joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6470700d
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push 0x68
mov eax, 0x64741888
call fcn.647264a8
xor edi, edi
lea ecx, [ebp - 0x6c]
push edi
push str.CFileListCompare::CheckSpoolerService
call fcn.647109cd
mov dword [ebp - 4], edi
push 0xf003f
push str.ServicesActive
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x64707139
push 0xf01ff
push str.Spooler
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x6470706a
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x64707139
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x6470712d
cmp dword [ebp - 0x28], 4
jne 0x64707097
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
xor edi, edi
inc edi
jmp 0x64707139
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x6470712d
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x6470712d
jmp 0x647070f8
mov eax, dword [ebp - 0x14]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x647070d0
mov eax, ecx
jmp 0x647070da
mov ecx, 0x2710
cmp eax, ecx
cmova eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x64707121
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x18], eax
jbe 0x64707109
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x74], eax
jmp 0x64707117
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x14]
ja 0x64707121
mov ecx, dword [ebp - 0x28]
cmp ecx, 2
je 0x647070b9
jmp 0x64707124
mov ecx, dword [ebp - 0x28]
xor eax, eax
inc eax
cmp ecx, 4
cmove edi, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.64710b28
mov eax, edi
call fcn.64726457
ret
Function at 0x64707aad
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x6475a360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0x103
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x10c], esi
mov byte [ebp - 0x108], bl
call fcn.64725a70
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x64707b7d
push edi
call fcn.64722f0e
mov esi, eax
pop ecx
test esi, esi
je 0x64707b7d
push esi
push edi
push ebx
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x64745954
push esi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x110]
test ecx, ecx
je 0x64707b76
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._u__u__u__u
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.64704ee5
add esp, 0x1c
push esi
call fcn.647261f1
pop ecx
cmp byte [ebp - 0x108], bl
je 0x64707b94
lea eax, [ebp - 0x108]
push eax
call fcn.64725b00
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x114]
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.6470219f
mov ecx, dword [ebp - 4]
xor eax, eax
cmp byte [ebp - 0x108], al
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.647263d1
mov esp, ebp
pop ebp
ret
Function at 0x64707c53
Capabilities:
Create thread

Disassembly:
push 0x88
mov eax, 0x647419d5
call fcn.647264a8
mov edi, ecx
mov dword [ebp - 0x88], edi
xor ebx, ebx
lea ecx, [ebp - 0x80]
push ebx
push str.CFileListCompare::StartFileVersionCheck
call fcn.647109cd
mov dword [ebp - 4], ebx
cmp dword [edi + 0x2c], ebx
jne 0x64707c89
push str.quickLaunch__fileList__CheckFileVersion__invalid_Meeting_Path
jmp 0x64707ca0
cmp dword [edi + 0x64], ebx
je 0x64707c95
push str.quickLaunch__fileList__CheckFileVersion__File_Version_Check_Thread_already_Running
jmp 0x64707ca0
cmp dword [ebp + 8], 0
jne 0x64707cad
push str.quickLaunch__fileList__CheckFileVersion__Thread_callback_Wnd_is_NULL
call fcn.6471ba48
pop ecx
mov esi, ebx
jmp 0x64707e3b
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x84]
push dword [edi + 0x6c]
lea ecx, [ebp - 0x94]
push dword [edi + 0x68]
push ebx
push eax
call fcn.64706786
mov esi, dword [edi + 0x74]
jmp 0x64707d27
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
push esi
push eax
mov ecx, edi
call fcn.64707bc3
push dword [ebp - 0x18]
lea eax, [ebp - 0x84]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x94]
push dword [ebp - 0x90]
push eax
call fcn.64706786
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.647093de
add esi, 0x18
cmp esi, dword [edi + 0x78]
jne 0x64707ce1
mov esi, dword [ebp - 0x94]
cmp esi, dword [ebp - 0x90]
je 0x64707d9b
lea eax, [edi + 0x1c]
mov edi, eax
push 0x64745954
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.64703114
mov byte [ebp - 4], 3
push esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.6470584e
add esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esi
push eax
call fcn.64703566
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.647020ab
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.647020ab
add esi, 0x34
cmp esi, dword [ebp - 0x90]
jne 0x64707d3f
mov edi, dword [ebp - 0x88]
push 0x14
call fcn.647239d2
mov esi, eax
pop ecx
mov dword [ebp - 0x88], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x64707dc1
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov byte [ebp - 4], 5
jmp 0x64707dc3
mov esi, ebx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x94]
push eax
mov ecx, esi
call fcn.64706d0a
mov eax, dword [ebp + 8]
push ebx
push ebx
push esi
push 0x64707f71
