joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a060
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.004a9460
mov eax, dword [0x532ab0]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x144]
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.0046c7a0
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jge 0x48a0c3
xor eax, eax
jmp 0x48a24d
lea ecx, [esp + 0x2c]
push ecx
call fcn.0049baa0
mov edx, dword [esp + 0x160]
add esp, 4
mov dword [esp + 0x18], edx
test edi, edi
jne 0x48a0e8
mov dword [esp + 0x148], edi
jmp 0x48a112
cmp dword [esp + 0x148], 0xffffffff
jne 0x48a112
mov eax, edi
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
jmp 0x48a100
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48a100
sub eax, dword [esp + 0x10]
mov dword [esp + 0x148], eax
test edx, edx
je 0x48a23b
jmp 0x48a128
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp edx, esi
jg 0x48a12e
mov esi, edx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
push 0
mov byte [esp + 0x18], dl
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x150]
mov ecx, ebx
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
lea ecx, [esp + 0x38]
push edi
push ecx
mov byte [esp + 0x2b], bl
call fcn.0049b7e0
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.0049b9e0
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.0049b9e0
push 0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.0049b9f0
push esi
lea eax, [esp + 0x138]
push eax
push ebp
call fcn.004a8d60
mov eax, dword [esp + 0x198]
add esp, 0x44
cmp eax, 1
jle 0x48a226
dec eax
mov dword [esp + 0x10], eax
jmp 0x48a1d0
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push edi
push edx
call fcn.0049bbb0
add esp, 0x1c
test esi, esi
jle 0x48a21f
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x48a210
mov edi, dword [esp + 0x28]
sub dword [esp + 0x10], 1
jne 0x48a1d0
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x48a120
lea eax, [esp + 0x2c]
push eax
call fcn.0049bb40
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a4ab5
add esp, 0x130
ret
Function at 0x49b7e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.004a9460
mov eax, dword [0x532ab0]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x49b82f
mov eax, 1
mov dword [esi], ebp
jmp 0x49b831
mov ebp, dword [esi]
test ecx, ecx
je 0x49b914
push ebp
call fcn.0046c780
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x49b860
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.00456e40
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x49b8b7
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.00475b20
add esp, 0xc
test eax, eax
je 0x49b9b6
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.00475cd0
add esp, 0xc
test eax, eax
je 0x49b9b6
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.00475ce0
add esp, 0xc
test eax, eax
je 0x49b9b6
jmp 0x49b8f1
cmp edi, 0x80
jbe 0x49b8d3
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.00456e40
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.004a8d60
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x49b91c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.004a96d0
add esp, 0xc
jmp 0x49b91c
test eax, eax
je 0x49b9a2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x49b920
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.00475b20
add esp, 0xc
test eax, eax
je 0x49b9b6
push ebp
call fcn.0046c780
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00475cd0
add esp, 0x10
test eax, eax
je 0x49b9b6
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x49b964
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.00475b20
add esp, 0xc
test eax, eax
je 0x49b9b6
push ebp
call fcn.0046c780
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00475cd0
add esp, 0x10
test eax, eax
je 0x49b9b6
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.00475e40
add esp, 8
test eax, eax
jne 0x49b9ba
xor eax, eax
jmp 0x49b9bf
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a4ab5
add esp, 0x8c
ret
Function at 0x49e660
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.004a9460
mov eax, dword [esp + 0x38]
push ebx
push edi
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
call fcn.0046c7a0
mov ebx, eax
add esp, 4
cmp ebx, edi
jl 0x49e8a1
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x49e727
mov esi, ebx
mov edi, dword [esp + 0x38]
mov ecx, dword [edi + 0x10]
push ebp
push ecx
call fcn.004560c0
mov ebp, eax
dec ebp
and ebp, 7
push edi
mov dword [esp + 0x24], ebp
call fcn.00451850
add esp, 8
mov edi, eax
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x49e6d9
