joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b4a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5494eb
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b0c20]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x25c]
mov ebx, dword [esp + 0x260]
call fcn.0050d475
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x42b505
push 0x80004005
call fcn.00401c60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x264]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, 0x5b2810
mov dword [esp + 0x25c], edi
call fcn.004050c0
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
push 0x11
lea eax, [esp + 0x48]
push esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 0x41
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
xor ebp, ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x42b5a0
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x42b5a0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
cmp esi, edi
je 0x42b59c
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ebp, eax
jmp 0x42b5a4
xor ebp, ebp
jmp 0x42b5a4
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x42b5e9
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x42b5e9
mov ecx, dword [esp + 0x14]
cmp ecx, edi
je 0x42b5d0
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x14]
call eax
mov eax, dword [esp + 0x18]
cmp esi, edi
je 0x42b5e1
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push esi
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x254], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b614
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.00524d83
add esp, 0x244
ret
Function at 0x430870
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x549b0b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
mov eax, dword [0x5b0c20]
xor eax, esp
push eax
lea eax, [esp + 0x434]
mov dword fs:[0], eax
mov esi, dword [esp + 0x444]
mov edi, dword [esp + 0x448]
mov ebx, dword [esp + 0x44c]
push 0x58cf10
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], 0
call fcn.00405d30
mov eax, dword [str.SoftwareJeticoBestCrypt_Volume_Encryption_]
push eax
lea ecx, [esp + 0x24]
push 0x104
push ecx
mov dword [esp + 0x448], 0
call fcn.005267e8
push edi
lea edx, [esp + 0x30]
push 0x104
push edx
call fcn.00527a99
add esp, 0x18
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x430961
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00404aa0
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x43c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4309ee
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x22c]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4309a2
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4309be
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x228]
push edx
lea ecx, [esp + 0x14]
call fcn.00405040
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00404aa0
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x440], edx
add esp, 4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4309fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x434]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00524d83
add esp, 0x430
ret

Function at 0x431eb0
Capabilities:
Read file on windows

Disassembly:
cmp dword [ecx], 0
jne 0x431eba
xor eax, eax
ret 0xc
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x431ec9
mov dword [esi], 0
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x431eda
lea eax, [edi + 1]
pop edi
pop esi
ret 0xc
mov eax, dword [ecx]
mov ecx, dword [esp + 0xc]
push eax
push edi
push 1
push ecx
call fcn.00527fdb
add esp, 0x10
test esi, esi
je 0x431ef3
mov dword [esi], eax
xor edx, edx
cmp edi, eax
sete dl
pop edi
pop esi
mov eax, edx
ret 0xc
Function at 0x431f10
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
jne 0x431f19
ret 8
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x431f2b
mov eax, 1
pop esi
ret 8
push eax
mov eax, dword [esp + 0xc]
push esi
push 1
push eax
call fcn.00527898
xor ecx, ecx
add esp, 0x10
cmp esi, eax
sete cl
pop esi
mov eax, ecx
ret 8
Function at 0x433cd0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x549cfb
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push esi
mov eax, dword [0x5b0c20]
xor eax, esp
push eax
lea eax, [esp + 0x274]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x284]
mov esi, dword [esp + 0x288]
push 0
push 0
lea eax, [esp + 0x70]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x433d44
jmp 0x433d30
movzx ecx, word [eax + 0x5533d8]
mov word [esp + eax + 0x68], cx
add eax, 2
test cx, cx
jne 0x433d30
xor ecx, ecx
push 0x58
push ecx
lea edx, [esp + 0x18]
push edx
mov word [esi], cx
call fcn.00526520
lea eax, [esp + 0x74]
add esp, 0xc
mov dword [esp + 0x10], 0x58
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x1c], str.Boot_image_files__.bin_
