joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a1eb
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
cmp dword [0x44f378], 0
je 0x42a30d
push ebp
push edi
or ecx, 0xffffffff
push esi
push ebx
mov edi, eax
mov ebx, eax
xor eax, eax
sub esp, 0x3c
repne scasb al, byte es:[edi]
mov dword [esp], 0x2000
not ecx
lea ebp, [ecx - 0xb]
sub ecx, 0xa
mov dword [esp + 4], ecx
call sym._GlobalAlloc_8
test eax, eax
push edi
push edi
mov edi, eax
jne 0x42a23b
mov dword [esp], str.Call_to_GlobalAlloc_failed_in_setClipboardContent_r_n
call dbg.logEvent
jmp 0x42a306
mov dword [esp], eax
call sym._GlobalLock_4
test eax, eax
push esi
mov esi, eax
jne 0x42a25b
mov dword [esp], str.Call_to_GlobalLock_failed_in_setClipboardContent_r_n
call dbg.logEvent
jmp 0x42a306
lea eax, [esp + 0x2c]
add ebx, 0xa
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], ebp
mov dword [esp], ebx
call dword [0x44f378]
sub esp, 0x1c
test eax, eax
mov edx, dword [esp + 0x2c]
mov byte [esi + edx], 0
jne 0x42a2b0
mov dword [esp], str.Call_to_CryptStringToBinaryA_failed_in_setClipboardContent_r_n
call dbg.logEvent
jmp 0x42a306
mov dword [esp], 0
call sym._OpenClipboard_4
push eax
call sym._EmptyClipboard_0
mov dword [esp + 4], esi
mov dword [esp], 1
call sym._SetClipboardData_8
push edx
push edx
mov dword [esp], edi
call sym._GlobalUnlock_4
push ecx
call sym._CloseClipboard_0
mov edx, 0x446da0
mov ecx, 0x5ff5
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
mov dword [esp + 8], 0x5ff4
mov dword [esp + 4], esi
mov dword [esp], edx
call sym._strncpy
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42a339
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
test edx, edx
jne 0x42a358
mov dword [esp], str.Skipping_set_timestamp_of_file__as_not_provided__r_n
call dbg.logEvent
jmp 0x42a44b
mov dword [esp + 4], edx
mov dword [esp], str.Setting_timestamp_of_file_to__lu__Unix_time_..._r_n
lea edi, [esp + 0x2c]
mov ebx, eax
mov ebp, edx
lea esi, [esp + 0x2c]
call dbg.logEvent
xor eax, eax
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
test eax, eax
jne 0x42a3ac
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._strncpy
lea ebx, [esp + 0x24]
mov eax, ebp
mov edx, ebx
call dbg.unixTimeToFileTime
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
call sym._CreateFileA_28
sub esp, 0x1c
cmp eax, 0xffffffff
mov esi, eax
jne 0x42a412
call sym._GetLastError_0
mov dword [esp], str.Error_encountered_calling_CreateFileA_in_setFileTime__._Error_code___d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x42a44b
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._SetFileTime_16
sub esp, 0x10
test eax, eax
jne 0x42a442
call sym._GetLastError_0
mov dword [esp], str.Error_encountered_calling_SetFileTime_in_setFileTime__._Error_code___d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov dword [esp], esi
call sym._CloseHandle_4
push eax
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42a469
Capabilities:
Get disk information