push ebx
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 1
call fcn.64727274
add esp, 0x18
mov dword [edi + 0x64], eax
test eax, eax
je 0x64707e00
xor esi, esi
inc esi
jmp 0x64707e2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.quickLaunch__failed_to_launch_thread_err_d
call fcn.6471ba48
pop ecx
pop ecx
mov dword [ebp - 0x88], esi
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.647093de
push esi
call fcn.647239ab
pop ecx
mov esi, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x94]
call fcn.647093de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.64710b28
mov eax, esi
call fcn.64726457
ret 4
Function at 0x64708141
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x234
mov eax, 0x64741b01
call fcn.647264a8
mov esi, ecx
mov dword [ebp - 0x240], esi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0x10
jb 0x64708165
mov eax, dword [edi]
jmp 0x64708167
mov eax, edi
push eax
push str.CFileListCompare::_FindFiles
lea ecx, [ebp - 0xfc]
call fcn.647109cd
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 0x64746224
push edi
push eax
call fcn.64703114
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x23c]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x647081b8
push eax
jmp 0x647082d4
cmp byte [ebp - 0x210], 0x2e
je 0x647082bd
test byte [ebp - 0x23c], 0x10
push 0x64745954
push edi
je 0x64708222
lea eax, [ebp - 0xa4]
push eax
call fcn.64703114
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x210]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.647030d2
add esp, 0x18
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa4]
push 0
push 1
call fcn.647020ab
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.64708141
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
jmp 0x647082b4
lea eax, [ebp - 0xbc]
push eax
call fcn.64703114
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x210]
push ecx
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.647030d2
add esp, 0x18
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xbc]
push 0
push 1
call fcn.647020ab
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x8c]
call fcn.64703353
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x74]
push 0x647459ef
call fcn.647011e6
mov byte [ebp - 4], 9
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x8c]
mov esi, dword [ebp - 0x240]
mov ecx, esi
push eax
call fcn.6470958c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x8c]
call fcn.64706cd4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push 0
push 1
call fcn.647020ab
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x647081b8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.647020ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.64710b28
call fcn.64726457
ret 4
Function at 0x64708301
Capabilities:
Read .ini file

Disassembly:
push 0x460
mov eax, 0x64741b3f
call fcn.647264a8
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x44], ebx
jne 0x64708323
xor eax, eax
jmp 0x64708492
push ebx
push str.CFileListCompare::_GetProfileSectionNames
lea ecx, [ebp - 0x468]
call fcn.647109cd
mov dword [ebp - 4], ebx
mov ecx, esi
push dword [esi + 4]
push dword [esi]
call fcn.64708103
mov eax, dword [esi]
push 0x3ff
mov dword [esi + 4], eax
lea eax, [ebp - 0x40f]
push ebx
push eax
mov byte [ebp - 0x410], bl
call fcn.64725a70
lea eax, [edi + 0x34]
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x6470836e
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov dword [ebp - 0x46c], eax
test eax, eax
je 0x64708481
mov dword [ebp - 0x418], ebx
lea edi, [ebp - 0x410]
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], ebx
mov byte [ebp - 0x428], bl
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov ebx, eax
push edi
call fcn.647023fa
pop ecx
push eax
push edi
lea ecx, [ebp - 0x428]
call fcn.6470219f
mov ecx, dword [ebp - 0x418]
test ecx, ecx
je 0x6470843f
cmp dword [ebp - 0x414], 0x10
lea eax, [ebp - 0x428]
lea edx, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
cmovae edx, dword [ebp - 0x428]
add eax, ecx
cmp dword [ebp - 0x414], 0x10
lea ecx, [ebp - 0x428]
push fcn.64726d9f
cmovae ecx, dword [ebp - 0x428]
push edx
push eax
push ecx
lea eax, [ebp - 0x46c]
push eax
call fcn.64703301
add esp, 0x14
lea eax, [ebp - 0x428]
mov ecx, esi
push eax
call fcn.647095f7
mov ecx, dword [ebp - 0x418]
inc edi
add edi, ecx
je 0x64708454
lea eax, [ebp - 0x410]
add eax, ebx
cmp edi, eax
jb 0x647083bf
mov eax, dword [esi + 4]
sub eax, dword [esi]
push 0x18
pop ecx
cdq
idiv ecx
push eax
push str.quickLaunch__fileList___GetProfileSectionNames__vtSection_size___d
call fcn.64721861
pop ecx
pop ecx
mov byte [ebp - 4], 0
xor ebx, ebx
push 0
inc ebx
lea ecx, [ebp - 0x428]
push ebx
call fcn.647020ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x468]
call fcn.64710b28
mov eax, ebx
call fcn.64726457
ret 4
Function at 0x64708fce
Capabilities:
Get common file path

Disassembly:
push 0x168
mov eax, 0x64741cdd
call fcn.647264a8
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
jb 0x64708fec
mov eax, dword [esi]
