joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b410
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push 0xf003f
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
jne 0x44b434
xor al, al
jmp 0x44b4cf
push edi
push 0xf01ff
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x44b4c5
mov esi, ebx
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x44b4be
cmp dword [esp + 0x14], 1
je 0x44b4bc
cmp dword [esp + 0x14], 4
je 0x44b482
cmp dword [esp + 0x14], 7
je 0x44b482
push 0xfa
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc esi
cmp esi, 0x3c
jb 0x44b44a
jmp 0x44b4be
lea eax, [esp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x44b4b5
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x44b4be
cmp dword [esp + 0x14], 1
je 0x44b4bc
push 0xfa
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc esi
cmp esi, 0x3c
jb 0x44b492
jmp 0x44b4be
mov bl, 1
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x44b4d6
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
je 0x44b629
push 4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x44b629
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
push 3
push 0x30
push edi
call ebx
test eax, eax
jne 0x44b540
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xea
jne 0x44b622
mov eax, dword [ebp - 8]
xor edx, edx
push 0x44d836
push 0x24
pop esi
div esi
xor ecx, ecx
inc eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004166c6
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
pop ecx
test esi, esi
je 0x44b622
mov eax, dword [ebp - 8]
xor edx, edx
push 0x24
pop ecx
div ecx
inc eax
imul eax, eax, 0x24
push eax
xor eax, eax
push eax
push esi
call fcn.004183a0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push 3
push 0x30
push edi
call ebx
test eax, eax
je 0x44b61b
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0xc], eax
jbe 0x44b61b
push 0x24
pop edi
lea ecx, [ebp - 0x234]
call fcn.0040b6e3
mov ecx, dword [esi]
test ecx, ecx
je 0x44b60d
lea eax, [ebp - 0x234]
push eax
call fcn.0044b2b2
test al, al
je 0x44b60d
mov ecx, dword [ebp + 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x14]
jne 0x44b5d9
sub ecx, edx
sar ecx, 1
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x234]
call fcn.00414791
test eax, eax
jne 0x44b60d
cmp dword [esi + 0xc], 1
je 0x44b60d
mov ecx, dword [esi]
test ecx, ecx
je 0x44b60d
call fcn.0044b410
inc ebx
add esi, edi
cmp ebx, dword [ebp - 0xc]
jb 0x44b5b2
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
push esi
call fcn.004166cf
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44b632
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
sub esp, 0x438
lea eax, [esp + 4]
push edi
mov edi, 0x22c
push edi
push 0
push eax
call fcn.004183a0
add esp, 0xc
cmp dword [esp + 0x440], 0
je 0x44b74d
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x44b74c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], edi
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x44b745
push ebp
push dword [esp + 0x18]
push 0
push 0x400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x44b730
push 0x104
lea eax, [esp + 0x240]
push eax
push ebp
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x44b729
lea eax, [esp + 0x23c]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
push dword [esp + 0x448]
lea eax, [esp + 0x240]
push eax
call fcn.0041779d
pop ecx
pop ecx
test eax, eax
je 0x44b729
push 0
call dword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x44b714
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x18]
je 0x44b71c
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x44b6f0
jmp 0x44b729
push 0
push 0
push 0x12
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x44b68b
pop ebp
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop edi
add esp, 0x438
ret 4
Function at 0x44b75b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88c
lea ecx, [esp + 4]
push ebx
push esi
push edi
call fcn.0040b6e3
lea ecx, [esp + 0x680]
call fcn.0040b6e3
push 0x208
xor edi, edi
lea eax, [esp + 0x22c]
push edi
push eax
call fcn.004183a0
add esp, 0xc
lea eax, [esp + 0x228]
push 0x103
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
mov esi, dword [ebp + 8]
test esi, esi
je 0x44b888
cmp word [esi], di
je 0x44b888
push esi
lea eax, [esp + 0x684]
push 0x463ee8
push eax
call fcn.0040c813
