joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a110
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5cfd1b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov eax, dword [0x66a8c4]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa8]
push 0x63
lea eax, [esp + 0x35]
push 0
mov dword [esp + 0x18], 0
push eax
mov byte [esp + 0x3c], 0
call fcn.00591690
lea ecx, [esp + 0x20]
push esi
push ecx
mov dword [esp + 0x24], 0x64
call fcn.0041a540
add esp, 0x14
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x34]
push ecx
push edi
mov ecx, eax
call fcn.00403c80
mov ecx, eax
mov edx, reloc.WS2_32.dll_accept
call fcn.0042c7d0
add esp, 0xc
lea ecx, [esp + 0x14]
mov bl, al
call fcn.00403d10
test bl, bl
je 0x41a1ec
lea ecx, [esp + 0xf]
call fcn.005bede0
mov dword [esp + 0xa0], 0
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x17]
call fcn.005bee60
lea ecx, [esp + 0xf]
mov dword [esp + 0xa0], 0xffffffff
call fcn.005bedd0
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.00404560
mov eax, ebp
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00590c4b
add esp, 0x98
ret

Function at 0x41a600
Capabilities:
Get common file path
Get file version info

Disassembly:
sub esp, 0x214
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x12]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x18], ax
call fcn.00591690
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x41a65d
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00590c4b
add esp, 0x214
ret
push esi
push 0x6031ac
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
lea ecx, [esp + 0x14]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x41a6ce
push edi
push esi
call fcn.004edb78
add esp, 4
mov edi, eax
push edi
push esi
push ebx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41a6c4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x602b08
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41a6c4
mov edx, dword [esp + 0xc]
mov ebx, dword [edx + 8]
push edi
call fcn.00591683
add esp, 4
pop edi
mov ecx, dword [esp + 0x218]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00590c4b
add esp, 0x214
ret
Function at 0x41b3d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d0550
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov eax, dword [0x66a8c4]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
mov esi, edx
lea edx, [eax + 0x38]
push edx
push eax
lea ebx, [esp + 0x30]
call fcn.0041b470
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0
call fcn.00403ca0
lea eax, [esp + 0xc]
push eax
mov ecx, ebx
push ecx
mov byte [esp + 0x58], 1
call fcn.004302e0
add esp, 8
lea ecx, [esp + 0xc]
mov bl, al
call fcn.00403d10
lea ecx, [esp + 0x28]
call fcn.00403d10
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00590c4b
add esp, 0x48
ret 4

