joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41918c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4232b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004179c2
and dword [ebp - 0x14], 0
cmp dword [0x424758], 0
mov dword [ebp - 0x18], eax
jne 0x41923f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4192e7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4192e7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x424758], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42475c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x424760], eax
call edi
push eax
call esi
mov dword [0x424768], eax
test eax, eax
je 0x41923f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x424764], eax
mov eax, dword [0x424764]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x419298
cmp dword [0x424768], ecx
je 0x419298
push eax
call esi
push dword [0x424768]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x419298
test ebx, ebx
je 0x419298
call edi
test eax, eax
je 0x41928f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41928f
test byte [ebp - 8], 1
jne 0x419298
or dword [ebp + 0x10], 0x200000
jmp 0x4192cb
mov eax, dword [0x42475c]
cmp eax, dword [ebp - 0x18]
je 0x4192cb
push eax
call esi
test eax, eax
je 0x4192cb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4192cb
mov eax, dword [0x424760]
cmp eax, dword [ebp - 0x18]
je 0x4192cb
push eax
call esi
test eax, eax
je 0x4192cb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x424758]
call esi
test eax, eax
je 0x4192e7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4192e9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00417b4e
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x79b54efa
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x113e612c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401460
Capabilities:
Manipulate cd-rom drive

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x10
mov ebx, ecx
call fcn.00401a50
mov eax, dword [ebx + 4]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.open
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x4014c1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.set_cdaudio_door_open
call sub.WINMM.DLL_mciSendStringA
sub esp, 0x10
jmp 0x40150e
mov eax, dword [ebx + 4]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.close
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x401509
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.set_cdaudio_door_closed
call sub.WINMM.DLL_mciSendStringA
sub esp, 0x10
jmp 0x40150e
mov eax, 1
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401b60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401bab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401ba4
test esi, esi
je 0x401ba4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b80
mov dword [esp], 0x407044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d90
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401de0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401eb8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401e1e
cmp eax, 4
jne 0x401e40
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401e2e
cmp edx, 4
je 0x401e2e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d90
Function at 0x60fc2d
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x67ac80
call 0xe8901d66
mov edi, 0x94
mov eax, edi
call 0xfd2a1c72
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x6600c4]
mov ecx, dword [esi + 0x10]
mov dword [0x84e970], ecx
mov eax, dword [esi + 4]
mov dword [0x84e97c], eax
mov edx, dword [esi + 8]
mov dword [0x84e980], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x84e974], esi
cmp ecx, 2
je 0x60fc8d
or esi, 0x8000
mov dword [0x84e974], esi
shl eax, 8
add eax, edx
mov dword [0x84e978], eax
xor esi, esi
push esi
mov edi, dword [0x6601b8]
call edi
cmp word [eax], 0x5a4d
jne 0x60fcc8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x60fcc8
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x60fce0
cmp eax, 0x20b
je 0x60fccd
mov dword [ebp - 0x1c], esi
jmp 0x60fcf4
cmp dword [ecx + 0x84], 0xe
jbe 0x60fcc8
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x60fcee
cmp dword [ecx + 0x74], 0xe
jbe 0x60fcc8
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call 0xc7cc1e27
pop ecx
test eax, eax
jne 0x60fd20
cmp dword [0x84e9bc], 1
jne 0x60fd0d
call 0x8fc41e3a
push 0x1c
call 0xedc21e41
push 0xff
call 0x72311d4b
pop ecx
pop ecx
call 0x39a51e52
mov dword [ebp - 4], esi
call 0xdfca1e5a
test eax, eax
jge 0x60fd39
push 0x1b
call 0x8b4c1d65
pop ecx
call dword [0x660218]
mov dword [0x85fce8], eax
call 0xbdc91e76
mov dword [0x84e9b4], eax
call 0x1bc91e80
test eax, eax
jge 0x60fd5f
push 8
call 0x8b4c1d8b
pop ecx
call 0xe8c61e91
test eax, eax
jge 0x60fd70
push 9
call 0x8b4c1d9c
pop ecx
push 1
call 0xd8311da4
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x60fd86
push eax
call 0x8b4c1db2
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x66021c]
call 0x8bc61ec5
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x60fda7
movzx eax, word [ebp - 0x40]
jmp 0x60fdaa
