joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407840
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x54e810
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
push esi
xor edi, edi
push edi
push 0x4079c0
call fcn.005245c5
mov dword [esi + 0x39c], eax
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call fcn.0043a3a0
lea ecx, [esp + 0x30]
lea ebx, [esi + 0x208]
push ecx
mov dword [esp + 0x54], edi
call fcn.00409170
lea edx, [esp + 0x18]
push edx
call fcn.0043a3a0
lea eax, [esp + 0x18]
lea ebx, [esi + 0x220]
push eax
mov byte [esp + 0x54], 1
call fcn.00409170
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x407918
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x407918
push esi
mov eax, 0x5891a1
mov ecx, str.12030000
call fcn.00404b10
mov ecx, esi
call fcn.00405360
mov esi, dword [esi + 0x54]
cmp esi, edi
je 0x407927
call esi
jmp 0x407927
push esi
push edi
push 0x406dd0
call fcn.005245c5
add esp, 0xc
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x40794b
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
push ecx
push edx
call fcn.00410c40
mov eax, dword [esp + 0x2c]
push eax
call fcn.00450c1b
add esp, 0xc
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00450c1b
mov eax, dword [esp + 0x40]
add esp, 4
cmp eax, edi
je 0x407988
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x40]
push edx
push ecx
call fcn.00410c40
mov edx, dword [esp + 0x44]
push edx
call fcn.00450c1b
add esp, 0xc
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
call fcn.00450c1b
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x40c340
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x54965b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.005231b7
push 4
mov dword [esp + 0x24], 0
call fcn.00450bec
mov edi, eax
add esp, 4
test edi, edi
je 0x40c3c2
call fcn.005229dd
mov dword [edi], eax
call fcn.0052280b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0052272f
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40c3b7
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00522757
jmp 0x40c3c4
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x40fc20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x549e68
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.0040a880
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40fc80
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0040c550
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.0040a880
cmp dword [esp + 0x28], 8
jb 0x40fccd
mov eax, dword [esp + 0x14]
push eax
call fcn.00450c1b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x4119d0
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x54dd78
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x23c]
mov esi, ecx
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [esi], ebx
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x5891a1
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov byte [ecx + 4], bl
call fcn.0040c040
lea ecx, [esi + 0x2c]
mov dword [esp + 0x234], ebx
push ebx
mov edi, 7
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x5899a4
mov word [ecx + 4], dx
call fcn.0040c670
lea ebp, [esi + 0x50]
mov byte [esi + 0x48], bl
xor eax, eax
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], ax
lea edi, [esi + 0x6c]
mov byte [esp + 0x234], 2
xor ecx, ecx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push ebx
mov word [edi + 4], cx
push 0x5899a4
mov ecx, edi
call fcn.0040c670
push 0x206
lea eax, [esp + 0x22]
xor edx, edx
push ebx
mov byte [esp + 0x23c], 3
push eax
mov word [esp + 0x28], dx
call fcn.00523d70
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x1c]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x411ad4
sub eax, ecx
sar eax, 1
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, edi
call fcn.0040c670
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x4c], eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x411b03
sub eax, edx
sar eax, 1
push eax
push edi
mov ecx, ebp
call fcn.0040c670
call fcn.00411b80
mov ecx, esi
call fcn.00411cc0
test al, al
je 0x411b33
cmp dword [0x5b856c], ebx
jne 0x411b54
push 1
push str.ERROR
push 0x589cd8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, esi
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00523c4c
add esp, 0x224
ret 4
Function at 0x413be0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, ecx
test eax, eax
je 0x413ca6
test ebp, ebp
je 0x413ca6
mov ecx, dword [edi + 0x4c]
push ebx
push esi
push eax
movzx eax, word [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x413c9d
mov edx, dword [edi + 0x4c]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x413c9d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x18], eax
test eax, eax
je 0x413c9d
mov eax, dword [edi + 0x4c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x589d00
push ebp
mov ebx, eax
call fcn.00529763
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x413c9d
xor esi, esi
test ebx, ebx
jbe 0x413c8b
lea ebx, [ebx]
mov edi, ebx
sub edi, esi
cmp edi, 0x800
jbe 0x413c71
mov edi, 0x800
mov ecx, dword [esp + 0x18]
push ebp
push edi
lea edx, [esi + ecx]
push 1
push edx
call fcn.0052a3a4
add esi, edi
add esp, 0x10
cmp esi, ebx
jb 0x413c60