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0x808
mov dword [esp + 0x4c], 0x556b30
call fcn.0050d475
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x433dc3
push 0x80004005
call fcn.00401c60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push 0xa3
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x5b2810
mov dword [esp + 0x284], 0
call fcn.004050c0
cmp dword [esp + 0x28c], 0
mov edx, dword [esp + 0xc]
mov dword [esp + 0x40], edx
je 0x433e46
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
cmp eax, 1
jne 0x433e77
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x27c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433e3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x433ea4
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp eax, 1
jne 0x433e77
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x27c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x433e33
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x27c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433ea2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x274]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.00524d83
add esp, 0x274
ret
Function at 0x435340
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x549df6
mov eax, dword fs:[0]
push eax
sub esp, 0x18c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
mov eax, dword [0x5b0c20]
xor eax, esp
push eax
lea eax, [esp + 0x19c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1ac]
call fcn.0050d475
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43539d
push 0x80004005
call fcn.00401c60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x1a4], ebx
call fcn.0050d475
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4353ce
push 0x80004005
call fcn.00401c60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0xbe
lea ecx, [esp + 0x20]
push ecx
push edi
mov byte [esp + 0x1b0], 1
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebx
jne 0x435457
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
mov byte [esp + 0x1a4], bl
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x435422
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1a4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43544d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x4354f7
lea eax, [esp + 0x1c]
xor edx, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x435460
sub eax, esi
sar eax, 1
je 0x4354a3
movzx esi, word [esp + edx*2 + 0x1c]
cmp si, 0x7e
ja 0x43551e
lea eax, [esp + 0x1c]
inc edx
lea esi, [eax + 2]
jmp 0x435490
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x435490
sub eax, esi
sar eax, 1
cmp edx, eax
jb 0x435471
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x1a4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4354ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1a4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4354f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x19c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.00524d83
add esp, 0x198
ret
push 0xef1c
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x5b2810
call fcn.004050c0
movzx eax, si
push eax
push eax
push eax
lea edx, [esp + 0x20]
push 0xf03c
push edx
call fcn.00405140
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 0x14
push ebx
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4353fb
Function at 0x435570
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, ecx
cmp dword [ebp + 0x64], 0
push esi
push edi
je 0x4355c2
mov edx, dword [ebp + 0x6c]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435583
sub eax, esi
mov esi, dword [esp + 0x14]
lea edi, [esi - 1]
cmp eax, edi
jl 0x4355b2
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esi - 1]
push eax
push edx
push ebx
call fcn.005257e0
add esp, 0xc
mov byte [ebx + esi - 1], 0
pop ebx
jmp 0x4355d8
mov esi, dword [esp + 0x10]
mov cl, byte [edx]
mov byte [esi], cl
inc edx
inc esi
test cl, cl
jne 0x4355b6
jmp 0x4355d6
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, eax
cmp dword [esp + 0x18], 0
je 0x4355f7
mov ecx, dword [ebp + 0x20]
push ecx
call fcn.00435340
add esp, 4
test eax, eax
je 0x4355f7
pop edi
pop esi
xor eax, eax
pop ebp
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x435ad0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
xor eax, eax
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x34]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
cmp esi, eax
je 0x435b2a
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x435b48
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x28
ret 0x10
cmp ebp, eax
je 0x435b1f
lea edx, [esp + 0x10]
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x435b48
pop edi
pop esi
pop ebp
add esp, 0x28
ret 0x10
mov eax, dword [esp + 0x30]
