joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41da60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564c08
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x70], eax
push 1
push dword [edi + 0x10]
lea ecx, [ebp - 0x20]
call fcn.0049bd60
mov dword [ebp - 4], 0
lea eax, [ebp + 0x20]
push eax
lea ecx, [edi + 8]
call fcn.0041d170
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x20]
push eax
lea ecx, [edi + 8]
call fcn.0041d170
mov bl, byte [eax + 4]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0049bd90
test bl, bl
jne 0x41dc35
mov dword [ebp - 4], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x68], eax
mov eax, dword [edi + 4]
push dword [ebp - 0x78]
push dword [ebp - 0x70]
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push dword [ebp + 0xc]
push dword [ebp - 0x80]
mov eax, dword [eax + 0x40]
call eax
mov bl, al
call esi
sub eax, dword [ebp - 0x68]
cmp eax, 0x1388
jbe 0x41dbbd
call esi
sub eax, dword [ebp - 0x68]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00425090
mov byte [ebp - 4], 2
push eax
push str.Warning__spent
lea eax, [ebp - 0x5c]
push eax
call fcn.00407110
mov byte [ebp - 4], 3
push str._ms_inside_DLL__DataBeforeSendA__
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00407080
add esp, 0x20
mov byte [ebp - 4], 4
push 0
push eax
call fcn.004453e0
mov ecx, eax
call fcn.004484e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004050f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.004050f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.004050f0
test bl, bl
je 0x41dbf5
cmp dword [ebp - 0x60], 0
je 0x41dbf5
push dword [ebp - 0x64]
call fcn.004acf15
mov ecx, dword [ebp - 0x74]
mov dword [ecx], eax
push dword [ebp - 0x64]
push dword [ebp - 0x60]
push eax
call fcn.004ae030
add esp, 0x10
push dword [ebp - 0x60]
mov ecx, edi
call fcn.0041dc60
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx], eax
mov al, bl
jmp 0x41dc37
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4212b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x601280], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x420dc0
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x421060
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.00420d70
jne 0x421432
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x421428
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004af07e
push str.ws2_32
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004b0143
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x421388
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x4213dd
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004af07e
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004b0143
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421425
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x4213dd
push edi
call esi
jmp 0x421425
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x42141e
inc esi
cmp esi, 3
jl 0x4213e0
mov eax, dword [ebp - 0x22c]
mov dword [0x5f3e94], eax
mov eax, dword [ebp - 0x224]
mov dword [0x5f3e9c], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.00420d70], eax
jmp 0x421425
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x601280], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [eax*8 + 0x5f3e94]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret 4
Function at 0x4216c0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
mov dword [edi], 0
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x42174e
cmp word [ebx + 8], 2
push esi
jne 0x421722
cmp word [ebx + 0xa], 4
jne 0x421722
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x421722
jmp 0x421700
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004215f0
mov dword [edi], eax
test eax, eax
je 0x421742
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x421700
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x18]
call fcn.004b02db
add esp, 0x10
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
pop esi
pop edi
mov eax, 8
pop ebx
pop ebp
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x42175e.11001
jmp dword [eax*4 + 0x421788]
pop edi
mov eax, 0x2af9
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afa
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afb
pop ebx
pop ebp
ret 0x18
Function at 0x428ab0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5667bd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 4]
mov dword [edi], vtable.CHTTPFilter.0
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00469190
mov dword [esi], eax
mov dword [ebp - 4], 4
mov byte [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov byte [ebp - 4], 5
lea esi, [edi + 0x20]
mov byte [edi + 0x1c], 0
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00469190
mov dword [esi], eax
mov byte [ebp - 4], 0xa
lea esi, [edi + 0x28]
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00469190
mov dword [esi], eax
mov byte [ebp - 4], 0xf
lea esi, [edi + 0x30]
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00469190
mov dword [esi], eax
mov byte [ebp - 4], 0x14
mov dword [edi + 0x4c], 0xf
mov dword [edi + 0x48], 0
mov byte [edi + 0x38], 0
mov byte [ebp - 4], 0x15
mov byte [edi + 0x50], 1
mov dword [edi + 0x68], 0xf
mov dword [edi + 0x64], 0
mov byte [edi + 0x54], 0
mov byte [ebp - 4], 0x16
mov word [edi + 0x6c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42c080
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566fe0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CHTTPHeader.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x14]
