joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bd3a
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
push 0x44
pop edi
push edi
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 0x57
push 0
push eax
mov ebx, edx
mov esi, ecx
call sub.msvcrt.dll_memset
mov dword [ebp - 0x60], edi
xor eax, eax
lea edi, [ebp - 0x14]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x30], ax
or edi, 0xffffffff
inc eax
mov dword [ebp - 0x34], eax
test esi, esi
je 0x40bdef
xor ecx, ecx
mov dword [ebp - 0x64], eax
push ecx
push 0x80
push 2
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0xc
push eax
push ecx
push 0x40000000
push esi
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x40be48
push 2
push 1
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x40be2c
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
or dword [ebp - 0x34], 0x100
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
xor eax, eax
push eax
push eax
push 0x10
push 1
push eax
push eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40be3b
push 0x2bf20
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40be53
cmp eax, 0x102
jne 0x40be64
and dword [ebp - 4], 0
jmp 0x40be6d
push dword [ebp - 0x24]
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40be3b
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x40be6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x40beb3
cmp dword [ebp - 0x24], edi
je 0x40be94
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x20], edi
je 0x40bea5
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x28], edi
je 0x40beb3
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x40be41
Function at 0x40bebd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ecx]
push esi
push edi
xor esi, esi
jmp 0x40bfce
push 1
push 0x32
lea eax, [ebp - 0x288]
push eax
push 0x32
push 0x402fa8
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x40bfce
push 0x64
lea eax, [ebp - 0xf8]
push 0
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x13
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push 0x63
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x288]
push 0x403010
push eax
call dword [sym.imp.msvcrt.dll_swscanf_s]
add esp, 0x18
cmp eax, 2
jne 0x40bfce
push 1
push 0xb
lea eax, [ebp - 0x2c]
push eax
push 0xb
push 0x403020
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x40bfce
push 0x403038
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x40bfce
lea eax, [ebp - 0xf8]
mov edi, 0x200
push eax
push 0x403048
lea eax, [ebp - 0x688]
push edi
push eax
call fcn.00408514
add esp, 0x10
test eax, eax
js 0x40bfce
push edi
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0x688]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
jae 0x40bfc6
lea edx, [ebp - 0xa88]
xor ecx, ecx
call fcn.0040bd3a
jmp 0x40bfc9
push 0x57
pop eax
test eax, eax
jne 0x40bfce
inc esi
push ebx
lea eax, [ebp - 0x288]
push 0xc8
push eax
call dword [sym.imp.msvcrt.dll_fgetws]
add esp, 0xc
test eax, eax
jne 0x40bede
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret
Function at 0x40c48d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
push 0x42470c
xor edi, edi
push edi
push 0x18
push 0x403270
push 0x403280
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
mov ebx, 0x80070000
test esi, esi
jle 0x40c4d4
movzx esi, si
or esi, ebx
test esi, esi
js 0x40c574
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push 0x2001f
push edi
push 0x403308
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x40c504
movzx esi, si
or esi, ebx
test esi, esi
js 0x40c56b
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push edi
push 0x403380
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40c53b
movzx esi, si
or esi, ebx
test esi, esi
js 0x40c56b
mov eax, dword [0x42470c]
push dword [ebp - 0xc]
not eax
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
push edi
push 0x403380
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x40c56b
movzx esi, si
or esi, ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c9ad
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 4
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 1
push eax
push 0
push 2
push dword [0x4041f4]
call dword [sym.imp.iertutil.dll_Ordinal_654]
mov esi, eax
test esi, esi
js 0x40ca71
push ebx
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
push 0x403480
