, si
pop ebx
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
pop ebx
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
mov esi, 0x80070003
push esi
push 0x82
push str.c:_buildagentwork1198dd0165ef29c7projects_third_partydutildirutil.cpp
call fcn.0040fa20
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x40f9f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40fa17
test al, 0x10
je 0x40fa17
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40fa0e
mov dword [ecx], eax
mov eax, 1
pop ebp
ret 8
xor eax, eax
pop ebp
ret 8
Function at 0x410850
Capabilities:
Get session information
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x828]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x828], 0
push dword [ebp + 8]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x4108c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetStringInfoFromSessionInformation__:_WTSQuerySessionInformation___err___d_n
lea ecx, [ebp - 0x824]
push 0x410
push ecx
call fcn.004092a0
add esp, 0x10
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412b32
mov esp, ebp
pop ebp
ret
push dword [esi]
lea ecx, [ebp - 0x824]
push dword [ebp + 0xc]
push str.GetStringInfoFromSessionInformation__:_WTSQuerySessionInformation__d____s_n
push 0x410
push ecx
call fcn.004092a0
add esp, 0x14
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00412b32
mov esp, ebp
pop ebp
ret

Function at 0x410910
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410938
push 0x4336fc
call fcn.00410b90
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
test eax, eax
je 0x410974
lea ecx, [ebp - 4]
push ecx
push eax
push 5
push esi
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x410974
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_get_session_user_name___d_
call fcn.00410b90
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], 0
test eax, eax
je 0x4109b0
lea ecx, [ebp - 8]
push ecx
push eax
push 7
push esi
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x4109b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_get_session_domain_name___d_
call fcn.00410b90
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret