joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035c7
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf0000000
push 0x18
xor esi, esi
push esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 1
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4036f9
push edi
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push 0x660e
push dword [ebp - 8]
push 0x10
pop edi
call fcn.004029aa
add esp, 0x18
test eax, eax
je 0x4036d9
mov edi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push esi
lea eax, [ebp - 0x10]
push eax
push 4
push dword [ebp - 4]
call edi
test eax, eax
je 0x4036bb
push esi
push dword [ebp + 0xc]
push 1
push dword [ebp - 4]
call edi
test eax, eax
je 0x4036ad
push dword [ebp + 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp edi, esi
je 0x4036ce
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
push eax
push dword [ebp + 0x10]
mov dword [ecx], eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp + 0x1c]
push edi
push esi
push 1
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x4036ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptDecrypt__0x_08x__n
call fcn.00407017
mov edi, dword [ebp + 0x18]
pop ecx
pop ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [edi], eax
mov eax, dword [ebp + 0x1c]
mov dword [eax], esi
jmp 0x4036ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptSetKeyParam__IV___0x_08x__n
jmp 0x4036c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptSetKeyParam__MODE___0x_08x__n
call fcn.00407017
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x4036ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___kull_m_crypto_hkey__0x_08x__n
call fcn.00407017
pop ecx
pop ecx
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
jmp 0x40370c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptAcquireContext__0x_08x__n
call fcn.00407017
pop ecx
pop ecx
mov eax, dword [ebp - 0xc]
pop esi
leave
ret
Function at 0x4037a2
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
xor edi, edi
xor esi, esi
inc esi
mov dword [ebp - 8], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
call fcn.0040a74d
mov dword [ebp - 0x28], eax
cmp eax, edi
je 0x403886
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 8
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
call ebx
test eax, eax
je 0x403869
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x403831
push dword [ebp + 0x18]
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040388d
add esp, 0x10
push dword [ebp - 0xc]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x403844
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptImportKey__0x_08x__n
call fcn.00407017
pop ecx
pop ecx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x10
push esi
push edi
push dword [ebp - 0x28]
lea eax, [ebp - 4]
push eax
call ebx
test eax, eax
jne 0x40387c
push dword [ebp - 0x28]
push str.ERROR_kull_m_crypto_DerAndKeyToPfx___Unable_to_delete_temp_keyset__s_n
jmp 0x403875
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptAcquireContext__0x_08x__n
call fcn.00407017
pop ecx
pop ecx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x4046a4
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xa0
and dword [ebp + 0x50], 0
push ebx
push esi
push edi
push 0x40
mov edi, eax
lea eax, [ebp - 8]
push 0x36
push eax
call sub.msvcrt.dll_memset
push 0x40
lea eax, [ebp - 0x48]
push 0x5c
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
test edi, edi
jbe 0x4046f2
mov eax, dword [ebp + 0x60]
lea edx, [ebp - 8]
lea esi, [ebp - 0x48]
sub edx, eax
sub esi, eax
mov cl, byte [eax]
xor byte [edx + eax], cl
xor byte [esi + eax], cl
inc eax
dec edi
jne 0x4046e6
mov eax, dword [ebp + 0x68]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, 0x40
push eax
push 0x40
mov dword [ebp + 0x4c], eax
call ebx
mov dword [ebp + 0x54], eax
test eax, eax
je 0x4047e1
push 0x10
pop ecx
push dword [ebp + 0x68]
mov edi, eax
push dword [ebp + 0x64]
add eax, 0x40
lea esi, [ebp - 8]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memcpy
push 0x14
lea eax, [ebp + 0x38]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x54]
push 0x8004
call fcn.00402875
add esp, 0x20
test eax, eax
je 0x4047d8
mov ecx, dword [ebp + 0x78]
mov eax, dword [ebp + 0x70]
lea eax, [eax + ecx + 0x54]
push eax
push 0x40
mov dword [ebp + 0x68], eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x4047d8