mov eax, dword [esp + 0x40]
mov byte [eax], 0
inc eax
dec edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], edi
cmp esi, 0xfffffffe
jne 0x49e75b
mov esi, edi
sub esi, ebx
sub esi, 2
test esi, esi
jle 0x49e799
push 0xda
push str..crypto_rsa_rsa_pss.c
push esi
call fcn.00455a60
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x49e787
push 0xde
push str..crypto_rsa_rsa_pss.c
push 0x41
push 0x7d
push 4
call fcn.00452a00
add esp, 0x14
jmp 0x49e884
cmp esi, 0xfffffffe
jne 0x49e731
jmp 0x49e69d
jge 0x49e69d
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.00452a00
add esp, 0x14
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
lea edx, [ebx + esi + 2]
cmp edi, edx
jge 0x49e6e5
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.00452a00
add esp, 0x14
mov eax, dword [esp + 0x14]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
push esi
push ebp
call fcn.00458da0
add esp, 8
test eax, eax
jle 0x49e880
lea eax, [esp + 0x20]
sub edi, ebx
push eax
lea ebp, [edi - 1]
call fcn.00475ad0
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00475b20
push 8
lea eax, [esp + 0x34]
push 0x50d240
push eax
call fcn.00475cd0
mov ecx, dword [esp + 0x60]
push ebx
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00475cd0
add esp, 0x28
test esi, esi
je 0x49e7f4
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00475cd0
add esp, 0xc
mov edx, dword [esp + 0x40]
lea eax, [edx + ebp]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00475e10
lea ecx, [esp + 0x2c]
push ecx
call fcn.00475d60
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
push edx
push ebx
add eax, ebp
push eax
push ebp
mov ebp, dword [esp + 0x60]
push ebp
call fcn.004618a0
add esp, 0x24
test eax, eax
jne 0x49e880
sub edi, esi
xor byte [edi + ebp - 2], 1
lea eax, [edi + ebp - 2]
inc eax
test esi, esi
jle 0x49e856
xor ecx, ecx
test esi, esi
jle 0x49e856
mov edx, dword [esp + 0x10]
mov dl, byte [ecx + edx]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x49e847
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x49e86f
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
and byte [ebp], al
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp - 1], 0xbc
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x49e77b
push ebp
call fcn.00455c00
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x4c7028
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x532ab0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004aedc2
mov dword [ebp - 0x14], eax
cmp dword [0x53b6cc], edi
jne 0x4c7119
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4c70a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4c71f9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4c71f9
push 0x51445c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c71f9
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x53b6cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x53b6d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x51448c
push esi
mov dword [0x53b6d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x53b6dc], eax
test eax, eax
je 0x4c7116
push 0x5144a8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x53b6d8], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4c713e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4c7131
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4c7153
push 4
pop eax
jmp 0x4c71fb
cmp dword [ebp - 0x14], edi
je 0x4c7153
push dword [0x53b6cc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4c7138
mov eax, dword [0x53b6d8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4c71b1
cmp dword [0x53b6dc], esi
je 0x4c71b1
push eax
call ebx
push dword [0x53b6dc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4c71b1
test eax, eax
je 0x4c71b1
call ecx
test eax, eax
je 0x4c71a6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4c71a6
test byte [ebp - 8], 1
jne 0x4c71b1
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4c71e1
mov eax, dword [0x53b6d0]
cmp eax, esi
je 0x4c71de
push eax
call ebx
test eax, eax
je 0x4c71de
call eax
mov edi, eax
test edi, edi
je 0x4c71de
mov eax, dword [0x53b6d4]
cmp eax, esi
je 0x4c71de
push eax
call ebx
test eax, eax
je 0x4c71de
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x53b6cc]
call ebx
test eax, eax
je 0x4c71f9
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4c71fb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4ab5
leave
ret
Function at 0x4c9807
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004b4f57
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4c983f
xor eax, eax