Function at 0x41b870
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x5d04a8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x66a8c4]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x80]
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x50]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
call fcn.00403ca0
cmp byte [esp + 0x84], 0
mov dword [esp + 0x78], edi
je 0x41b944
push str..MD5
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.004031b0
add esp, 0xc
mov edi, eax
lea esi, [esp + 0x34]
mov byte [esp + 0x78], 1
call fcn.0041b7f0
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x7c], 2
call fcn.004013f0
mov ecx, esi
call fcn.00403d10
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 0
call fcn.00403d10
mov ecx, ebp
call fcn.00403c80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41b940
lea ecx, [esp + 0x50]
push ecx
push ebp
call fcn.005c3f50
add esp, 8
test al, al
je 0x41b940
push ebp
mov ecx, ebx
call fcn.00403cd0
jmp 0x41b976
mov esi, dword [esp + 0x10]
push esi
mov eax, ebp
call fcn.00430420
add esp, 4
test al, al
je 0x41b96f
cmp byte [esp + 0x84], 0
je 0x41b936
lea edx, [esp + 0x50]
push edx
push ebp
call fcn.005c3f50
add esp, 8
test al, al
jne 0x41b936
mov ecx, ebx
call fcn.00403ca0
lea ecx, [esp + 0x50]
call fcn.00403d10
mov eax, ebx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00590c4b
add esp, 0x6c
ret
Function at 0x41bdc0
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x5cf768
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push esi
mov eax, dword [0x66a8c4]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov esi, ecx
call fcn.005be610
test al, al
je 0x41beb2
push str.city
lea ecx, [esp + 0x4c]
call fcn.00404560
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x68]
push ecx
mov ecx, esi
mov dword [esp + 0x94], 0
call fcn.005beb40
push eax
mov ecx, edi
mov byte [esp + 0x90], 1
call fcn.004013f0
lea ecx, [esp + 0x64]
call fcn.00403d10
lea ecx, [esp + 0x48]
mov dword [esp + 0x8c], 0xffffffff
call fcn.00403d10
mov ecx, edi
call fcn.00408810
test al, al
jne 0x41beb2
push str.time
lea ecx, [esp + 0x4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.00404560
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, esi
mov dword [esp + 0x94], 2
call fcn.005bea10
lea ecx, [esp + 0x48]
call fcn.00403d10
lea ecx, [esp + 0x30]
call fcn.00408ab0
cmp eax, 8
je 0x41beb9
lea ecx, [esp + 0x30]
call fcn.00408a70
xor al, al
jmp 0x41bf6e
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x34]
lea esi, [esp + 0x10]
call fcn.004090b0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
call fcn.004b7dc0
push eax
lea ecx, [esp + 0x1c]
call fcn.004c00c0
test al, al
je 0x41bf21
lea ecx, [esp + 0x18]
call fcn.0040f7b0
mov al, byte [eax]
push 0
lea ecx, [esp + 0x2c]
push ecx
mov byte [esi], al
lea ecx, [esp + 0x20]
inc esi
call fcn.0040f7d0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
call fcn.004b7dc0
push eax
lea ecx, [esp + 0x1c]
call fcn.004c00c0
test al, al
jne 0x41bee7
push 0
call fcn.00591a30
xor ecx, ecx
add esp, 4
sub eax, dword [esp + 0xc]
sbb ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
fild qword [esp + 0xc]
lea ecx, [esp + 0x30]
fdiv qword [0x609590]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fild dword [esp + 0x94]
fcompp
fnstsw ax
test ah, 5
jnp 0x41bead
call fcn.00408a70
mov al, 1
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x88
ret 4
Function at 0x41c610
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x420
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov ebx, edx
mov word [esp + 0x1c], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x222]
push eax
mov word [esp + 0x224], dx
call fcn.00591690
add esp, 0xc
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
mov ecx, 0x603380
call fcn.00421700
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
test al, al
je 0x41c6ec
lea eax, [esp + 0x10]
lea edx, [eax + 2]
jmp 0x41c690
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c690
sub eax, edx
sar eax, 1
je 0x41c6ec
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x18]
xor ecx, ecx
push 0x5c
push edx
mov word [eax], cx
call fcn.00593545
lea edx, [esp + 0x20]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x22c]
push str._sUser_DataDefaultCookies
push eax
call edi
add esp, 0x1c
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41c759
push reloc.WS2_32.dll_accept
lea esi, [esp + 0x14]
mov ecx, str.360se6
call fcn.0041cc50
test al, al
jne 0x41c716
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, str.360se6
call fcn.0041cc50
test al, al
je 0x41c77d
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c720
sub eax, edx
sar eax, 1
je 0x41c77d
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x18]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x224]
push str._sUser_DataDefaultCookies
push eax
call edi
add esp, 0x14
lea esi, [esp + 0x218]
call fcn.0041d0d0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00590c4b
add esp, 0x420
ret
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00590c4b
add esp, 0x420
ret
Function at 0x41c7a0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x420
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov ebx, edx
mov word [esp + 0x1c], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x222]
push eax
mov word [esp + 0x224], dx
call fcn.00591690
add esp, 0xc
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
mov ecx, str.360
call fcn.00421700
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
test al, al
je 0x41c87c
lea eax, [esp + 0x10]
lea edx, [eax + 2]
jmp 0x41c820
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c820
sub eax, edx
sar eax, 1
je 0x41c87c
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x18]
xor ecx, ecx
push 0x5c
push edx
mov word [eax], cx
call fcn.00593545
lea edx, [esp + 0x20]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x22c]
push str._sUser_DataDefaultCookies
push eax
call edi
add esp, 0x1c
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41c8e9
push reloc.WS2_32.dll_accept
lea esi, [esp + 0x14]
mov ecx, 0x6033d0
call fcn.0041cc50
test al, al
jne 0x41c8a6
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, 0x6033d0
call fcn.0041cc50
test al, al
je 0x41c90d
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c8b0
sub eax, edx
sar eax, 1
je 0x41c90d
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x18]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x224]
push str._sUser_DataDefaultCookies
push eax
call edi
add esp, 0x14
lea esi, [esp + 0x218]
call fcn.0041d0d0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00590c4b
add esp, 0x420
ret
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00590c4b
add esp, 0x420
ret