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
lea esi, [esp + 0x2c]
mov dword [esp], 0x104
mov dword [esp + 0x14], eax
mov dword [esp + 4], esi
call sym._GetLogicalDriveStringsA_8
test eax, eax
push edx
push edx
jne 0x42a4a4
mov dword [esp], str.Call_to_GetLogicalDriveStringsW_failed_r_n
call dbg.logEvent
xor eax, eax
jmp 0x42a533
mov edi, dword [esp + 0x14]
xor eax, eax
or ecx, 0xffffffff
xor ebp, ebp
or edx, 0xffffffff
repne scasb al, byte es:[edi]
mov dword [esp + 0x18], esi
not ecx
lea ebx, [ecx - 1]
cmp byte [esp + ebp + 0x2c], 0
je 0x42a52e
test ebp, ebp
jle 0x42a4e2
mov edi, dword [esp + 0x14]
xor eax, eax
mov ecx, edx
mov esi, dword [esp + 0x14]
inc ebx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
mov word [esi + eax - 1], 0x7c
mov eax, dword [esp + 0x18]
mov dword [esp + 8], str._s_2000_01_01_00:00_0_0
mov dword [esp + 4], 0x100
mov dword [esp + 0x1c], edx
lea esi, [eax + ebp]
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], esi
lea edi, [eax + ebx]
mov dword [esp], edi
call sym.___mingw_snprintf
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ecx, edx
repne scasb al, byte es:[edi]
mov edi, esi
not ecx
lea ebx, [ebx + ecx - 1]
mov ecx, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
add ebp, eax
jmp 0x42a4bd
mov eax, 1
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42a754
Capabilities:
Create process on windows
Query environment variable

Disassembly:
sub esp, 0x1c
add eax, 7
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._strtol
add esp, 0x1c
jmp dbg.createConsoleProcess

Function at 0x42a77a
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
push edi
mov ebp, edx
push esi
push ebx
sub esp, 0x4c
mov dword [esp + 4], 0x4316cc
mov dword [esp], eax
call sym._strtok
mov dword [esp + 4], 0x4316cc
mov dword [esp], 0
call sym._strtok
mov dword [esp + 4], 0x4316cc
mov esi, eax
mov dword [esp], 0
call sym._strtok
mov dword [esp], esi
mov ebx, eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
call sym._strtol
mov dword [esp], ebx
mov esi, eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
call sym._strtol
mov edi, eax
mov eax, esi
mov word [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov word [esp + 0x34], 1
call dbg.keyCode
movzx ebx, ax
mov word [esp + 0x36], ax
mov eax, ebx
call dbg.scanCode
mov edx, edi
mov word [esp + 0x38], ax
mov eax, esi
call dbg.asciiCode
mov byte [esp + 0x3a], al
call dbg.controlKeyState
cmp esi, 0x10
mov dword [esp + 0x3c], eax
jne 0x42a84c
xor eax, eax
cmp dword [0x445ef8], 0
sete al
mov dword [0x445ef8], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x40000000
mov dword [esp], str.CONIN_
call sym._CreateFileA_28
sub esp, 0x1c
cmp eax, 0xffffffff
mov edi, eax
jne 0x42a8ae
call sym._GetLastError_0
mov dword [esp], str.Console_error:_CreateFileA_failed_for_CONIN___error___d_r_n
mov dword [esp + 4], eax
xor ebx, ebx
call dbg.logEvent
jmp 0x42a92f
lea eax, [esp + 0x28]
mov dword [esp + 8], 1
mov dword [esp], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
call sym._WriteConsoleInputA_16
sub esp, 0x10
test eax, eax
je 0x42a918
mov eax, ebx
call dbg.scanCode
test ebp, ebp
movzx eax, ax
mov edx, str.PRESS
jne 0x42a8f5
mov edx, str.RELEASE
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov ebx, 1
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], str.Successfully_wrote_KEY__s_input_record_to_the_console_process:__d__d__d_r_n
call dbg.logEvent
jmp 0x42a926
mov dword [esp], str.Failed_on_call_to_WriteConsoleInput_r_n
xor ebx, ebx
call dbg.logEvent
mov dword [esp], edi
call sym._CloseHandle_4
push eax
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42a939
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
push edi
mov edx, 0x445a98
push esi
push ebx
mov esi, eax
mov edi, edx
xor eax, eax
mov ecx, 4
sub esp, 0x59c
mov edx, dword [0x445a84]
lea ebx, [esp + 0x38]
lea ebp, [esp + 0x7c]
rep stosd dword es:[edi], eax
mov edi, ebx
mov ecx, 0x11
rep stosd dword es:[edi], eax
lea edi, [esp + 0x7c]
mov ecx, 0x41
mov dword [esp + 0x78], edx
mov edx, dword [0x445a8c]
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 0x100
mov dword [esp + 0x74], edx
mov edx, dword [0x445a90]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebp
mov dword [esp], str._TEMP_
mov dword [esp + 0x70], edx
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
lea edi, [esp + 0x180]
mov dword [esp + 8], 0x410
mov dword [esp], esi
mov dword [esp + 4], edi
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x445a98
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
call sym._CreateProcessA_40
mov ebx, eax
mov eax, dword [0x445a8c]
sub esp, 0x28
mov dword [esp], eax
call sym._CloseHandle_4
push eax
mov eax, dword [0x445a84]
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [0x445a90]
push edx
mov dword [esp], eax
call sym._CloseHandle_4
test ebx, ebx
push ecx
je 0x42aa7e
mov dword [esp + 8], 0x400
mov dword [esp + 4], esi
mov ebx, 1
mov dword [esp], 0x445680
call sym._strncpy
mov dword [esp], str.Task_process_successfully_created__r_n
call dbg.logEvent
jmp 0x42aa8a
mov dword [esp], str.Task_error:_CreateProcessA_r_n
call dbg.logEvent
add esp, 0x59c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42aa97
Capabilities:
Create pipe