cmp dword [ebp + 0x6c], 0
push 0x10
pop ecx
lea esi, [ebp - 0x48]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [ebx + 0x40]
pop ecx
lea esi, [ebp + 0x38]
rep movsd dword es:[edi], dword [esi]
je 0x404796
cmp dword [ebp + 0x70], 0
je 0x404796
push dword [ebp + 0x70]
lea eax, [ebx + 0x54]
push dword [ebp + 0x6c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp + 0x74], 0
je 0x4047b8
cmp dword [ebp + 0x78], 0
je 0x4047b8
push dword [ebp + 0x78]
mov eax, dword [ebp + 0x70]
push dword [ebp + 0x74]
lea eax, [ebx + eax + 0x54]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0x14
push dword [ebp + 0x7c]
push dword [ebp + 0x68]
push ebx
push 0x8004
call fcn.00402875
add esp, 0x14
push ebx
mov dword [ebp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0x50]
pop edi
pop esi
pop ebx
add ebp, 0x58
leave
ret
Function at 0x404af1
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
mov esi, edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
cmp dword [ebp + 0x1c], ebx
je 0x404b84
cmp dword [ebp + 0x20], ebx
je 0x404b84
push eax
call fcn.00403a6f
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404bd8
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x24]
push edi
push esi
push dword [ebp + 0x20]
mov esi, ebx
push dword [ebp + 0x1c]
call fcn.004048f6
add esp, 0x1c
mov dword [ebp - 4], eax
test eax, eax
je 0x404b7b
mov esi, dword [ebp + 8]
test esi, esi
je 0x404b7b
cmp dword [ebx + 0x30], 0
je 0x404b7b
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x404b7b
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
test eax, eax
je 0x404b7b
push dword [ebx + 0x2c]
push dword [ebx + 0x30]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, ebx
call fcn.00403b4c
jmp 0x404bd8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push dword [ebp + 0xc]
push ebx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x404bd8
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + 0x18]
push eax
push 0x40
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp eax, ebx
je 0x404bcf
push dword [esi]
push dword [ebp - 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x405248
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
push edi
mov dword [ebp - 8], 0x8004
cmp eax, 0x8009
je 0x40526b
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.004033c1
push dword [esi + 0x28]
call fcn.00403493
push dword [esi + 0x28]
mov ebx, eax
call fcn.00403424
add esp, 0xc
lea edi, [eax + ebx]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4053e6
push 1
push edi
push eax
push dword [esi + 0x20]
lea eax, [esi + 0x34]
push eax
push 0x14
push dword [ebp + 8]
push dword [ebp - 8]
push 0x10
pop eax
call fcn.00402cfc
add esp, 0x20
test eax, eax
je 0x4053dd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
xor edi, edi
push edi
push ebx
push dword [ebp - 0x10]
push dword [esi + 0x28]
call fcn.004031c3
add esp, 0x18
test eax, eax
je 0x4053ca
mov eax, dword [ebp - 0x10]
push edi
add eax, ebx
push eax
push 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x4053a6
mov eax, dword [esi + 0x4c]
push eax
push 0x40
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x4053a6
push dword [ebp - 0x14]
push dword [esi + 0x48]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x40539f
mov edi, dword [esi + 0x2c]
push 0x14
pop eax
cmp edi, eax
jae 0x40534a
mov eax, edi
push eax
push ebx
push dword [ebp + 0x10]
call sub.msvcrt.dll_memcpy
mov esi, dword [esi + 0x30]
add esp, 0xc
push 0x10
pop eax
cmp esi, eax
jae 0x405363
mov eax, esi
push eax
add edi, ebx
push edi
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcpy
lea eax, [esi - 0x10]
add esp, 0xc
mov dword [ebp - 4], 1
test eax, eax
je 0x40539f
xor esi, esi
test eax, eax
jbe 0x40539f
add edi, 0x10
cmp dword [ebp - 4], 0
je 0x40539f
xor ecx, ecx
cmp byte [edi], cl
sete cl
and dword [ebp - 4], ecx
inc esi
inc edi
cmp esi, eax
jb 0x405389
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0x18]
call fcn.00402b01
pop ecx
test eax, eax
jne 0x4053dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_close_hprov_delete_container__0x_08x__n
jmp 0x4053d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_hkey_session__0x_08x__n
call fcn.00407017
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40550f
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [0x486f84], edi
je 0x4055b7
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