push ebx
push 1
push eax
call fcn.00525178
mov ebx, dword [esp + 0x4c]
add esp, 8
mov dword [ebx], eax
test eax, eax
jne 0x435b6c
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x28
ret 0x10
test esi, esi
je 0x435b7d
push 0x55791c
push esi
call fcn.005279de
jmp 0x435b8c
test ebp, ebp
je 0x435bbb
push 0x554630
push ebp
call fcn.00527bdc
mov edi, eax
add esp, 8
test edi, edi
je 0x435bbb
mov ecx, dword [esp + 0x34]
mov edx, dword [ebx]
push edi
push ecx
push 1
push edx
call fcn.00527fdb
add esp, 0x10
cmp eax, dword [esp + 0x34]
jne 0x435bbb
mov ecx, dword [esp + 0x48]
mov dword [ecx], eax
mov esi, 1
jmp 0x435bde
mov eax, dword [ebx]
test eax, eax
je 0x435bca
push eax
call fcn.005251b8
add esp, 4
mov edx, dword [esp + 0x48]
mov esi, dword [esp + 0x10]
mov dword [ebx], 0
mov dword [edx], 0
test edi, edi
je 0x435beb
push edi
call fcn.005276ba
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x28
ret 0x10
Function at 0x436900
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebp
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
push 9
mov ecx, edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
xor esi, esi
call fcn.00436680
test eax, eax
je 0x436976
add edi, 0x108
push 0x554f9c
push edi
call fcn.005279de
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x436976
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push ebx
push 1
push edx
call fcn.00527898
add esp, 0x10
cmp eax, ebx
pop ebx
jne 0x436976
push esi
call fcn.005276ba
push edi
xor esi, esi
call fcn.004367e0
add esp, 8
lea ebp, [esi + 1]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x436987
push eax
call fcn.005251b8
add esp, 4
test esi, esi
je 0x436994
push esi
call fcn.005276ba
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret

Function at 0x4369a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x120]
xor esi, esi
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x436a9a
call fcn.00438110
test al, 2
je 0x436a9a
test al, 4
je 0x4369fa
lea eax, [esi + 1]
jmp 0x436a9c
push ebx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0xa
mov ecx, edi
call fcn.00436680
mov ebx, dword [esp + 0x10]
test eax, eax
je 0x436a77
push str.console.crt
push str.certificates_
add edi, 0x20c
push edi
lea edx, [esp + 0x24]
push str._s_s_s
push edx
call fcn.00436870
lea eax, [esp + 0x2c]
push 0x554f9c
push eax
call fcn.005279de
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x436a77
mov edi, dword [esp + 0xc]
push esi
push edi
push 1
push ebx
call fcn.00527898
add esp, 0x10
cmp eax, edi
jne 0x436a77
push esi
call fcn.005276ba
add esp, 4
xor esi, esi
lea edi, [esi + 1]
jmp 0x436a7b
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x436a88
push ebx
call fcn.005251b8
add esp, 4
pop ebx
test esi, esi
je 0x436a96
push esi
call fcn.005276ba
add esp, 4
mov eax, edi
jmp 0x436a9c
xor eax, eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
xor ecx, esp
call fcn.00524d83
add esp, 0x114
ret 4

Function at 0x436f90
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebp
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
xor ebp, ebp
lea edx, [esp + 8]
push edx
push ebp
push ebp
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call fcn.00436680
test eax, eax
jne 0x436fbf
pop ebp
add esp, 8
ret 8
mov ecx, dword [esp + 0x14]
push ebx
push esi
push 0x554590
push ecx
call fcn.00527bdc
mov ebx, dword [esp + 0x14]
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x436ff9
push edi
mov edi, dword [esp + 0x14]
push esi
push edi
push 1
push ebx
call fcn.00527898
add esp, 0x10
cmp eax, edi
pop edi
jne 0x436ff9
mov ebp, 1
test ebx, ebx
je 0x437006
push ebx
call fcn.005251b8
add esp, 4
test esi, esi
je 0x437013
push esi
call fcn.005276ba
add esp, 4
pop esi
pop ebx
mov eax, ebp
pop ebp
add esp, 8
ret 8
Function at 0x437dd0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x549eeb
mov eax, dword fs:[0]
push eax
sub esp, 0x2d4
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b0c20]
xor eax, esp
push eax
lea eax, [esp + 0x2e8]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2f8]
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.00438cc0
lea ecx, [esp + 0x14]
mov dword [esp + 0x2f0], 0
call fcn.00438110
test al, 2
je 0x437e67
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.004369a0
mov dword [esp + 0x2f0], 0xffffffff
lea ecx, [esp + 0x14]
test eax, eax
je 0x437fee
call fcn.004380d0
mov eax, 1
jmp 0x437ff5
test eax, eax
jne 0x437ea8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esi + 0x62d]
push ecx
lea edx, [esp + 0x168]
push str.Workstation__s__08x
push edx
call fcn.00525599
add esp, 0x10
lea eax, [esp + 0x160]
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00438d40
test eax, eax
je 0x437fdf
lea ecx, [esp + 0x14]
call fcn.00438110
cmp eax, 1
jne 0x437fdf
push 0x104