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call 0xacfa04e5
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x60fdc8
push edi
call 0x3331df5
call 0x25331dfa
jmp 0x60fdfa
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call 0x23911f35
ret
Function at 0x401590
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x578ab0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x57a904]
and eax, 1
jne 0x4015d3
mov ecx, dword [0x57a904]
or ecx, 1
mov dword [0x57a904], ecx
mov ecx, 0x57a900
call fcn.00404750
push 0x52cae0
call fcn.004e4a1f
add esp, 4
mov ecx, 0x57a900
call fcn.00402ec0
movzx edx, al
test edx, edx
je 0x4016d4
xor eax, eax
mov word [ebp - 0x108], ax
push 0xfe
push 0
lea ecx, [ebp - 0x106]
push ecx
call fcn.004e4a40
add esp, 0xc
push 0x100
lea edx, [ebp - 0x108]
push edx
push 0x1003
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x57a900
call fcn.00404850
mov ecx, 0x57a900
call fcn.00402d70
push 0x52dae8
push 0x52daec
mov ecx, 0x57a900
call fcn.00402a10
push 0x52daf4
push 0x52daf8
mov ecx, 0x57a900
call fcn.00402a10
push 0x52db00
push 0x52db04
mov ecx, 0x57a900
call fcn.00402a10
push 0x52db0c
push 0x52db10
mov ecx, 0x57a900
call fcn.00402a10
push 0x52db14
push 0x52db20
mov ecx, 0x57a900
call fcn.00402a10
push 0x52db24
push 0x52db30
mov ecx, 0x57a900
call fcn.00402a10
push 0x52db34
push 0x52db40
mov ecx, 0x57a900
call fcn.00402a10
mov ecx, 0x57a900
call fcn.00402df0
mov eax, 0x57a900
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e4045
mov esp, ebp
pop ebp
ret
Function at 0x40edb0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515316
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x578ab0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1d4], ecx
mov ecx, dword [ebp - 0x1d4]
call fcn.0040f520
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp dword [ebp - 0x10], 0
jne 0x40ee14
xor al, al
jmp 0x40eff0
mov edx, dword [ebp - 0x10]
push edx
call fcn.004e7535
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40ee30
xor al, al
jmp 0x40eff0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x40efcf
lea ecx, [ebp - 0x38]
call fcn.00402ee0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c8], 0
jmp 0x40ee77
mov eax, dword [ebp - 0x1c8]
add eax, 1
mov dword [ebp - 0x1c8], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c8]
cmp edx, dword [ecx + 0x190]
jae 0x40ef20
mov byte [ebp - 0x1d0], 0
xor eax, eax
mov dword [ebp - 0x1cf], eax
mov word [ebp - 0x1cb], ax
mov byte [ebp - 0x1c9], al
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x190]
sub edx, 1
cmp dword [ebp - 0x1c8], edx
jae 0x40eee5
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c8]
movzx ecx, byte [eax + 0x194]
push ecx
push str._02X_
push 8
lea edx, [ebp - 0x1d0]
push edx
call fcn.004e74c8
add esp, 0x10
jmp 0x40ef0c
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c8]
movzx ecx, byte [eax + 0x194]
push ecx
push str._02X
push 8
lea edx, [ebp - 0x1d0]
push edx
call fcn.004e74c8
add esp, 0x10
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040f280
jmp 0x40ee68
mov byte [ebp - 0x1c4], 0
push 0x7f
push 0
lea ecx, [ebp - 0x1c3]
push ecx
call fcn.004e4a40
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x144]
push edx
call fcn.004e4a40
add esp, 0xc
push 0x10
mov eax, dword [ebp - 0x18]
add eax, 0x1b0
push eax
push 0x80
lea ecx, [ebp - 0x1c4]
push ecx
call fcn.004e4dea
add esp, 0x10
lea ecx, [ebp - 0x38]
call fcn.00457070
push eax
lea ecx, [ebp - 0x38]
call fcn.00402fb0
push eax
push 0x100
lea edx, [ebp - 0x144]
push edx
call fcn.004e4dea
add esp, 0x10
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x1a0]
mov dword [ebp - 0x44], ecx
lea edx, [ebp - 0x1c4]
push edx
mov ecx, dword [ebp - 0x1d4]
call fcn.0040f4a0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00402f90
jmp 0x40ee43
mov edx, dword [ebp - 0x14]
push edx
call fcn.004e6eb7
add esp, 4
mov ecx, dword [ebp - 0x1d4]
call fcn.0040f440
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004e4045
mov esp, ebp
pop ebp
ret
Function at 0x422e20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517de0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x578ab0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], 4
call fcn.00424d80
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x533c28
lea ecx, [ebp - 0x20]
call fcn.00404790
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
push str.DetectHW
lea ecx, [ebp - 0x24]
call fcn.00404790
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x30]
call fcn.004240d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00404810
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00404810
push 4
push 1
mov ecx, dword [ebp - 0x30]
call fcn.004240a0
mov ecx, dword [ebp - 0x30]
call fcn.004238b0
push 0
push 0x43a870
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x533c40
lea ecx, [ebp - 0x28]
call fcn.00404790
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 3
push str.InitComm
lea ecx, [ebp - 0x2c]
call fcn.00404790
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 4
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