Function at 0x41c930
Capabilities:
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push esi
xor eax, eax
push 0x206
mov ebx, ecx
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x12]
push eax
mov word [esp + 0x14], dx
call fcn.00591690
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x422]
push edx
mov word [esp + 0x424], cx
call fcn.00591690
add esp, 0xc
push 1
push 0x1c
lea eax, [esp + 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41ca0d
lea ecx, [esp + 0x210]
push ecx
lea edx, [esp + 0xc]
push str._s2345ExplorerUser_DataDefault_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x418]
push eax
lea ecx, [esp + 0xc]
call fcn.004210c0
test al, al
je 0x41ca0d
lea esi, [esp + 0x418]
call fcn.0041d0d0
pop esi
pop ebx
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.00590c4b
add esp, 0x624
ret
mov ecx, dword [esp + 0x624]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00590c4b
add esp, 0x624
ret
Function at 0x41ca30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push esi
xor eax, eax
push 0x206
mov ebx, ecx
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x12]
push eax
mov word [esp + 0x14], dx
call fcn.00591690
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x422]
push edx
mov word [esp + 0x424], cx
call fcn.00591690
add esp, 0xc
push 1
push 0x1c
lea eax, [esp + 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41cb0d
lea ecx, [esp + 0x210]
push ecx
lea edx, [esp + 0xc]
push str._sUCBrowserUser_DataDefault_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x418]
push eax
lea ecx, [esp + 0xc]
call fcn.004210c0
test al, al
je 0x41cb0d
lea esi, [esp + 0x418]
call fcn.0041d0d0
pop esi
pop ebx
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.00590c4b
add esp, 0x624
ret
mov ecx, dword [esp + 0x624]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00590c4b
add esp, 0x624
ret

Function at 0x41cb30
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x424
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov ebx, edx
mov word [esp + 0x1c], ax
call fcn.00591690
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x222]
push eax
mov word [esp + 0x224], dx
call fcn.00591690
add esp, 0xc
push 1
lea ecx, [esp + 0x14]
push ecx
push esi
mov ecx, 0x6035cc
call fcn.00421700
test al, al
je 0x41cc28
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cba5
sub eax, edx
sar eax, 1
je 0x41cc28
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.00593545
lea edx, [esp + 0x18]
xor ecx, ecx
push 0x5c
push edx
mov word [eax], cx
call fcn.00593545
lea edx, [esp + 0x20]
xor ecx, ecx
push edx
mov word [eax], cx
lea eax, [esp + 0x22c]
push str._sUser_DataDefaultCookies
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41cc28
lea esi, [esp + 0x218]
call fcn.0041d0d0
pop esi
pop ebx
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.00590c4b
add esp, 0x424
ret
mov ecx, dword [esp + 0x424]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00590c4b
add esp, 0x424
ret
Function at 0x41cc50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebx
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
push ecx
push 9
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push eax
xor bl, bl
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41cca1
xor al, al
jmp 0x41cd3f
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41cd36
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x22]
push edx
mov dword [esp + 0x1c], 0x104
mov word [esp + 0x24], cx
call fcn.00591690
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.InstallLocation
push eax
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41cd2f
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
mov bl, 1
sub edx, ecx
jmp 0x41cd20
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41cd20
mov edx, dword [esp + 8]
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
mov al, bl
mov ecx, dword [esp + 0x220]
pop edi
pop ebx
xor ecx, esp
call fcn.00590c4b
add esp, 0x21c
ret 4

Function at 0x41ceb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
xor eax, eax
push 0x206
mov ebx, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov esi, edx
mov word [esp + 0x14], ax
call fcn.00591690
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x226]
push eax
mov word [esp + 0x228], dx
call fcn.00591690
mov ecx, dword [esp + 0x438]
add esp, 0x18
push 1
push ecx
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x41cf20
xor al, al
jmp 0x41cf48
push esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x218]
push 0x6035f0
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea esi, [esp + 0x210]
call fcn.0041d0d0
mov ecx, dword [esp + 0x418]
pop esi
pop ebx
xor ecx, esp
call fcn.00590c4b
add esp, 0x414
ret 4