lea eax, [ebp - 4]
push eax
push edi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x405603
mov eax, dword [ebp - 4]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x405603
lea eax, [ebp - 4]
push eax
push ebx
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
mov dword [ebp - 8], eax
cmp eax, edi
je 0x4055ae
push dword [ebp + 8]
push str._n_nBase64_of_file_:__s_n_n
call fcn.00407017
pop ecx
xor esi, esi
pop ecx
cmp dword [ebp - 4], edi
jbe 0x4055a3
movzx eax, word [ebx + esi*2]
push eax
push 0x4629a8
call fcn.00407017
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 4]
jb 0x40558c
push str._n
call fcn.00407017
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x405603
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, edi
je 0x405603
cmp esi, 0xffffffff
je 0x405603
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4055fc
cmp edi, dword [ebp - 4]
jne 0x4055fc
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40560b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x405699
cmp eax, 0xffffffff
je 0x405699
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x405690
cmp dword [ebp - 0x10], edi
jne 0x405690
mov eax, dword [ebp - 0x14]
push eax
push 0x40
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebx], eax
cmp eax, edi
je 0x405690
push edi
lea ecx, [ebp - 0xc]
push ecx
push dword [esi]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405685
mov eax, dword [esi]
cmp eax, dword [ebp - 0xc]
jne 0x405685
mov dword [ebp - 4], 1
jmp 0x405690
push dword [ebx]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x4056d2
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4058dc
test al, 0x10
je 0x4058dc
xor ebx, ebx
cmp dword [ebp + 0x18], ebx
je 0x40573c
cmp dword [ebp + 0x14], ebx
jne 0x40573c
push dword [ebp + 8]
push 0x45d518
push ebx
push str._sDirectory__s
call fcn.00407017
add esp, 0x10
cmp dword [ebp + 0xc], ebx
je 0x405731
push dword [ebp + 0xc]
push str.___s_
call fcn.00407017
pop ecx
pop ecx
push 0x45d6e4
call fcn.00407017
pop ecx
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x4058d5
push dword [ebp + 8]
mov esi, 0x104
push esi
push edi
call fcn.00450047
add esp, 0xc
test eax, eax
jne 0x4058d5
push 0x462a0c
push esi
push edi
call fcn.0044ffca
add esp, 0xc
test eax, eax
jne 0x4058d5
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x405790
mov eax, 0x462a10
push eax
push esi
push edi
call fcn.0044ffca
add esp, 0xc
test eax, eax
jne 0x4058d5
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x4058d5
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
lea eax, [esp + 0x3c]
push 0x462a14
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x4058b4
lea eax, [esp + 0x3c]
push 0x462a18
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x4058b4
push dword [ebp + 8]
push esi
push edi
call fcn.00450047
add esp, 0xc
test eax, eax
jne 0x4058b4
push 0x462a0c
push esi
push edi
call fcn.0044ffca
add esp, 0xc
test eax, eax
jne 0x4058b4
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40581f
sub eax, edx
sar eax, 1
mov ebx, eax
lea eax, [esp + 0x3c]
push eax
push esi
push edi
call fcn.0044ffca
add esp, 0xc
test eax, eax
jne 0x4058b4
cmp dword [ebp + 0x18], eax
je 0x405875
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x14]
shr eax, 3
not eax
and eax, 2
or eax, 0x44
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0x45d518
add eax, eax
push eax
push str._s_3u__c_s_n
call fcn.00407017
add esp, 0x18
test byte [esp + 0x10], 0x10
jne 0x405892
cmp dword [ebp + 0x1c], 0
je 0x4058b4
push dword [ebp + 0x20]
lea eax, [edi + ebx*2]
push eax
push edi
push dword [ebp + 0x14]
call dword [ebp + 0x1c]
jmp 0x4058b4
cmp dword [ebp + 0x10], 0
je 0x4058b4
push dword [ebp + 0x20]
mov eax, dword [ebp + 0x14]
push dword [ebp + 0x1c]
inc eax
push dword [ebp + 0x18]
push eax
push 1
push dword [ebp + 0xc]
push edi
call fcn.004056d2
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4057bc
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406503
Capabilities:
Get domain controller name

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea ecx, [ebp - 4]
push ecx
xor edi, edi
or eax, 0x40020000
push eax
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
push edi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, edi
jne 0x406578
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 4