push ebp
call fcn.00529aae
add esp, 4
pop esi
pop ebx
pop edi
mov al, 1
pop ebp
ret 8
pop esi
pop ebx
pop edi
xor al, al
pop ebp
ret 8
pop edi
xor al, al
pop ebp
ret 8
Function at 0x414100
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x54cb12
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x589d98
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.00415020
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00415b40
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x5b8de0]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.00415450
test eax, eax
jne 0x4141f7
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x4141f0
or eax, 4
push ebx
push eax
call fcn.00401dc0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x415b40
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5495eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005231b7
push 4
mov dword [esp + 0x20], 0
call fcn.00450bec
mov edi, eax
add esp, 4
test edi, edi
je 0x415bbe
call fcn.005229dd
mov dword [edi], eax
call fcn.0052280b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0052272f
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x415bb3
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00522757
jmp 0x415bc0
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4181b0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x54de7b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
push 0x9c
call fcn.00450bec
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0
test eax, eax
je 0x418222
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
call fcn.00417bd0
jmp 0x418224
xor eax, eax
push eax
push 0
push 0x417e50
call fcn.005245c5
add esp, 0xc
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret

Function at 0x418510
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x54de7b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
push 0x5c
call fcn.00450bec
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0
test eax, eax
je 0x41856b
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
call fcn.00417d30
jmp 0x41856d
xor eax, eax
push eax
push 0
push 0x418260
call fcn.005245c5
add esp, 0xc
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret

Function at 0x4188f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54dd23
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], edi
call fcn.00450bec
add esp, 4
cmp eax, edi
je 0x418953
mov dword [eax], edi
jmp 0x418955
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.00450bec
add esp, 4
cmp eax, edi
je 0x418970
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x418972
xor eax, eax
xor edx, edx
mov ecx, esi
mov dword [esi + 0x64], eax
mov dword [esi + 0x58], edi
call fcn.004217f0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x41cac0
Capabilities:
Set registry value

Disassembly:
cmp dword [eax + 0x18], 8
mov edx, dword [eax + 0x14]
jb 0x41cace
mov eax, dword [eax + 4]
jmp 0x41cad1
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x41cadc
mov ecx, dword [ecx + 4]
jmp 0x41cadf
add ecx, 4
lea edx, [edx + edx + 2]
push edx
push eax
mov eax, dword [esp + 0xc]
push 1
push 0
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x41cb07
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
ret 4
mov al, 1
ret 4

Function at 0x41cb10
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x54a842
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.00527c00
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x1010], eax
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x101c]
mov dword fs:[0], eax
mov dword [esp + 8], 0
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [esp + 0x10], esi
mov edi, ecx
mov word [esi + 4], ax
push 0x1000
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x102c], eax
push ecx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0x1000
call fcn.00523d70
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x41cba3
mov edi, dword [edi + 4]
jmp 0x41cba6
add edi, 4
lea edx, [esp + 0xc]
push edx
mov edx, dword [ebx + 4]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cbd0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.0040c670
mov eax, esi
mov ecx, dword [esp + 0x101c]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.00523c4c
add esp, 0x1020
ret
Function at 0x41cc20
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x54b4ab
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x224], eax
push ebp
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24c]
xor edi, edi
xor esi, esi
push 0x200
lea eax, [esp + 0x38]
push edi
push eax
mov dword [esp + 0x20], 0x200
call fcn.00523d70
mov eax, dword [ebp + 4]
add esp, 0xc
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x48]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
jne 0x41cd09
xor ecx, ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41ccb7
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x20]
call fcn.0040c670
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x248], edi
call fcn.004090c0
mov dword [esp + 0x244], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x41cd10
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00450c1b
add esp, 4
jmp 0x41cd10
cmp eax, 0x103
je 0x41cd1d