Disassembly:
push edi
push esi
mov edi, eax
push ebx
sub esp, 0x20
lea esi, [esp + 0x14]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x445a8c
mov dword [esp], 0x445a88
mov dword [esp + 0x14], 0xc
mov dword [esp + 8], esi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0
call sym._CreatePipe_16
sub esp, 0x10
test eax, eax
jne 0x42aaf5
mov dword [esp], str.Task_error:_Cannot_CreatePipe_for_STDOUT_r_n
mov ebx, eax
call dbg.logEvent
jmp 0x42ac0e
mov eax, dword [0x445a88]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._SetHandleInformation_12
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x42ab2c
mov dword [esp], str.Task_error:_Cannot_SetHandleInformation_for_STDOUT_r_n
call dbg.logEvent
jmp 0x42ac0e
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x445a94
mov dword [esp], 0x445a90
call sym._CreatePipe_16
sub esp, 0x10
test eax, eax
mov ebx, eax
jne 0x42ab66
mov dword [esp], str.Task_error:_Cannot_CreatePipe_for_STDIN_r_n
call dbg.logEvent
jmp 0x42ac0e
mov eax, dword [0x445a94]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._SetHandleInformation_12
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x42ab9a
mov dword [esp], str.Task_error:_Cannot_SetHandleInformation_for_STDIN_r_n
call dbg.logEvent
jmp 0x42ac0e
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x445a84
mov dword [esp], 0x445a80
call sym._CreatePipe_16
sub esp, 0x10
test eax, eax
mov ebx, eax
jne 0x42abd1
mov dword [esp], str.Task_error:_Cannot_CreatePipe_for_STDERR_r_n
call dbg.logEvent
jmp 0x42ac0e
mov eax, dword [0x445a80]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._SetHandleInformation_12
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x42ac05
mov dword [esp], str.Task_error:_Cannot_SetHandleInformation_for_STDERR_r_n
call dbg.logEvent
jmp 0x42ac0e
mov eax, edi
call dbg.createTaskProcess
mov ebx, eax
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x42ac17
Capabilities:
Get common file path