jmp 0x4c986b
cmp esi, dword [ebp - 4]
je 0x4c9868
cmp dword [ebp + 0xc], 0
je 0x4c9868
push dword [edi + 0x9c]
call fcn.004c9415
push dword [edi + 0x9c]
mov esi, eax
call fcn.004b0022
pop ecx
pop ecx
cmp esi, eax
je 0x4c983b
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x712f3ee4
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x71316010]
and dword [ebp - 0x4c], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x10]
test eax, eax
push esi
push edi
mov dword [ebp - 0x58], eax
mov ebx, 0x80004002
je 0x712f3f19
and dword [eax], 0
xor eax, eax
mov edi, dword [eax*8 + 0x713160a8]
mov esi, dword [ebp - 0x54]
push 4
pop ecx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x712f3f8d
inc eax
cmp eax, 6
jb 0x712f3f1b
mov esi, dword [ebp - 0x54]
push 4
pop ecx
mov edi, 0x712f41d8
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x712f40b1
push 0xa
pop ecx
push 6
mov esi, 0x712f41b0
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x712f13b0
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x50], eax
mov edi, 0x80070000
jne 0x712f3fb8
call esi
test eax, eax
jg 0x712f3fa4
call esi
mov ebx, eax
jmp 0x712f3fb0
push dword [ebp - 0x58]
mov eax, dword [eax*8 + 0x713160ac]
push dword [ebp - 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx]
jmp 0x712f40b3
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, edi
test ebx, ebx
jl 0x712f4093
push 0x712f419c
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp - 0x60], eax
jne 0x712f3fed
call esi
test eax, eax
jg 0x712f3fd9
call esi
mov ebx, eax
jmp 0x712f3fe5
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, edi
test ebx, ebx
jl 0x712f4093
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x54]
call dword [ebp - 0x60]
mov ebx, eax
test ebx, ebx
jl 0x712f4093
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x4c]
push eax
push 0xf003f
push 0
push 0x712f4140
mov edi, 0x80000000
push edi
call esi
test eax, eax
jne 0x712f4093
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push 0
push 0
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x712f4093
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x4c]
push eax
push 0xf003f
push 0
push 0x712f40c8
push edi
call esi
test eax, eax
jne 0x712f4093
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push 0
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x50], 0
je 0x712f40a2
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x4c], 0
je 0x712f40b1
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.7131316b
leave
ret 0xc
Function at 0x712f957c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea eax, [esi + 0x68]
mov ecx, dword [eax]
cmp ecx, ebx
push edi
mov dword [ebp - 0x28], 0x712f3020
mov dword [ebp - 0x24], 0x712f966c
mov dword [ebp - 0x20], 0x712f31b8
mov dword [ebp - 0x1c], 0x712f2f6c
mov dword [ebp - 0x18], 0x712f9658
mov dword [ebp - 0x14], 0x712f2f50
mov dword [ebp - 0x10], 0x712f3190
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
lea edi, [esi + 0x60]
jne 0x712f95fc
lea ecx, [ebp - 4]
push ecx
push edi
push eax
lea eax, [esi + 0x64]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x6c]
push eax
xor eax, eax
cmp dword [esi + 0x58], ebx
sete al
push eax
mov eax, dword [esi + 0x54]
push dword [eax + 0x14]
push dword [esi + 8]
push dword [esi + 0x10]
call fcn.712f85b8
jmp 0x712f9613
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x712f3170
push ebx
push ecx
push dword [edi]
call sub.adsldpc.dll_LdapSearchS
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x712f9640
mov ecx, dword [esi + 0x3c]
lea eax, [esi + 0x6c]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [edi]
push dword [esi + 0x64]
call fcn.7130225d
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x712f9640
mov ecx, dword [esi + 0x3c]
call fcn.71301a8d
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x712f9650
push dword [ebp - 4]
call sub.adsldpc.dll_LdapMsgFree
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x71305535
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x78]
xor ebx, ebx
cmp ecx, ebx
push edi
mov dword [esi], 0x712f37f0
mov dword [esi + 0x24], 0x712f37e0
mov dword [esi + 0x28], 0x712f3790
mov dword [esi + 0x2c], 0x712f3748
mov dword [esi + 0x30], 0x712f3728
mov dword [esi + 0x34], 0x712f36f4
mov dword [esi + 0x38], 0x712f36c8
mov dword [esi + 0x3c], 0x712f3688
mov dword [esi + 0x40], 0x712f3660
mov dword [esi + 0x44], 0x712f365c
mov dword [esi + 0x48], 0x712f363c
mov dword [esi + 0x4c], 0x712f3628
je 0x7130559f
push 1
call fcn.7130448c
lea eax, [esi + 0x58]
push eax
call sub.OLEAUT32.dll_VariantCopy