jmp 0x64708fee
mov eax, esi
push eax
push str.CFileListCompare::_ParseTargetPath
lea ecx, [ebp - 0x16c]
call fcn.647109cd
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x113]
push 0x103
push ebx
push eax
mov byte [ebp - 0x114], bl
call fcn.64725a70
push str._uninstall_
call fcn.64725b00
add esp, 0x10
mov ecx, esi
push eax
push str._uninstall_
push dword [esi + 0x10]
push ebx
call fcn.64702eb9
mov dword [ebp - 0x170], 1
test eax, eax
jne 0x64709063
lea eax, [edi + 0x4c]
cmp esi, eax
je 0x647091f5
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.6470210b
jmp 0x647091f5
mov edi, str._system_
push edi
call fcn.64725b00
pop ecx
push eax
push edi
push dword [esi + 0x10]
mov ecx, esi
push ebx
call fcn.64702eb9
test eax, eax
jne 0x64709094
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x64709109
mov edi, str._windows_
push edi
call fcn.64725b00
pop ecx
push eax
push edi
push dword [esi + 0x10]
mov ecx, esi
push ebx
call fcn.64702eb9
test eax, eax
jne 0x647090c5
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x64709109
mov edi, str._pdriver_
push edi
call fcn.64725b00
pop ecx
push eax
push edi
push dword [esi + 0x10]
mov ecx, esi
push ebx
call fcn.64702eb9
test eax, eax
jne 0x64709134
call fcn.6470700d
lea eax, [ebp - 0x174]
mov dword [ebp - 0x174], ebx
push eax
push 0x104
lea eax, [ebp - 0x114]
push eax
push 1
push ebx
push ebx
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
cmp byte [ebp - 0x114], bl
je 0x64709120
lea eax, [ebp - 0x114]
push eax
call fcn.64725b00
pop ecx
mov ebx, eax
push ebx
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.6470219f
jmp 0x647091f5
mov edi, str._kdriver_
push edi
call fcn.64725b00
pop ecx
push eax
push edi
push dword [esi + 0x10]
mov ecx, esi
push ebx
call fcn.64702eb9
test eax, eax
jne 0x647091ef
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x114], bl
jne 0x64709173
mov eax, ebx
jmp 0x64709180
lea eax, [ebp - 0x114]
push eax
call fcn.64725b00
pop ecx
push eax
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.6470219f
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x115], 0x5c
je 0x647091d8
push 0x64745954
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.64703114
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, esi
push eax
call fcn.64703566
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x12c]
push ebx
push 1
call fcn.647020ab
mov edi, str.drivers
push edi
call fcn.64725b00
pop ecx
push eax
push edi
mov ecx, esi
call fcn.64705196
jmp 0x647091f5
mov dword [ebp - 0x170], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.64710b28
mov eax, dword [ebp - 0x170]
call fcn.64726457
ret 4
Function at 0x64709769
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x34]
test eax, eax
je 0x6470985c
cmp eax, 0xffffffff
je 0x6470985c
mov edi, dword [ebp + 8]
test edi, edi
je 0x6470985c
push ebx
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
xor edx, edx
lea ecx, [ebp + 0xc]
push edx
push ecx
push edx
push edi
push eax
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x64709857
cmp dword [ebp + 0xc], 1
je 0x647097e1
cmp dword [ebp + 0xc], 7
je 0x647097e1
cmp dword [ebp + 0xc], 2
je 0x647097e1
cmp dword [esi + 0x14], 0x10
jb 0x647097d0
mov esi, dword [esi]
push edi
push esi
push str.configuration__registry__pas_s__key_s_is_not_string_value
call fcn.6471ba48
add esp, 0xc
jmp 0x64709857
push dword [ebp + 8]
call fcn.64722f0e
mov dword [ebp - 4], eax
pop ecx
test eax, eax
je 0x6470983d
push dword [ebp + 8]
push 0
push eax
call fcn.64725a70
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push dword [esi + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ebx, [esi + 0x18]
mov esi, dword [ebp - 4]
push esi
call fcn.647023fa
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.6470219f
push esi
call fcn.647261f1
cmp dword [ebx + 0x14], 0x10
pop ecx
jb 0x64709857
mov ebx, dword [ebx]
jmp 0x64709857
cmp dword [esi + 0x14], 0x10
jb 0x64709845
mov esi, dword [esi]
push dword [ebp + 8]
push edi
push esi
push str.configuration__registry__pas_s__key_s_failed_to_allocate_buffer_size_d
call fcn.6471ba48
add esp, 0x10
mov eax, ebx
pop ebx
jmp 0x6470985f
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x6470e027
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.6470e3b0
test eax, eax
je 0x6470e038
xor eax, eax
inc eax
pop esi
ret
push ebx
push edi
xor edi, edi
cmp dword [esi + 0x28], edi
je 0x6470e082
push 0x64
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test ebx, ebx
je 0x6470e076
cmp ebx, 0x80
je 0x6470e076
cmp ebx, 0xffffffff
je 0x6470e076
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.jmtLog__initThread_failed_to_quit_previous_thread_wait_d_err_d
call fcn.6470e3da
add esp, 0xc
jmp 0x6470e08d
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x28], edi
mov ecx, esi
call fcn.6470e386
test eax, eax
je 0x6470e091
xor eax, eax
jmp 0x6470e0cd
lea eax, [esi + 0x2c]
push eax
push edi
push esi
push 0x6470e871
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28], eax
test eax, eax
je 0x6470e0b8