add esp, 0xc
lea eax, [esp + 0x430]
push eax
push dword [esp + 0x688]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44b888
test byte [esp + 0x430], 0x10
jne 0x44b86e
lea eax, [esp + 0x45c]
push eax
push esi
lea eax, [esp + 0x18]
push 0x45c788
push eax
call fcn.0040c813
mov edi, dword [esp + 0x24]
add esp, 0x10
test edi, edi
je 0x44b840
push dword [esp + 0x1c]
push edi
call fcn.00424c52
mov edi, dword [esp + 0x1c]
pop ecx
pop ecx
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x14]
call fcn.004112d4
test eax, eax
je 0x44b86e
push 0x45dc94
push edi
call fcn.0041779d
pop ecx
pop ecx
push eax
call fcn.0044b632
push esi
call fcn.0044b4d6
lea eax, [esp + 0x430]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x44b803
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b6e0
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], ecx
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], esi
cmp dword [ebx + 4], esi
jbe 0x401f31
nop
mov eax, edi
lea esi, [ebp - 0x138]
and eax, 1
mov ecx, ebx
lea esi, [esi + eax*2]
call fcn.004023c0
movzx eax, word [eax + edi*2]
push eax
call fcn.0042a528
xor word [esi], ax
inc edi
add esp, 4
cmp edi, dword [ebx + 4]
jb 0x401f00
mov esi, dword [ebp - 0x138]
mov eax, 4
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
mov word [ebp - 0x1a], ax
lea ecx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov byte [ebp - 0x18], 1
push 1
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.004065a0
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
push str.Local_
lea eax, [ebp - 0x134]
mov dword [ebp - 4], ecx
push 0x44ea78
push eax
call fcn.004063a0
push str.mutex_file_
lea eax, [ebp - 0x134]
push 0x44ea78
push eax
call fcn.004063a0
push esi
lea eax, [ebp - 0x134]
push str.0x_p
push eax
call fcn.004063a0
mov esi, dword [ebp - 0x13c]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x140]
add esp, 0x24
cmp byte [ebp - 0x18], 0
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
push esi
call fcn.004088b0
test al, al
jne 0x402012
push 0x44a6f8
mov ecx, esi
call fcn.00401e00
xor bl, bl
jmp 0x402014
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x40203d
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x40203d
push eax
call fcn.00429847
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421dd5
mov esp, ebp
pop ebp
ret 8
Function at 0x402580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov cl, byte [edi + 0x11c]
lea eax, [edi + 0xc]
test cl, cl
jne 0x4025a7
mov eax, dword [edi + 8]
cmp word [eax + 6], 0x3a
jne 0x40263f
lea eax, [edi + 0xc]
test cl, cl
jne 0x4025bc
mov eax, dword [edi + 8]
cmp word [eax + 8], 0
jne 0x40263f
push edi
lea ecx, [ebp - 0x24c]
call fcn.00406040
push 0x44a728
lea eax, [ebp - 0x24c]
push 0x44ea78
push eax
call fcn.004063a0
add esp, 0xc
lea eax, [ebp - 0x240]
cmp byte [ebp - 0x130], 0
cmove eax, dword [ebp - 0x244]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402611
xor bl, bl
jmp 0x402617
shr ebx, 4
and bl, 1
cmp byte [ebp - 0x130], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x402760
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
jmp 0x402753
push edi
lea ecx, [ebp - 0x128]
call fcn.00406040
mov al, byte [edi + 0x11c]
lea ecx, [edi + 0xc]
test al, al
jne 0x40265b
mov ecx, dword [edi + 8]
cmp word [ecx + 6], 0x3a
jne 0x402684
lea ecx, [edi + 0xc]
test al, al
jne 0x40266c
mov ecx, dword [edi + 8]
cmp word [ecx + 8], 0x5c
jne 0x402684
lea ecx, [edi + 0xc]
test al, al
jne 0x40267d
mov ecx, dword [edi + 8]
cmp word [ecx + 0xa], 0
je 0x4026cc
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4026cc
test al, al
lea eax, [edi + 0xc]
jne 0x402695
mov eax, dword [edi + 8]
cmp word [eax + ecx*2 + 2], 0x5c
jne 0x4026cc
push esi
lea esi, [ecx - 1]
push ecx
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x124], esi
call fcn.004065a0
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
xor ecx, ecx
mov word [eax + esi*2 + 4], cx
pop esi
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4026f2
xor bl, bl
jmp 0x402737
mov al, byte [edi + 0x11c]
lea ecx, [edi + 0xc]
test al, al
jne 0x402702
mov ecx, dword [edi + 8]
cmp word [ecx + 6], 0x3a
jne 0x402731
lea ecx, [edi + 0xc]
test al, al
jne 0x402713
mov ecx, dword [edi + 8]
cmp word [ecx + 8], 0x5c
jne 0x402731
test al, al
je 0x402723
add edi, 0xc