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40ca50
push 0x401f0c
lea eax, [ebp - 0x20c]
push eax
push 0x403494
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00408514
mov esi, eax
add esp, 0x14
test esi, esi
js 0x40ca50
push dword [0x4045cc]
lea edx, [ebp - 0x414]
call fcn.0040dbe3
mov esi, eax
test esi, esi
jns 0x40ca70
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
push 4
push eax
push 0
push 2
push dword [0x4041f4]
call dword [sym.imp.iertutil.dll_Ordinal_654]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00423440
mov esp, ebp
pop ebp
ret
Function at 0x40ca87
Capabilities:
Get common file path
Get program files directory
Get system information on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
mov esi, ecx
mov dword [ebp - 0x210], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x210], ebx
je 0x40cafd
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
push 0x4034f8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x40cb60
push 0x40353c
lea ecx, [ebp - 0x20c]
call fcn.0040ed30
test eax, eax
js 0x40cb60
mov edx, edi
jmp 0x40cb4c
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push ebx
push 0x26
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40cb60
push 0x403558
lea ecx, [ebp - 0x20c]
call fcn.0040ed30
test eax, eax
js 0x40cb60
push 0x40353c
lea ecx, [ebp - 0x20c]
call fcn.0040ed30
test eax, eax
js 0x40cb60
mov edx, 0x104
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004084a5
test eax, eax
js 0x40cb60
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret 8

Function at 0x40cc78
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov bl, dl
mov edi, ecx
call fcn.0040cb7a
mov esi, eax
test esi, esi
js 0x40cdaa
test bl, bl
jne 0x40ccb0
cmp byte [edi + 0xc], bl
je 0x40cdaa
lea eax, [ebp - 0x604]
push eax
push 0x20019
push 0
push dword [edi + 0x10]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x40ccda
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40cdaa
mov eax, dword [edi]
xor ebx, ebx
mov dword [ebp - 0x61c], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x618], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x614], eax
lea eax, [ebp - 0x600]
mov byte [ebp - 0x610], 1
mov dword [ebp - 0x60c], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x608]
mov dword [ebp - 0x608], 0xff
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push dword [ebp - 0x604]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jle 0x40cd4d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40cd89
lea eax, [ebp - 0x204]
push eax
push dword [edi + 0x10]
lea eax, [ebp - 0x600]
push 0x403f34
push 0x1fe
push eax
call fcn.00408514
mov esi, eax
add esp, 0x14
test esi, esi
js 0x40cd91
mov dl, 1
lea ecx, [ebp - 0x61c]
call fcn.0040cc78
mov esi, eax
jmp 0x40cd91
cmp esi, 0x80070103
je 0x40cd9c
inc ebx
test esi, esi
jns 0x40cd0f
jmp 0x40cd9e
xor esi, esi
push dword [ebp - 0x604]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret
Function at 0x40cf13
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
xor esi, esi
mov ebx, edx
cmp ax, word [edi + 4]
jae 0x40cf5f
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
movzx eax, si
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x40cf58
mov eax, dword [ebp - 4]
cmp byte [eax], 0
jne 0x40cf58
push ebx
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40cf6a
inc esi
cmp si, word [edi + 4]
jb 0x40cf2a
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor dl, dl
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 0x10]
mov al, byte [ecx + 1]
je 0x40cf82
or al, 3
mov byte [esi], 1
mov byte [ecx + 1], al
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov eax, edx
and eax, dword [ebp + 8]
cmp eax, dword [ebp + 8]
je 0x40cfa6
or edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 4]
mov byte [esi], 1
and byte [ecx + 1], 0xef
mov ecx, dword [ebp - 4]
or byte [ecx + 1], 3
mov al, 1
jmp 0x40cf61

Function at 0x40d663
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
test edi, edi
je 0x40d683
call fcn.0040d55b
mov ecx, edi
or ecx, 1
cmp eax, ecx
jne 0x40d6b7
and dword [ebp - 4], 0
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.0040d797
test eax, eax
js 0x40d6b7
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x40d6b7
xor esi, esi
jmp 0x40d787
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
mov edx, edi
push eax
call fcn.0040d497