mov ecx, dword [ebp - 0x30]
call fcn.004240d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00404810
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404810
push 4
push 2
mov ecx, dword [ebp - 0x30]
call fcn.004240a0
mov ecx, dword [ebp - 0x30]
call fcn.00423a80
mov ecx, dword [ebp - 0x30]
call fcn.00423ee0
mov ecx, dword [ebp - 0x30]
call fcn.004236e0
push 4
push 3
mov ecx, dword [ebp - 0x30]
call fcn.004240a0
mov ecx, dword [ebp - 0x30]
call fcn.00423e60
mov ecx, dword [ebp - 0x30]
call fcn.00423730
mov ecx, dword [ebp - 0x30]
call fcn.00423510
push 0
push 0
push 0x46b
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x10]
call fcn.00421380
push 4
push 4
mov ecx, dword [ebp - 0x30]
call fcn.004240a0
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x14], 1
jmp 0x422ffc
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x518d38
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x578ab0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x4324d0
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x4324dc
mov al, 1
jmp 0x43267f
mov dword [ebp - 0x10], 8
call fcn.00430e00
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00430e00
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00430ea0
add esp, 8
movzx eax, al
test eax, eax
je 0x43251f
xor al, al
jmp 0x43267f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00431e50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.00420b30
mov ecx, eax
call fcn.00432870
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00457070
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.00420b30
mov ecx, eax
call fcn.00432870
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.00432bd0
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x43259a
cmp dword [ebp - 0x6c], 1
je 0x4325a1
cmp dword [ebp - 0x6c], 3
je 0x43263b
jmp 0x432653
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00420b30
mov ecx, eax
call fcn.00432870
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x432604
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.00420b30
mov ecx, eax
call fcn.00432870
push eax
call fcn.004e7fc6
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x432604
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402f90
mov al, byte [ebp - 0x61]
jmp 0x43267f
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x432627
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402f90
mov al, byte [ebp - 0x62]
jmp 0x43267f
cmp dword [ebp - 0x38], 0
jne 0x432639
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0040f7b0
jmp 0x43266b
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402f90
mov al, byte [ebp - 0x63]
jmp 0x43267f
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402f90
mov al, byte [ebp - 0x64]
jmp 0x43267f
jmp 0x432532
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004e4045
mov esp, ebp
pop ebp
ret
Function at 0x433890
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x518ebd
mov eax, dword fs:[0]
push eax
sub esp, 0x884
mov eax, dword [0x578ab0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x880], 0
lea ecx, [ebp - 0x3c]
call fcn.004062d0
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x15], al
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x43397e
xor ecx, ecx
mov word [ebp - 0x844], cx
push 0x7fe
push 0
lea edx, [ebp - 0x842]
push edx
call fcn.004e4a40
add esp, 0xc
mov dword [ebp - 0x40], 0x400
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x844]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x15], al
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x433974
lea ecx, [ebp - 0x844]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00420b90
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.00457070
test eax, eax
jne 0x4339dc
lea ecx, [ebp - 0x860]
push ecx
call fcn.0043be70
add esp, 4
mov dword [ebp - 0x884], eax
mov edx, dword [ebp - 0x884]
mov dword [ebp - 0x888], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x888]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00406340
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x860]
call fcn.00403020
jmp 0x433a67
call fcn.0043ba30
cmp eax, 6
jne 0x4339f5
push str.AppData_roaming4G_LTE_Wingle_
lea ecx, [ebp - 0x3c]
call fcn.004043f0
jmp 0x433a02
push str.Application_Data4G_LTE_Wingle_
lea ecx, [ebp - 0x3c]
call fcn.004043f0
push 0
lea ecx, [ebp - 0x3c]
call fcn.00403040
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x433a67
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x433a67
lea ecx, [ebp - 0x87c]
push ecx
call fcn.0043be70
add esp, 4
mov dword [ebp - 0x88c], eax
mov edx, dword [ebp - 0x88c]
mov dword [ebp - 0x890], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x890]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00406340
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x87c]
call fcn.00403020
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403d70
mov edx, dword [ebp - 0x880]
or edx, 1
mov dword [ebp - 0x880], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00403020
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004e4045
mov esp, ebp
pop ebp
ret