Disassembly:
cmp dword [0x44f368], 0
je 0x42adb7
cmp dword [0x44f364], 0
je 0x42adb7
push edi
push ebx
xor eax, eax
mov ecx, 0x3f
sub esp, 0x174
lea edi, [esp + 0x74]
mov dword [esp + 0x6c], 0x5c2e5c5c
mov dword [esp + 0x70], 0x3a43
rep stosd dword es:[edi], eax
lea eax, [esp + 0x70]
mov dword [esp + 4], 0x100
mov dword [esp], eax
call sym._GetWindowsDirectoryA_8
test eax, eax
push edx
push edx
jne 0x42ac85
call sym._GetLastError_0
mov dword [esp], str.Call_to_GetWindowsDirectoryA_failed_in_startMonitoringVolumeChanges___with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
lea eax, [esp + 0x6c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
mov dword [esp], eax
mov byte [esp + 0x72], 0
call sym._CreateFileA_28
sub esp, 0x1c
cmp eax, 0xffffffff
mov ebx, eax
jne 0x42acea
call sym._GetLastError_0
mov dword [esp], str.Call_to_CreateFile_in_startMonitoringVolumeChanges___has_failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x42adaf
lea eax, [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x38
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], 0x900f4
mov dword [esp], ebx
mov dword [esp + 0x10], eax
call sym._DeviceIoControl_32
sub esp, 0x20
test eax, eax
jne 0x42ad48
call sym._GetLastError_0
mov dword [esp], str.Call_to_DeviceIoControl_to_query_journal_failed_in_startMonitoringVolumeChanges___with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x42ada6
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esp], str.Journal_ID:__I64x_r_n
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call dbg.logEvent
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [esp], str.NextUsn:__I64x_r_n
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call dbg.logEvent
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [0x445450], eax
mov dword [0x445454], edx
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [0x445448], eax
mov dword [0x44544c], edx
mov dword [esp], ebx
call sym._CloseHandle_4
push eax
add esp, 0x174
pop ebx
pop edi
ret
Function at 0x42adb8
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x2848
call fcn.00421710
sub esp, eax
mov ebx, edx
mov esi, ecx
mov ebp, dword [esp + 0x2860]
mov eax, dword [esp + eax]
test ebp, ebp
mov edi, eax
mov eax, 0x433dad
je 0x42ade7
mov eax, str.and_appending_to
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], str.Downloading_file__s__s__s..._r_n
call dbg.logEvent
test esi, esi
je 0x42ae21
mov eax, ebx
call dbg.fileExists
test eax, eax
je 0x42ae21
mov dword [esp], str.File_exists__so_skipping_r_n
xor ebx, ebx
call dbg.logEvent
jmp 0x42af73
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], str.Remotely_Client
call sym._InternetOpenA_20
sub esp, 0x14
test eax, eax
mov esi, eax
jne 0x42ae72
call sym._GetLastError_0
mov dword [esp], str.Call_to_InternetOpen_failed_in_downloadFile___with_error__d_r_n
mov dword [esp + 4], eax
xor ebx, ebx
call dbg.logEvent
jmp 0x42af73
mov dword [esp + 4], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x80003000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call sym._InternetOpenUrlA_24
sub esp, 0x18
test eax, eax
mov edi, eax
jne 0x42aec3
mov dword [esp], str.Call_to_InternetOpenUrl_failed_r_n
xor ebx, ebx
call dbg.logEvent
mov dword [esp], esi
call sym._InternetCloseHandle_4
push ecx
jmp 0x42af73
test ebp, ebp
mov eax, 0x431a38
jne 0x42aed1
mov eax, 0x4313ab
mov dword [esp + 4], eax
mov dword [esp], ebx
lea ebp, [esp + 0x40]
call sym._fopen
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 8], 0x2800
mov dword [esp + 4], ebp
mov dword [esp], edi
mov dword [esp + 0xc], eax
call sym._InternetReadFile_16
sub esp, 0x10
test eax, eax
mov ebx, eax
je 0x42af5c
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x42af30
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebp
mov dword [esp + 0xc], edx
call sym._fwrite
jmp 0x42aee5
mov dword [esp], str.File_successfully_downloaded_r_n
call dbg.logEvent
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._fclose
mov dword [esp], edi
call sym._InternetCloseHandle_4
push eax
mov dword [esp], esi
call sym._InternetCloseHandle_4
push edx
jmp 0x42af73
call sym._GetLastError_0
mov dword [esp], str.Call_to_InternetReadFile_failed_in_downloadFile___with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x42af3c
add esp, 0x284c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42b298
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x38
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.downloadMalwareSignatures
mov dword [esp + 4], 0
mov dword [esp + 0x14], eax
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
test eax, eax
jne 0x42b2ee
call sym._GetLastError_0
mov dword [esp], str.Call_to_CreateThread_failed_in_downloadMalwareSignaturesInBackgroundThread___with_error__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x42b305
mov ebx, eax
mov dword [esp], str.Background_thread_successfully_created_to_check_download_AV_database_r_n
call dbg.logEvent
mov dword [esp], ebx
call sym._CloseHandle_4
push eax
add esp, 0x38
pop ebx
ret