xor edi, edi
mov ecx, esi
inc edi
push edi
call fcn.6470e83b
jmp 0x6470e0cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.jmtLog__failed_to_create_thread_err_d
call fcn.6470e3da
pop ecx
pop ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x6470e206
Capabilities:
Create directory

Disassembly:
push 0x34
mov eax, 0x6474298e
call fcn.647264a8
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x6470e230
push esi
call fcn.647023fa
pop ecx
push eax
push esi
mov ecx, edi
call fcn.6470219f
jmp 0x6470e360
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
push eax
call fcn.6470df6a
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push eax
call fcn.64703566
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.647020ab
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x6470e2b9
lea eax, [ebp - 0x40]
push 0x1c
push eax
call fcn.6470de45
pop ecx
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.64703566
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.647020ab
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x6470e2b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.647020ab
xor eax, eax
jmp 0x6470e36a
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp byte [eax + ecx - 1], 0x5c
je 0x6470e2e1
mov esi, 0x64745954
push esi
call fcn.64725b00
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.64705196
mov esi, 0x64745958
push esi
call fcn.64725b00
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.64705196
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.64726e92
pop ecx
pop ecx
test eax, eax
je 0x6470e322
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.JmtLog.log
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.64703114
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, edi
push eax
call fcn.64703566
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.647020ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.647020ab
mov ecx, edi
call fcn.6470e0d1
xor eax, eax
inc eax
call fcn.64726457
ret 4
Function at 0x6470e924
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x647438d3
call fcn.647264a8
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x6470ea25
cmp byte [ebx + 0x45], 0
je 0x6470ea25
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x6470e959
xor al, al
jmp 0x6470ea27
xor eax, eax
lea ecx, [ebp - 0x28]
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push 8
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.6470b850
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x6470e9b9
dec eax
je 0x6470e9bd
dec eax
dec eax
je 0x6470ea0f
xor bl, bl
jmp 0x6470ea11
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x6470e9f5
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.6472634f
add esp, 0x10
cmp esi, eax
jne 0x6470e9b5
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x45], 0
je 0x6470ea0f
test esi, esi
jne 0x6470e983
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.6470b67f
jmp 0x6470e97d
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.647020ab
mov al, bl
jmp 0x6470ea27
mov al, 1
call fcn.64726457
ret
Function at 0x6470f942
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x64742b7c
call fcn.647264a8
mov esi, ecx
mov dword [ebp - 0x30], esi
mov ebx, dword [ebp + 8]
or edi, 0xffffffff
cmp ebx, edi
jne 0x6470f964
xor eax, eax
jmp 0x6470fac6
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x6470f98b
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x6470f98b
dec dword [edx]
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov byte [edx], bl
jmp 0x6470fac4
cmp dword [esi + 0x50], 0
jne 0x6470f998
mov eax, edi
jmp 0x6470fac6
mov ecx, esi
call fcn.6470f01b
xor eax, eax
cmp dword [esi + 0x40], eax
jne 0x6470f9b8
push dword [esi + 0x50]
push ebx
call fcn.6470c47b
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x6470f991
push eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], eax
push 8
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.6470b850
and dword [ebp - 4], 0
lea eax, [esi + 0x48]
mov dword [ebp - 0x40], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x40]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x40]
call dword [edi + 0x1c]
test eax, eax
js 0x6470fab1
cmp eax, 1
jg 0x6470fa90
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x6470fa66
push dword [esi + 0x50]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.6472634f
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x6470fab1
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov byte [esi + 0x45], 1
cmp dword [ebp - 0x38], eax
jne 0x6470fab4
test edx, edx
jne 0x6470f9e6
cmp dword [ebp - 0x18], 0x20
jae 0x6470fab1
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.6470b67f
jmp 0x6470f9e3
cmp eax, 3
jne 0x6470fab1
mov eax, dword [ebp - 0x30]
push dword [eax + 0x50]
push dword [ebp - 0x2c]
call fcn.6470c47b
pop ecx
pop ecx
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
mov ebx, ecx
jmp 0x6470fab4
or ebx, 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.647020ab
mov eax, ebx
call fcn.64726457
ret 4