jmp 0x402726
mov edi, dword [edi + 8]
cmp word [edi + 0xa], 0
jne 0x402731
mov bl, 1
jmp 0x402737
shr ebx, 4
and bl, 1
cmp byte [ebp - 0xc], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x402760
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
cmp eax, ecx
je 0x402760
push eax
call fcn.00429847
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.00421dd5
mov esp, ebp
pop ebp
ret
Function at 0x402830
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b790
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
mov ebx, dword [ebp + 8]
jne 0x402872
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x402890
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40294c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0x11c], 0
mov edi, eax
lea eax, [esi + 0xc]
jne 0x4028b9
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40294c
shr eax, 4
not al
test al, 1
je 0x40294c
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4028e4
mov eax, dword [esi + 8]
push 0
push 0
push 0
push 0
push 0
add eax, 4
lea ecx, [ebp - 0x134]
push eax
call fcn.004020e0
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 0
push eax
push 0x44a73c
push edi
mov ecx, ebx
call fcn.004070f0
mov ecx, eax
call fcn.00407320
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x402948
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x402948
push eax
call fcn.00429847
add esp, 4
xor al, al
jmp 0x40294e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421dd5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402970
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b7db
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
call fcn.00402580
test al, al
je 0x4029b3
mov al, 1
jmp 0x402b48
lea ecx, [ebp - 0x134]
call fcn.00405f90
push 1
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.004065a0
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00402b70
test al, al
je 0x402a79
cmp dword [ebp - 0x130], 2
jb 0x402a61
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
test bl, bl
cmove eax, ecx
movzx edx, word [eax + 6]
lea eax, [ebp - 0x128]
cmove eax, ecx
movzx eax, word [eax + 8]
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x128]
cmove eax, ecx
movzx eax, word [eax + 0xa]
cmp edx, 0x3a
jne 0x402a61
cmp word [ebp - 0x25c], 0x5c
jne 0x402a61
test ax, ax
je 0x402a79
push 1
push 0
push edi
lea ecx, [ebp - 0x134]
call fcn.00402970
test al, al
je 0x402b09
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x402a88
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402b0d
cmp byte [esi + 0x11c], al
lea eax, [esi + 0xc]
jne 0x402aa6
mov eax, dword [esi + 8]
push 0
push 0
push 0
push 0
push 0
add eax, 4
lea ecx, [ebp - 0x258]
push eax
call fcn.004020e0
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 2
push eax
push 0x44a74c
mov ecx, edi
call fcn.00407180
mov ecx, eax
call fcn.00407320
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x402b09
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x402b09
push eax
call fcn.00429847
add esp, 4
xor bl, bl
jmp 0x402b1d
mov ecx, esi
call fcn.00402d30
mov ecx, esi
call fcn.00402ca0
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x402b46
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x402b46
push eax
call fcn.00429847
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421dd5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403280
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
mov edi, ecx
push str.Wintrust.dll
mov byte [edi], 0
call esi
push str.Crypt32.dll
mov dword [edi + 4], eax
call esi
mov ecx, dword [edi + 4]
mov dword [edi + 8], eax
test ecx, ecx
je 0x40338a
test eax, eax
je 0x40338a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinVerifyTrust
push ecx
call esi
push str.WTHelperProvDataFromStateData
push dword [edi + 4]
mov dword [edi + 0xc], eax
call esi
push str.WTHelperGetProvSignerFromChain
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push str.CertNameToStrW
push dword [edi + 8]
mov dword [edi + 0x14], eax
call esi
push str.CryptMsgClose
push dword [edi + 8]
mov dword [edi + 0x18], eax
call esi
push str.CryptMsgGetParam
push dword [edi + 8]
mov dword [edi + 0x20], eax
call esi
push str.CertCloseStore
push dword [edi + 8]
mov dword [edi + 0x1c], eax
call esi
push str.CertFindCertificateInStore
push dword [edi + 8]