Function at 0x42b37f
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x38
mov dword [esp], str.Initiating_scan_of_system_for_malware__in_background_thread_..._r_n
call dbg.logEvent
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.scanAllDrivesForMalware
mov dword [esp + 4], 0
mov dword [esp + 0x14], eax
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
test eax, eax
jne 0x42b3e1
call sym._GetLastError_0
mov dword [esp], str.Call_to_CreateThread_failed_in_scanSystemForMalware___with_error__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x42b3f8
mov ebx, eax
mov dword [esp], str.Background_thread_successfully_created_to_perform_AV_scan_r_n
call dbg.logEvent
mov dword [esp], ebx
call sym._CloseHandle_4
push eax
add esp, 0x38
pop ebx
ret

Function at 0x42b7f7
Capabilities:
Move file

Disassembly:
push ebp
push edi
or ebp, 0xffffffff
push esi
push ebx
sub esp, 0x1c
mov dword [esp + 4], 0x4316cc
mov dword [esp], eax
call sym._strtok
mov dword [esp + 4], 0x4316cc
mov dword [esp], 0
call sym._strtok
mov dword [esp + 4], 0x4316cc
mov dword [esp], 0
mov ebx, eax
call sym._strtok
xor edx, edx
mov esi, eax
xor eax, eax
mov ecx, ebp
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jbe 0x42b85b
cmp byte [ebx + edx], 0x3f
jne 0x42b858
mov byte [ebx + edx], 0x20
inc edx
jmp 0x42b841
xor edx, edx
or ebp, 0xffffffff
xor eax, eax
mov ecx, ebp
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jbe 0x42b87c
cmp byte [esi + edx], 0x3f
jne 0x42b879
mov byte [esi + edx], 0x20
inc edx
jmp 0x42b862
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._MoveFileA_8
test eax, eax
push edx
push edx
jne 0x42b895
mov eax, str.ERROR_RENAME_FAILED
jmp 0x42b89a
mov eax, str.SUCCESS_RENAME_ACTIONED
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp dbg.sendMessage

Function at 0x42b8a6
Capabilities:
Create directory

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._CreateDirectoryA_8
test eax, eax
push edx
push edx
jne 0x42b8cc
mov eax, str.ERROR_MKDIR_FAILED
add esp, 0x1c
jmp dbg.sendMessage
mov eax, str.SUCCESS_MKDIR_ACTIONED
add esp, 0x1c
jmp dbg.sendMessage
Function at 0x42ba2c
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
call dbg.isConsoleProcessRunning
test eax, eax
jne 0x42ba45
mov eax, str.ERROR_CONSOLE_NOT_RUNNING
add esp, 0xc
jmp dbg.sendMessage
add esp, 0xc
jmp dbg.stopConsoleProcess

Function at 0x42ba4d
Capabilities:
Terminate process

Disassembly:
cmp byte [0x445680], 0
je 0x42ba77
sub esp, 0xc
call dbg.isTaskStillRunning
test eax, eax
jne 0x42ba6f
mov eax, str.ERROR_TASK_NOT_RUNNING
add esp, 0xc
jmp dbg.sendMessage
add esp, 0xc
jmp dbg.stopTaskProcess
mov eax, str.ERROR_TASK_NOT_RUNNING
jmp dbg.sendMessage
Function at 0x42c10d
Capabilities:
Delete file
Query environment variable