mov word [edi + 0x10], 0
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00469190
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x1c]
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00469190
mov dword [esi], eax
mov byte [ebp - 4], 0xa
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [ebp - 4], 0xb
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov byte [ebp - 4], 0xc
xor eax, eax
mov word [edi + 0x3c], ax
mov dword [edi + 0x54], 0xf
mov dword [edi + 0x50], eax
mov byte [edi + 0x40], al
mov byte [ebp - 4], 0xd
mov dword [edi + 0x6c], 0xf
mov dword [edi + 0x68], eax
mov byte [edi + 0x58], al
mov byte [ebp - 4], 0xe
mov dword [edi + 0x84], 0xf
mov dword [edi + 0x80], eax
mov byte [edi + 0x70], al
mov byte [ebp - 4], 0xf
mov al, byte [ebp + 8]
mov byte [edi + 0x88], al
mov byte [edi + 0x89], 0
mov dword [edi + 0xa0], 0xf
mov dword [edi + 0x9c], 0
mov byte [edi + 0x8c], 0
mov byte [ebp - 4], 0x10
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
mov byte [ebp - 4], 0x11
mov byte [edi + 0xb0], 0
mov dword [edi + 0xb4], 0
mov dword [edi + 0xb8], 0
mov word [edi + 0xbc], 0
mov byte [edi + 0xbe], 0
mov dword [edi + 0xc0], 0
mov word [edi + 0xc4], 1
mov dword [edi + 0xdc], 0xf
mov dword [edi + 0xd8], 0
mov byte [edi + 0xc8], 0
mov byte [ebp - 4], 0x12
mov al, byte [ebp + 0xc]
mov word [edi + 0xe0], 0
mov byte [edi + 0xe2], al
mov dword [edi + 0xf8], 0xf
mov dword [edi + 0xf4], 0
mov byte [edi + 0xe4], 0
mov byte [ebp - 4], 0x13
mov dword [edi + 0xfc], 0
mov byte [edi + 0x100], 0
mov dword [edi + 0x108], 1
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
cmp eax, 0x1000
jae 0x42c29a
push 0x1000
lea ecx, [edi + 4]
call fcn.004054e0
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
mov dword [edi + 0x104], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e860
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569aa2
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xac], 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov dword [ebp - 0xb0], edi
mov byte [edi], 0
mov dword [ebp - 4], 0
push 0xf0000020
push 1
push 0
push 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xac], 1
mov dword [ebp - 0xa8], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x43e9cd
lea eax, [ebp - 0xa0]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x43e9c4
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x43e9bb
push 0
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x9c]
push eax
push 2
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x43e9ad
xor esi, esi
jmp 0x43e960
movzx eax, byte [ebp + esi - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push str._02x
push eax
call fcn.004afd67
add esp, 0xc
cmp byte [ebp - 0x1c], 0
jne 0x43e984
xor eax, eax
jmp 0x43e999
lea eax, [ebp - 0x1c]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43e990
sub eax, edx
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00405750
inc esi
cmp esi, 0x10
jl 0x43e960
jmp 0x43e9db
push str.Error_getting_hash_param
mov ecx, edi
call fcn.0040a160
jmp 0x43e9db
push 0x12
push str.Error_hashing_data
jmp 0x43e9d4
push 0x13
push str.Error_creating_hash
jmp 0x43e9d4
push 0x17
push str.Error_acquiring_context
mov ecx, edi
call fcn.004059b0
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret
Function at 0x43f0e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569c82
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
cmp byte [ebp + 0xc], al
mov dword [ebp - 0x21c], 0
mov word [ebp - 0x218], ax
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], ebx
push eax
jne 0x43f143
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x43f185
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x43f152
mov eax, dword [0x583288]
mov dword [ecx], eax
mov eax, dword [0x58328c]
mov dword [ecx + 4], eax
mov eax, dword [0x583290]
mov dword [ecx + 8], eax
mov eax, dword [0x583294]
mov dword [ecx + 0xc], eax
mov eax, dword [0x583298]
mov dword [ecx + 0x10], eax
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x43f190
mov eax, dword [0x57e5d0]
mov dword [edi], eax
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x43f1b0
mov ecx, 7
mov esi, str.LTVSrvOff.ini
lea eax, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, ebx
call fcn.004038b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret 8
Function at 0x43f430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569d20
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.004a3cb0
mov byte [ebp - 4], 1
xor esi, esi
mov dword [ebp - 0x38], esi
cmp esi, 9
jae 0x43f497
lea eax, [esi*2 + 1]
add eax, esi
lea ecx, [ebx + eax*4]
mov eax, dword [ecx]
lea edx, [ebp - 0x4c]
push edx
call dword [eax]
inc esi
jmp 0x43f478
push str.sdfsdf890890ji3245kl3245
lea ecx, [ebp - 0x2c]
call fcn.00405090
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004a3e00
push eax
lea ecx, [ebp - 0x4c]
call fcn.004a3df0
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.0043eff0
mov ebx, eax
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004050f0
cmp dword [edi + 0x14], 8
jb 0x43f4e2
mov edi, dword [edi]
push 0x57e5fc
push edi
call fcn.004ad4a2
add esp, 8
mov edi, eax
test edi, edi
jne 0x43f503
mov byte [ebp - 4], al
lea ecx, [ebp - 0x4c]
call fcn.004a3d20
jmp 0x43f543
push edi
mov esi, dword [ebp - 0x34]
push esi
push 1
push ebx
call fcn.004ad424
cmp eax, esi
sete bl
push dword [ebp - 0x30]
call fcn.004af1a1
push edi
call fcn.004ad256
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.004a3d20