lea ecx, [esp + 0x1e4]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00438490
test eax, eax
je 0x437fdf
push 0x40
lea ebp, [esi + 0x66d]
push ebp
lea edx, [esp + 0x1e8]
push edx
mov ecx, esi
call fcn.00436250
test eax, eax
je 0x437fdf
push str.ComputerName
push str.Client
lea ebx, [esi + 0x62d]
lea edi, [esi + 4]
push ebx
push edi
call fcn.00436850
add esp, 0x10
test eax, eax
jne 0x437f1b
mov byte [ebx], al
push 0x557c70
push str.Client
push ebp
push edi
call fcn.00436850
add esp, 0x10
test eax, eax
jne 0x437f36
mov byte [ebp], al
cmp dword [esi + 0xc0c], 0
je 0x437f57
push str.UefiComputer
push str.Client
push 0x557d6c
push edi
call fcn.00436850
add esp, 0x10
mov ecx, esi
call fcn.00435a60
test eax, eax
je 0x437f84
push str.WirelessComputer
push str.Client
push 0x557d6c
push edi
call fcn.00436850
add esp, 0x10
mov dword [esi + 0xc10], 1
push 1
mov ecx, esi
call fcn.00437630
push edi
call fcn.004367e0
add esp, 4
mov ecx, esi
call fcn.00436890
lea eax, [esp + 0x1e0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
call fcn.00438bd0
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.004369a0
mov dword [esp + 0x2f0], 0xffffffff
lea ecx, [esp + 0x14]
test eax, eax
je 0x437fee
call fcn.004380d0
mov eax, 1
jmp 0x437ff5
lea ecx, [esp + 0x14]
mov dword [esp + 0x2f0], 0xffffffff
call fcn.004380d0
xor eax, eax
mov ecx, dword [esp + 0x2e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2d0]
xor ecx, esp
call fcn.00524d83
add esp, 0x2e0
ret 4
Function at 0x438020
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x14]
push eax
xor ebp, ebp
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
push 2
mov ecx, edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
xor esi, esi
call fcn.00436680
test eax, eax
je 0x4380a5
push ebx
lea ebx, [edi + 4]
push 0x554f9c
push ebx
call fcn.005279de
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x4380a4
mov ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push esi
push ebp
push 1
push edx
call fcn.00527898
add esp, 0x10
cmp eax, ebp
jne 0x4380a4
push esi
call fcn.005276ba
push ebx
xor esi, esi
call fcn.004367e0
add esp, 8
push 1
mov ecx, edi
call fcn.00437630
mov dword [esp + 0x14], 1
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4380b6
push eax
call fcn.005251b8
add esp, 4
test esi, esi
je 0x4380c3
push esi
call fcn.005276ba
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x438cc0
Capabilities:
Create directory

Disassembly:
push esi
mov esi, ecx
push 0x104
push esi
push 0
mov byte [esi], 0
mov dword [esi + 0x148], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x438cf7
add eax, 0xffffffff
je 0x438cf7
cmp byte [eax + esi], 0x5c
je 0x438cf7
sub eax, 1
mov byte [eax + esi + 1], 0
jne 0x438ce7
push str.certificates_
push 0x104
push esi
call fcn.00528962
push 0
push esi
call fcn.00526e12
add esp, 0x14
test eax, eax
je 0x438d1f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, esi
call fcn.00438bd0
call fcn.0046b3f0
push 1
call fcn.00467b00
add esp, 4
mov eax, esi
pop esi
ret
Function at 0x439490
Capabilities:
Access peb ldr_data
Get keyboard layout
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x54a06e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b0c20]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x30]
push eax
push 0x95
call fcn.00508545
lea edi, [esi + 0x84]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.CPwdDlg.0
call fcn.00502fcc
mov dword [edi], vtable.CStatic.0
push ebx
push ebx
push 1
lea ecx, [esi + 0xd8]
mov byte [esp + 0x28], 1
call fcn.00434770
lea edi, [esi + 0x184]
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.00502fcc
mov dword [edi], vtable.CStatic.0
lea edi, [esi + 0x1dc]
mov ecx, edi
mov byte [esp + 0x1c], 3
call fcn.00502fcc
mov dword [edi], vtable.CStatic.0
lea edi, [esi + 0x24c]
mov ecx, edi
mov byte [esp + 0x1c], 4
call fcn.00502fcc
mov dword [edi], vtable.CStatic.0
lea edi, [esi + 0x238]
push edi
mov byte [esp + 0x20], 5
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
jne 0x43955f
xor ecx, ecx
mov word [edi], cx
push 1
push str.00000409
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
lea eax, [edi + 4]
push eax
mov dword [esi + 0x74], edx
mov dword [esi + 0x78], ebx
call fcn.005018ce
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov dword [esi + 0x78], eax
mov byte [eax], bl
add esp, 4
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], ecx
mov dword [esi + 0x230], edx
call fcn.0050bde7
mov edi, dword [eax + 0xc]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xc
call ebx
push eax
push 0xb
call ebx
push eax
push 1
push 0x80
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [esi + 0x1d8], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x234], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x18