mov esi, eax
test esi, esi
js 0x40d787
mov eax, dword [ebp - 4]
movzx eax, word [eax + 2]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40d779
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x40d75b
mov ecx, dword [ebp - 4]
lea esi, [edi + 0x14]
movzx eax, word [ecx + 2]
push eax
push ecx
push eax
push esi
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
push 0
push esi
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
test eax, eax
je 0x40d75b
push edi
push 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
je 0x40d736
xor esi, esi
jmp 0x40d74f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40d74d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40d770
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40d770
mov byte [eax], 1
jmp 0x40d770
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40d770
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40d77e
mov esi, 0x8007000e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40de8c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x4247bc], 0
jne 0x40dee6
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x4046b8
push reloc.SHLWAPI.dll_ParseURLW
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dee5
push esi
push esi
push esi
push esi
push 0x40474c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov dword [0x4247bc], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
cmp dword [0x4247bc], 1
sete al
mov esp, ebp
pop ebp
ret

Function at 0x40defb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4247b8], 0
push esi
jne 0x40df7d
call fcn.0040de8c
test eax, eax
je 0x40df73
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x4046b8
push reloc.SHLWAPI.dll_ParseURLW
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40df7d
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x404730
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40df68
cmp dword [ebp - 8], eax
sete al
inc eax
mov dword [0x4247b8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40df7d
mov dword [0x4247b8], 2
xor eax, eax
cmp dword [0x4247b8], 1
pop esi
sete al
mov esp, ebp
pop ebp
ret
Function at 0x40f2a1
Capabilities:
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x21
push ebx
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jne 0x40f3a6
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call sub.msvcrt.dll_wcsrchr
pop ecx
pop ecx
test eax, eax
je 0x40f2f2
xor ecx, ecx
mov word [eax], cx
push edi
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.004096fa
mov esi, eax
test esi, esi
jne 0x40f3a6
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov esi, eax
test esi, esi
je 0x40f32e
cmp esi, 0x50
je 0x40f32e
cmp esi, 0xb7
jne 0x40f399
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 0x2002
test edi, eax
jne 0x40f352
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x404820
lea ecx, [ebp - 0x20c]
call fcn.0040ed30
mov esi, eax
test esi, esi
js 0x40f3a6
push ebx
push ebx
push 3
mov dl, 1
lea ecx, [ebp - 0x20c]
call fcn.0040f246
mov esi, eax
test esi, esi
js 0x40f3a6
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40f3a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f3a6
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret
Function at 0x40f3be
Capabilities:
Get common file path
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov bl, dl
mov eax, 0x80070057
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x40f4b1
mov eax, dword [esi]
cmp eax, 6
jne 0x40f40c
cmp dword [ebp + 8], 0
je 0x40f40c
push dword [ebp + 8]
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.004084a5
jmp 0x40f435
cmp eax, 0xffffffff
jne 0x40f41c
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x40f439
lea ecx, [ebp - 0x20c]
or eax, 0x8000
push ecx
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40f4b1
cmp dword [esi + 0xc], 0
je 0x40f44d
push dword [esi + 0xc]
lea ecx, [ebp - 0x20c]
call fcn.0040ed30
test eax, eax
js 0x40f481
cmp dword [esi], 6
jne 0x40f463
call fcn.0040f7c1
test eax, eax
je 0x40f463
mov al, 1
jmp 0x40f465
xor al, al
test al, al
jne 0x40f47f
push edi
push dword [esi + 8]
mov dl, bl
lea ecx, [ebp - 0x20c]
push dword [esi + 4]
call fcn.0040f246
jmp 0x40f481
xor eax, eax
cmp dword [esi + 0x10], 0xffffffff
je 0x40f4b1
push dword [esi + 0x10]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40f49f
xor eax, eax