lea eax, [esi + 0x68]
push eax
call sub.OLEAUT32.dll_VariantCopy
lea edi, [esi + 0x8c]
mov eax, dword [edi]
cmp eax, ebx
je 0x713055c5
push eax
call sub.adsldpc.dll_LdapCloseObject
mov dword [edi], ebx
lea edi, [esi + 0x84]
mov eax, dword [edi]
cmp eax, ebx
je 0x713055d9
push eax
call sub.ACTIVEDS.dll_FreeADsStr
mov dword [edi], ebx
lea edi, [esi + 0x88]
mov eax, dword [edi]
cmp eax, ebx
je 0x713055ed
push eax
call sub.ACTIVEDS.dll_FreeADsStr
mov dword [edi], ebx
mov ecx, dword [esi + 0x80]
cmp ecx, ebx
je 0x713055fe
push 1
call fcn.712f9126
mov ecx, dword [esi + 0x7c]
cmp ecx, ebx
je 0x7130560c
push 1
call fcn.712f914b
cmp dword [esi + 0xbc], ebx
je 0x71305648
xor edi, edi
cmp dword [esi + 0xc0], edi
jbe 0x7130563d
mov eax, dword [esi + 0xbc]
mov eax, dword [edi + eax]
test eax, eax
je 0x71305631
push eax
call sub.ACTIVEDS.dll_FreeADsStr
inc ebx
add edi, 0xc
cmp ebx, dword [esi + 0xc0]
jb 0x7130561e
push dword [esi + 0xbc]
call sub.ACTIVEDS.dll_FreeADsMem
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x713056a7
mov eax, dword [eax + 0x14]
test eax, eax
je 0x71305674
mov eax, dword [eax + 4]
test eax, eax
je 0x71305666
push eax
call sub.ACTIVEDS.dll_FreeADsMem
mov eax, dword [esi + 0xd4]
push dword [eax + 0x14]
call sub.ACTIVEDS.dll_FreeADsMem
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x7130569c
mov eax, dword [eax + 4]
test eax, eax
je 0x7130568e
push eax
call sub.ACTIVEDS.dll_FreeADsMem
mov eax, dword [esi + 0xd4]
push dword [eax + 0x18]
call sub.ACTIVEDS.dll_FreeADsMem
push dword [esi + 0xd4]
call sub.ACTIVEDS.dll_FreeADsMem
mov eax, dword [esi + 0xd8]
test eax, eax
je 0x713056b7
push eax
call sub.ACTIVEDS.dll_FreeADsStr
lea ecx, [esi + 0xe4]
call fcn.713145a3
pop edi
mov ecx, esi
pop esi
pop ebx
jmp 0x712f53b6
Function at 0x71309a74
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x71316010]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x234
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x420], ebx
call sub.ACTIVEDS.dll_AllocADsMem
cmp eax, ebx
mov dword [ebp - 0x424], eax
je 0x71309b91
push edi
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x71309ba8
push esi
mov dword [ebp - 0x420], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
lea ebx, [ebp - 0x20c]
cmp word [ebx], 0
je 0x71309b60
lea eax, [ebp - 0x414]
push ebx
push eax
call esi
pop ecx
pop ecx
push 0x21c
call sub.ACTIVEDS.dll_AllocADsMem
mov edi, eax
test edi, edi
je 0x71309b51
lea eax, [ebp - 0x414]
push eax
push edi
call esi
pop ecx
pop ecx
lea eax, [edi + 0x208]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
mov eax, dword [ebp - 0x418]
mov dword [edi + 0x218], eax
mov dword [ebp - 0x418], edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax*2 + 2]
test ebx, ebx
jne 0x71309afd
push dword [ebp - 0x41c]
mov edi, dword [ebp - 0x424]
push edi
call esi
pop ecx
pop ecx
lea eax, [edi + 0x208]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov eax, dword [ebp - 0x418]
mov dword [edi + 0x228], eax
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x424]
pop esi
pop ebx
call fcn.7131316b
leave
ret 8
Function at 0x71309dc9
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x71316010]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x210
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x220], esi
call sub.ACTIVEDS.dll_AllocADsMem
cmp eax, esi
mov dword [ebp - 0x214], eax
je 0x71309f4a
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push esi
push esi
push esi
xor eax, eax
push esi
mov ecx, 0x82
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x210], 0x104
call ebx
test eax, eax
jne 0x71309f39
lea eax, [ebp - 0x218]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x71309f4a
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call fcn.71309a74
mov edi, eax
cmp edi, esi
je 0x71309ec6
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [ebp - 0x220]
pop ecx
pop ecx
mov dword [edi + 0x230], eax
mov dword [ebp - 0x220], edi
cmp dword [ebp - 0x218], esi
je 0x71309eda
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push esi
xor eax, eax
inc dword [ebp - 0x21c]
push esi
push esi
mov ecx, 0x82
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], 0x104
push dword [ebp - 0x224]
call ebx
test eax, eax
je 0x71309e64
mov eax, dword [ebp - 0x220]
cmp eax, esi
je 0x71309f39
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 0x208], eax
jmp 0x71309f4a
push dword [ebp - 0x214]
call sub.ACTIVEDS.dll_FreeADsMem
mov dword [ebp - 0x214], esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
call fcn.7131316b
leave
ret 8