Function at 0x41cf70
Capabilities:
Encrypt data using dpapi

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov dword [esp + 0xc], eax
mov esi, 0x80
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], esi
call edi
test eax, eax
jne 0x41cfad
add esi, 0x10
cmp esi, 0x1000
jbe 0x41cf84
cmp esi, 0x1000
jb 0x41cfbd
xor eax, eax
pop edi
pop esi
add esp, 0x14
ret
push 0x1000
push 0
push ebx
call fcn.00591690
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, 0x1000
jbe 0x41cfdd
mov eax, 0xfff
mov esi, dword [esp + 0x14]
push eax
push esi
push ebx
call fcn.00596f90
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
Function at 0x41d0d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x108
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.00591690
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41d11f
xor al, al
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00590c4b
add esp, 0x108
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
test eax, eax
je 0x41d152
push 0
push 0
push eax
lea ecx, [esp + 0x10]
push ecx
push 0xffffffffffffffff
push esi
push 0
push 0
call edi
test eax, eax
jne 0x41d16a
xor al, al
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00590c4b
add esp, 0x108
ret
lea edx, [esp + 4]
push edx
call fcn.0041d000
lea eax, [esp + 4]
mov edx, ebx
mov ecx, eax
sub edx, ecx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41d180
mov ecx, dword [esp + 0x108]
pop edi
xor ecx, esp
mov al, 1
call fcn.00590c4b
add esp, 0x108
ret
Function at 0x41e130
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ce4ab
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
mov eax, dword [0x66a8c4]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.00403ca0
push 0x7f
lea eax, [esp + 0x29]
push 0
mov dword [esp + 0xb8], 0
push eax
mov byte [esp + 0x30], 0
call fcn.00591690
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0xb0]
add esp, 0xc
push ecx
push edx
lea esi, [esp + 0x2c]
call fcn.0041d1b0
lea eax, [edi + 0x54]
push eax
lea ecx, [esp + 0xc]
call fcn.004035d0
push 0x6037dc
lea ecx, [esp + 0xc]
call fcn.004014e0
lea ecx, [edi + 0x70]
push ecx
lea ecx, [esp + 0xc]
call fcn.004035d0
push 0x6037e0
lea ecx, [esp + 0xc]
call fcn.004014e0
push str.path
lea ecx, [esp + 0xc]
call fcn.004014e0
lea edx, [edi + 0x8c]
push edx
lea ecx, [esp + 0xc]
call fcn.004035d0
push 0x6037e0
lea ecx, [esp + 0xc]
call fcn.004014e0
push str.domain
lea ecx, [esp + 0xc]
call fcn.004014e0
lea eax, [edi + 0x1c]
push eax
lea ecx, [esp + 0xc]
call fcn.004035d0
push 0x6037e0
lea ecx, [esp + 0xc]
call fcn.004014e0
cmp dword [edi + 0xc8], 0
je 0x41e265
push str.expires
lea ecx, [esp + 0xc]
call fcn.004014e0
mov ecx, esi
push ecx
lea ecx, [esp + 0xc]
call fcn.004014e0
push 0x6037e0
lea ecx, [esp + 0xc]
call fcn.004014e0
cmp dword [edi + 0xc0], 0
je 0x41e27c
push str.Secure_
lea ecx, [esp + 0xc]
call fcn.004014e0
cmp dword [edi + 0xc4], 0
je 0x41e293
push str.HttpOnly_
lea ecx, [esp + 0xc]
call fcn.004014e0
push str.CPCAO_PSA_OUR
push 0x40
lea ecx, [esp + 0x10]
call fcn.00403c80
push eax
push 0
mov ecx, edi
call fcn.00403c80
push eax
call dword [sym.imp.WININET.dll_InternetSetCookieExA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 8]
test eax, eax
jne 0x41e2cb
call fcn.00403d10
mov al, 1
jmp 0x41e2d2
call fcn.00403d10
xor al, al
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.00590c4b
add esp, 0xac
ret
Function at 0x41f160
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
push 0x103
lea eax, [esp + 0x115]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x11c], 0
call fcn.00591690
add esp, 0xc
push 0x103
lea ecx, [esp + 0xd]
push 0
push ecx
mov byte [esp + 0x14], 0
call fcn.00591690
add esp, 0xc
lea edx, [esp + 0x110]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f1e7
sub eax, edx
je 0x41f1fe
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00403c60
mov ecx, esi
call fcn.00408810
test al, al
jne 0x41f256
mov ecx, esi
call fcn.00403c80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41f256
call fcn.0041e300
test al, al
je 0x41f256
push esi
call fcn.0041e890
test al, al
je 0x41f256
push esi
call fcn.0041e960
test al, al
je 0x41f256
push esi
call fcn.0041efe0
test al, al
setne al
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x21c]
pop esi
xor ecx, esp
xor al, al
call fcn.00590c4b
mov esp, ebp
pop ebp
ret