jmp 0x40f4b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40f4b1
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret 8
Function at 0x40f4c9
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x484
mov eax, dword [0x424004]
xor eax, esp
mov dword [esp + 0x480], eax
push ebx
mov bl, byte [ebp + 8]
lea eax, [esp + 7]
push esi
push edi
push eax
mov edi, ecx
mov byte [esp + 0x13], 0
push 0
mov dl, bl
mov dword [esp + 0x20], edi
call fcn.0040f3be
mov esi, eax
test bl, bl
je 0x40f51d
cmp byte [esp + 0xf], 0
jne 0x40f517
cmp byte [ebp + 0xc], 0
je 0x40f51d
mov al, 1
xor ebx, ebx
jmp 0x40f521
xor ebx, ebx
mov al, bl
mov byte [esp + 0x10], al
test esi, esi
js 0x40f69a
test al, al
je 0x40f69a
cmp dword [edi], 0xffffffff
jne 0x40f548
xor eax, eax
mov esi, ebx
mov word [esp + 0x280], ax
jmp 0x40f580
lea eax, [esp + 0x280]
push eax
push ebx
push ebx
push dword [edi]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x40f69a
push 0x40254c
lea eax, [esp + 0x284]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
cmp dword [edi + 0xc], 0
je 0x40f59f
push dword [edi + 0xc]
lea eax, [esp + 0x284]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
push 0x402538
lea eax, [esp + 0x284]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x40f69a
lea edi, [esp + 0x280]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, bx
jne 0x40f5e4
mov ebx, dword [esp + 0x18]
sub edi, ecx
push 0x2e
sar edi, 1
pop eax
cmp word [esp + 0x5c], ax
je 0x40f676
cmp word [esp + 0x5e], ax
je 0x40f676
xor eax, eax
mov word [esp + edi*2 + 0x27e], ax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x284]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x28]
or dword [esp + 0x28], 0xffffffff
add esp, 0xc
or dword [esp + 0x2c], 0xffffffff
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 8]
push dword [esp + 0x10]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x284]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
shr eax, 4
and al, 1
movzx eax, al
push eax
call fcn.0040f4c9
test esi, esi
js 0x40f676
test eax, eax
jns 0x40f676
mov esi, eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40f5fa
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x48c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00423440
mov esp, ebp
pop ebp
ret 8
Function at 0x40f6b8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov ebx, 0x4240f0
push edi
mov dword [ebp - 0x210], eax
xor edi, edi
push eax
push 1
mov ecx, ebx
call fcn.0040f4c9
mov esi, eax
test esi, esi
js 0x40f7a9
mov eax, dword [ebp - 0x210]
add edi, 0x14
add ebx, 0x14
cmp edi, 0xdc
jb 0x40f6df
xor edi, edi
mov ecx, dword [edi + 0x4049f0]
call fcn.0040f2a1
mov esi, eax
test esi, esi
js 0x40f7a9
add edi, 4
cmp edi, 0x10
jb 0x40f709
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40f794
push 0x404820
lea ecx, [ebp - 0x20c]
call fcn.0040ed30
mov esi, eax
test esi, esi
js 0x40f7a9
push 0
push 0
push 3
mov dl, 1
lea ecx, [ebp - 0x20c]
call fcn.0040f246
mov esi, eax
test esi, esi
js 0x40f7a9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f794
or eax, 0x2000
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40f7a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f7a9
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423440
mov esp, ebp
pop ebp
ret

Function at 0x40f7c1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x4247c0]
test ecx, ecx
jne 0x40f81a
push 1
push 6
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40f814
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
mov ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 2
mov dword [0x4247c0], ecx
jmp 0x40f81a
mov ecx, dword [0x4247c0]
xor eax, eax
cmp ecx, 1
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.00423440
mov esp, ebp
pop ebp
ret

Function at 0x4105a0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push esi
push edi
push 4
mov edi, ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x4105cc
and dword [esi], 0
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
jmp 0x4105ce
xor esi, esi
mov dword [edi + 0x14], esi
test esi, esi
je 0x410602
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4105eb
mov eax, dword [edi + 0x14]
mov dword [ecx], eax
jmp 0x4105ed
xor ecx, ecx
mov dword [edi + 0x10], ecx
neg ecx
sbb ecx, ecx
and ecx, 0x7ff8fff2
add ecx, 0x8007000e
jmp 0x410607
mov ecx, 0x8007000e
pop edi
mov eax, ecx
pop esi
ret