mov dword [edi + 0x24], eax
call esi
push str.CertFreeCertificateContext
push dword [edi + 8]
mov dword [edi + 0x28], eax
call esi
push str.CertGetNameStringW
push dword [edi + 8]
mov dword [edi + 0x2c], eax
call esi
push str.CryptQueryObject
push dword [edi + 8]
mov dword [edi + 0x30], eax
call esi
cmp dword [edi + 0xc], 0
mov dword [edi + 0x34], eax
je 0x40338a
cmp dword [edi + 0x10], 0
je 0x40338a
cmp dword [edi + 0x14], 0
je 0x40338a
cmp dword [edi + 0x18], 0
je 0x40338a
cmp dword [edi + 0x20], 0
je 0x40338a
cmp dword [edi + 0x1c], 0
je 0x40338a
cmp dword [edi + 0x24], 0
je 0x40338a
cmp dword [edi + 0x28], 0
je 0x40338a
cmp dword [edi + 0x2c], 0
je 0x40338a
cmp dword [edi + 0x30], 0
je 0x40338a
test eax, eax
je 0x40338a
mov byte [edi], 1
pop edi
pop esi
ret
Function at 0x404130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b93e
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x150], edi
mov dword [ebp - 0x154], edi
mov dword [edi + 4], fcn.00429862
mov dword [edi + 8], fcn.00429ca4
mov dword [edi + 0xc], fcn.00429847
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x8000
mov dword [edi], vtable.common::t_heap.0
mov dword [ebp - 0x150], edi
mov dword [edi + 0x18], 0
mov byte [edi + 0x1c], 1
lea esi, [edi + 0x20]
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x158], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00421b46
xorps xmm0, xmm0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
movups xmmword [edi + 0x28], xmm0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 7
mov word [edi + 0x28], ax
mov dword [edi + 0x40], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14c]
mov dword [edi + 0x48], 0xffffffff
mov dword [edi + 0x4c], 0xffffffff
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], 1
call fcn.00405090
mov byte [ebp - 4], 2
cmp dword [ebp - 0x148], 0
je 0x40428e
cmp byte [ebp - 0x30], 0
lea eax, [ebp - 0x140]
cmove eax, dword [ebp - 0x144]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40428e
shr eax, 4
not al
test al, 1
je 0x40428e
cmp byte [ebp - 0x30], 0
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x28]
cmove eax, dword [ebp - 0x144]
add eax, 4
push eax
call fcn.00405550
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.004099c0
lea ecx, [ebp - 0x28]
call fcn.004054f0
cmp byte [ebp - 0x30], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4042b7
mov eax, dword [ebp - 0x144]
lea ecx, [ebp - 0x140]
cmp eax, ecx
je 0x4042b7
push eax
call fcn.00429847
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421dd5
mov esp, ebp
pop ebp
ret
Function at 0x404bb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ba30
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x45604c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [0x4599e4], 0
jne 0x404d60
call fcn.00407700
test al, al
jne 0x404d60
call fcn.00406780
test al, al
je 0x404d60
mov ecx, str.CheckSig1
call fcn.00408d10
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x134]
call fcn.004020e0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x128]
cmp byte [ebp - 0x18], 0
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404d2e
shr eax, 4
not al
test al, 1
je 0x404d2e
call fcn.00408da0
cmp byte [0x45fa99], 0
jne 0x404d08
push 0x114
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00423c20
push 0x114
lea eax, [ebp - 0x35c]
push 0
push eax
call fcn.00423c20
add esp, 0x18
lea edx, [ebp - 0x35c]
lea ecx, [ebp - 0x248]
call fcn.00407500
cmp dword [ebp - 0x244], 6
mov ecx, dword [ebp - 0x240]
ja 0x404cc1
jne 0x404d01
cmp ecx, 2
jae 0x404cca
jmp 0x404d01
mov byte [0x45fa98], 1
jne 0x404ce1
movzx eax, byte [0x45fa98]
cmp ecx, 3
mov edx, 1
cmovae eax, edx
mov byte [0x45fa98], al
mov eax, dword [ebp - 0x358]
cmp eax, 0xa
jae 0x404cfa
cmp eax, 6
jne 0x404d01
cmp dword [ebp - 0x354], 3
jb 0x404d01
mov byte [0x45fa98], 1
mov byte [0x45fa99], 1
sub esp, 8
mov ecx, esi
cmp byte [0x45fa98], 0
je 0x404d22
call fcn.004048d0
add esp, 8
mov esi, eax
jmp 0x404d33
call fcn.00404440
add esp, 8
mov esi, eax
jmp 0x404d33
mov esi, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x404d5c
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x404d5c
push eax
call fcn.00429847
add esp, 4
mov eax, esi
jmp 0x404d62
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421dd5
mov esp, ebp
pop ebp
ret