mov al, bl
jmp 0x43f545
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret 4
Function at 0x4415c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569fd4
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5f7448]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.COperationsManager.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [edi + 0x30], 1
mov dword [edi + 0x34], 0
mov byte [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov word [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
xor eax, eax
mov dword [edi + 0x74], 7
mov dword [edi + 0x70], 0
mov word [edi + 0x60], ax
mov dword [ebp - 4], eax
lea esi, [edi + 0x78]
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.00448690
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x80]
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00448750
mov dword [esi], eax
mov byte [ebp - 4], 0xa
push 0
push 0
push 0
push 0
call fcn.0049bea0
add esp, 0x10
mov dword [edi + 0x5c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4452a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56aa3d
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x238], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x23c], esi
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x218]
push eax
push 2
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x234], 0x104
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x4453b4
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0045ef30
add esp, 8
mov edi, eax
mov dword [ebp - 4], 1
cmp esi, edi
je 0x44537c
cmp dword [esi + 0x14], 8
jb 0x445361
push dword [esi]
call fcn.004ad196
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push edi
mov ecx, esi
mov word [esi], ax
call fcn.00403a40
mov byte [ebp - 4], 0
cmp dword [ebp - 0x21c], 8
jb 0x445397
push dword [ebp - 0x230]
call fcn.004ad196
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret 4
Function at 0x4453f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56aa7b
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
push 0x5876dc
mov ecx, eax
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x43c], 0
call fcn.004040e0
lea eax, [ebp - 0x43c]
push eax
push esi
xor edi, edi
call fcn.00444b40
add esp, 8
mov dword [ebp - 0x440], eax
test eax, eax
jne 0x4454e9
push 0x2a
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x424], edi
push str.GetProviders:_Unable_to_enumerate_catalog_
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 0xf
mov dword [ebp - 0x428], edi
mov byte [ebp - 0x438], al
call fcn.004059b0
mov dword [ebp - 4], edi
push edi
lea eax, [ebp - 0x438]
push eax
mov ecx, 0x6015a8
call fcn.00448360
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x424], 0x10
jb 0x4454c9
push dword [ebp - 0x438]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x424], 0xf
mov dword [ebp - 0x428], 0
mov byte [ebp - 0x438], 0
jmp 0x4455da
mov ebx, dword [ebp - 0x43c]
test ebx, ebx
jle 0x4455d1
lea esi, [eax + 0x74]
lea ebx, [ebx]
cmp dword [esi - 0x4c], 0
jne 0x4455be
push 0x5838c4
push esi
call fcn.004b0d95
add esp, 8
test eax, eax
jne 0x4455bb
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [esi - 0x60]
push eax
or edi, 1
mov dword [ebp - 0x43c], 0x103
call sub.WS2_32.dll_WSCGetProviderPath
cmp eax, 0xffffffff
je 0x4455be
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4455be
cmp word [ebp - 0x218], 0
jne 0x44558e
mov ecx, dword [ebp - 0x444]
xor eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004040e0
jmp 0x4455be
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445597
mov ecx, dword [ebp - 0x444]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004040e0
jmp 0x4455be
or edi, 2
add esi, 0x274
dec ebx
jne 0x445500
mov eax, dword [ebp - 0x440]
push eax
call fcn.004af1a1
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret
Function at 0x445c90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ab89
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x5f7448]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ax, word [0x5839e4]
movq xmm0, qword [str.LTVSrv.log]
mov word [ebp - 0x14], ax
mov al, byte [0x5839e6]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
movq qword [ebp - 0x1c], xmm0
mov byte [ebp - 0x12], al
mov dword [ebp - 0x124], 0xf
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x138], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [ebp - 0x120], 0
jne 0x445d32
xor ecx, ecx
jmp 0x445d49
lea ecx, [ebp - 0x120]
lea edx, [ecx + 1]
jmp 0x445d40
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445d40
sub ecx, edx
push ecx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.004059b0
cmp byte [ebp - 0x1c], 0
jne 0x445d66
xor ecx, ecx
jmp 0x445d79
lea ecx, [ebp - 0x1c]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445d70
sub ecx, edx
push ecx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x138]
call fcn.00405750
push 0x34
call fcn.004ad19b
add esp, 4
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x445daa
mov ecx, eax
call fcn.0049dcd0
jmp 0x445dac
xor eax, eax
mov byte [ebp - 4], 0
push 1
mov ecx, eax
mov dword [esi + 0x10], eax
call fcn.0049d5a0
mov ecx, dword [esi + 0x10]
lea eax, [ebp - 0x138]
push eax
call fcn.0049de60
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x124], 0x10
jb 0x445de9
push dword [ebp - 0x138]
call fcn.004ad196
add esp, 4
mov dword [ebp - 0x124], 0xf
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x138], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004adbd4
mov esp, ebp
pop ebp
ret