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x406532
sub eax, ecx
push esi
sar eax, 1
lea esi, [eax + eax + 2]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, edi
je 0x40656d
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
push esi
add ecx, 4
push ecx
xor edi, edi
push eax
inc edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
pop esi
jmp 0x406585
push eax
push str.ERROR_kull_m_net_getDC___DsGetDcName:__u_n
call fcn.00407017
pop ecx
pop ecx
mov eax, edi
pop edi
leave
ret
Function at 0x406657
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x486f88
mov ecx, dword [eax]
sub ecx, ebx
push edi
mov dword [esp + 0x10], ebx
je 0x406733
dec ecx
je 0x406710
dec ecx
dec ecx
je 0x4066e5
sub ecx, 3
jne 0x40682e
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
cmp dword [ecx], ebx
jne 0x4067e7
mov ecx, dword [esi]
cmp ecx, ebx
je 0x4066c3
mov eax, dword [eax + 4]
push ebx
push ebx
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x40682e
push ebx
lea eax, [esp + 0x18]
push eax
push dword [ebp + 0x10]
mov eax, dword [esi + 4]
push dword [edi]
mov eax, dword [eax + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x10], eax
jmp 0x40682e
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
cmp dword [ecx], ebx
jne 0x4067e7
push ebx
push esi
push dword [ebp + 0x10]
xor esi, esi
push dword [edi]
push 0x22c187
mov eax, dword [eax + 4]
push dword [eax]
call fcn.00405a30
add esp, 0x18
jmp 0x4066dc
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
cmp dword [ecx], ebx
jne 0x4067e7
mov eax, dword [eax + 4]
push ebx
push dword [ebp + 0x10]
push dword [edi]
push dword [esi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x4066dc
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov ecx, dword [eax]
sub ecx, ebx
je 0x4067ce
dec ecx
je 0x4067b6
dec ecx
je 0x40679d
dec ecx
je 0x40678b
sub ecx, 3
jne 0x40682e
mov eax, dword [eax + 4]
push ebx
push ebx
push dword [edi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40682e
push ebx
lea eax, [esp + 0x18]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi + 4]
push dword [esi]
mov eax, dword [eax + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x4066dc
push ebx
push esi
push ebx
push dword [edi]
lea esi, [ebp + 0x10]
push 0x22c183
jmp 0x406701
push dword [ebp + 0x10]
mov eax, dword [eax + 4]
push dword [edi]
mov eax, dword [eax]
push dword [esi]
call fcn.00406cbb
add esp, 0xc
jmp 0x4066dc
mov eax, dword [eax + 4]
push ebx
push dword [ebp + 0x10]
push dword [esi]
push dword [edi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x4066dc
push dword [ebp + 0x10]
push dword [edi]
push dword [esi]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esp + 0x10], 1
jmp 0x40682e
push dword [ebp + 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x18], eax
cmp eax, ebx
je 0x40682e
push dword [ebp + 0x10]
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.00406657
add esp, 0xc
test eax, eax
je 0x406824
push dword [ebp + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00406657
add esp, 0xc
mov dword [esp + 0x10], eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406bf7
Capabilities:
Read file via mapping

Disassembly:
push edi
push 8
push 0x40
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
cmp eax, edi
je 0x406c5a
push edi
push edi
push edi
push 2
push edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
cmp dword [eax], edi
je 0x406c55
push edi
push edi
push edi
push 4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esi]
mov dword [ecx + 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
cmp ecx, edi
je 0x406c55
cmp dword [ecx], 0x504d444d
jne 0x406c55
mov edx, 0xa793
cmp word [ecx + 4], dx
jne 0x406c55
inc edi
jmp 0x406c5a
call fcn.00406c5e
mov eax, edi
pop edi
ret

Function at 0x40739b
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [esi]
push edi
mov edi, 0xc0000004
test eax, eax
je 0x4073b9
push 0
push 0
push eax
push dword [esp + 0x14]
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, eax
jmp 0x4073f4
push ebx
mov ebx, 0x1000
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
test eax, eax
je 0x4073f3
push 0
push ebx
push eax
push dword [esp + 0x18]
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, eax
test edi, edi
jge 0x4073e9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, ebx
cmp edi, 0xc0000004
je 0x4073bf
pop ebx
mov eax, edi
pop edi
ret