Disassembly:
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x120
mov dword [esp + 4], eax
mov dword [esp], str.Request_to_delete_file__s_r_n
lea edi, [esp + 0x1c]
call dbg.logEvent
xor eax, eax
mov ecx, 0x41
lea ebx, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
test eax, eax
jne 0x42c168
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._strncpy
mov dword [esp + 4], ebx
mov dword [esp], str.Deleting_file__s_r_n
call dbg.logEvent
mov dword [esp], ebx
call sym._DeleteFileA_4
test eax, eax
push edx
jne 0x42c1a6
call sym._GetLastError_0
mov dword [esp], str.DeleteFile_failed_on_error__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov eax, str.ERROR_DELETE_FILE_FAILED
call dbg.sendMessage
jmp 0x42c1b0
mov eax, 0x434e55
call dbg.sendMessage
add esp, 0x120
pop ebx
pop esi
pop edi
ret

Function at 0x42c1ba
Capabilities:
Delete directory

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
mov dword [esp + 4], eax
mov dword [esp], str.Request_to_delete_directory__s_r_n
call dbg.logEvent
mov dword [esp], ebx
call sym._RemoveDirectoryA_4
test eax, eax
push edx
jne 0x42c200
call sym._GetLastError_0
mov dword [esp], str.RemoveDirectory_failed_on_error__d
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x18
mov eax, str.ERROR_DELETE_DIR_FAILED
pop ebx
jmp dbg.sendMessage
add esp, 0x18
mov eax, 0x434e55
pop ebx
jmp dbg.sendMessage
Function at 0x42c65e
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x65c
cmp byte [0x445680], 0
je 0x42c690
mov dword [esp + 4], eax
mov dword [esp], str.Task_script_already_running__concurrent_scripts_not_currently_supported__r_n
call dbg.logEvent
mov eax, str.ERROR_TASK_FAILED_TO_START
call dbg.sendMessage
jmp 0x42c819
add eax, 5
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp], 0x445600
mov dword [esp + 4], eax
lea edi, [esp + 0x38]
mov dword [esp + 0x2c], eax
call sym._strncpy
xor eax, eax
mov ecx, 0x41
lea ebx, [esp + 0x38]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x13c]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [esp + 0x240]
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea edi, [esp + 0x344]
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], str._TEMP__batch_task.bat
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
lea esi, [esp + 0x13c]
mov dword [esp + 8], 0x104
mov dword [esp], str._TEMP__batch_task.vbs
mov dword [esp + 4], esi
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
lea edi, [esp + 0x240]
mov dword [esp + 8], 0x104
mov dword [esp], str._TEMP__batch_task.zip
mov dword [esp + 4], edi
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
lea ebp, [esp + 0x344]
mov dword [esp + 8], 0x104
mov dword [esp], str._TEMP_unzip.exe
mov dword [esp + 4], ebp
call sym._ExpandEnvironmentStringsA_12
sub esp, 0xc
mov dword [esp], ebx
call sym._DeleteFileA_4
push eax
mov dword [esp], esi
call sym._DeleteFileA_4
push edx
mov dword [esp], edi
call sym._DeleteFileA_4
push ecx
mov dword [esp], ebp
call sym._DeleteFileA_4
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call dbg.createLauncherScript
test eax, eax
jne 0x42c7aa
mov eax, str.ERROR_TASK_FAILED_TO_START
call dbg.sendMessage
jmp 0x42c819
mov edx, dword [esp + 0x2c]
mov dword [esp], ebp
mov ecx, edi
mov eax, esi
call dbg.createFetcherScript
test eax, eax
je 0x42c79e
lea edi, [esp + 0x448]
xor eax, eax
mov ecx, 0x82
lea esi, [esp + 0x448]
rep stosd dword es:[edi], eax
call dbg.isRunningXP
test eax, eax
jne 0x42c7ed
call dbg.windowsPlatform
cmp eax, 0x20
mov edx, str._windir_Sysnativecmd.exe
jne 0x42c7f2
mov edx, str.cmd.exe
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], str._s__c___s_
mov dword [esp + 4], 0x208
mov dword [esp], esi
call sym.___mingw_snprintf
mov eax, esi
call dbg.executeTaskInBackground
add esp, 0x65c
pop ebx
pop esi
pop edi
pop ebp
ret