inc esi
cmp esi, 0x400
jl 0x41cc65
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00523c4c
add esp, 0x238
ret 4
Function at 0x41ce60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x10c], eax
test byte [0x5b8eac], 1
mov eax, dword [esp + 0x11c]
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
jne 0x41cec8
or dword [0x5b8eac], 1
push 0x54f3c0
mov dword [0x5b8ea8], 0xf
mov dword [0x5b8ea4], 0
mov byte [0x5b8e94], 0
call fcn.0052519c
add esp, 4
cmp dword [0x5b8ea4], 0
jne 0x41cf2a
push 0x104
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.00523d70
add esp, 0xc
push 0
push 0x21
lea eax, [esp + 0x20]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41cf00
sub eax, edx
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x5b8e90
call fcn.0040c040
push 0x15
push str.BaasClientCookie.txt
mov eax, 0x5b8e90
call fcn.0040e300
call fcn.0048c850
push str.Content_Type:application_x_www_form_urlencoded_charsetUTF_8
push 0
mov esi, eax
call fcn.0048f700
mov ebx, eax
push ebx
push 0x2727
push esi
call fcn.0048c8e0
push 1
push 0x2f
push esi
call fcn.0048c8e0
push edi
push 0x2712
push esi
call fcn.0048c8e0
push ebp
push 0x271f
push esi
call fcn.0048c8e0
mov edx, dword [esp + 0x160]
push edx
push 0x3c
push esi
call fcn.0048c8e0
add esp, 0x44
cmp dword [esp + 0x130], 0
je 0x41cf97
push 1
push 0x2a
push esi
call fcn.0048c8e0
add esp, 0xc
mov edi, dword [esp + 0x10]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41cfa0
sub eax, edx
je 0x41cfb3
push edi
push 0x2726
jmp 0x41d02d
mov eax, dword [0x5b8e94]
mov edi, 0x10
cmp dword [0x5b8ea8], edi
jae 0x41cfca
mov eax, 0x5b8e94
push 0
push eax
call fcn.0052ac61
add esp, 8
test eax, eax
je 0x41cff4
mov eax, dword [0x5b8e94]
cmp dword [0x5b8ea8], edi
jae 0x41cfeb
mov eax, 0x5b8e94
call fcn.0041e030
test eax, eax
je 0x41d036
mov eax, dword [0x5b8e94]
cmp dword [0x5b8ea8], edi
jae 0x41d006
mov eax, 0x5b8e94
push eax
push 0x2762
push esi
call fcn.0048c8e0
mov eax, dword [0x5b8e94]
add esp, 0xc
cmp dword [0x5b8ea8], edi
jae 0x41d027
mov eax, 0x5b8e94
push eax
push 0x272f
push esi
call fcn.0048c8e0
add esp, 0xc
push 0
push 0x4e2c
push esi
call fcn.0048c8e0
push 0x44ebf0
push 0x4e2b
push esi
call fcn.0048c8e0
mov eax, dword [esp + 0x2c]
push eax
push 0x2711
push esi
call fcn.0048c8e0
push 1
push 0x63
push esi
call fcn.0048c8e0
push esi
call fcn.0048c910
push esi
mov edi, eax
call fcn.0048c9c0
push ebx
call fcn.0048f760
mov ecx, dword [esp + 0x158]
add esp, 0x3c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00523c4c
add esp, 0x110
ret
Function at 0x41d0a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x11c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x118], eax
test byte [0x5b8e8c], 1
mov eax, dword [esp + 0x128]
push ebp
mov ebp, dword [esp + 0x128]
push esi
mov esi, dword [esp + 0x128]
push edi
mov edi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
jne 0x41d10e
or dword [0x5b8e8c], 1
push 0x54f3f0
mov dword [0x5b8e88], 0xf
mov dword [0x5b8e84], 0
mov byte [0x5b8e74], 0
call fcn.0052519c
add esp, 4
xor eax, eax
push 3
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
call fcn.0048c7d0
push 0x11
push esi
push 0xa
push str.fileKey
push 1
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00490a30
add esp, 0x20
call fcn.0048c850
mov esi, eax
test esi, esi
je 0x41d2de
push edi
push 0x2712
push esi
call fcn.0048c8e0
mov ecx, dword [esp + 0x18]
push ecx
push 0x2728
push esi
call fcn.0048c8e0
push 0x44ebf0
push 0x4e2b
push esi
call fcn.0048c8e0
push ebp
push 0x2711
push esi
call fcn.0048c8e0
mov eax, ebx
add esp, 0x30
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d190
sub eax, edx
je 0x41d1a6
push ebx
push 0x2726
jmp 0x41d248
cmp dword [0x5b8e84], 0
jne 0x41d20a
push 0x104
lea edx, [esp + 0x24]
push 0
push edx
call fcn.00523d70
add esp, 0xc
push 0
push 0x21
lea eax, [esp + 0x28]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x20]
lea edx, [eax + 1]
jmp 0x41d1e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d1e0
sub eax, edx
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, 0x5b8e70
call fcn.0040c040
push 0x15
push str.BaasClientCookie.txt
mov eax, 0x5b8e70
call fcn.0040e300
mov eax, dword [0x5b8e74]
mov edi, 0x10
cmp dword [0x5b8e88], edi
jae 0x41d221
mov eax, 0x5b8e74
push eax
push 0x2762
push esi
call fcn.0048c8e0
mov eax, dword [0x5b8e74]
add esp, 0xc
cmp dword [0x5b8e88], edi
jae 0x41d242
mov eax, 0x5b8e74
push eax
push 0x272f
push esi
call fcn.0048c8e0
mov edi, dword [esp + 0x1c]
add esp, 0xc
test edi, edi
je 0x41d282
push 0
push 0x2b
push esi
call fcn.0048c8e0
push edi
push 0x4e58
push esi
call fcn.0048c8e0
mov edx, dword [esp + 0x2c]
push edx
push 0x2749
push esi
call fcn.0048c8e0
add esp, 0x24
push esi
call fcn.0048c910
mov edi, eax
add esp, 4
test edi, edi
je 0x41d2b1
push edi
call fcn.0048f7a0
add esp, 4
push eax
push str.curl_easy_perform___failed:__s_n
call fcn.0052aa23
add eax, 0x40
push eax
call fcn.0052acdd
add esp, 0xc
push esi
call fcn.0048c9c0
mov eax, dword [esp + 0x10]
push eax
call fcn.00490ca0
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.00523c4c
add esp, 0x11c
ret
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00523c4c
add esp, 0x11c
ret