joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fb870
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x732f08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x857060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [eax]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], eax
cmp byte [eax + 0xd], bl
jne 0x4fb8ed
mov esi, eax
nop
push edx
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], esi
push eax
call fcn.004fbdb0
test al, al
je 0x4fb8d8
mov esi, dword [esi + 8]
xor ebx, ebx
jmp 0x4fb8e1
mov edi, esi
mov ebx, 1
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
mov edx, dword [ebp - 0x10]
je 0x4fb8c0
mov esi, dword [ebp - 0x1c]
cmp byte [edi + 0xd], 0
jne 0x4fb91c
lea ecx, [edi + 0x10]
push ecx
push edx
call fcn.004fbdb0
test al, al
jne 0x4fb91c
mov byte [esi + 4], al
mov eax, esi
mov dword [esi], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], 0xa72f05
je 0x4fba16
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x188
mov dword [ebp - 0x28], 0
call fcn.006d0976
mov edi, eax
add esp, 4
mov dword [ebp - 0x28], edi
push dword [ebp - 0x10]
lea esi, [edi + 0x10]
mov dword [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], esi
call fcn.00449340
mov eax, dword [ebp - 0x10]
lea ecx, [esi + 0x18]
add eax, 0x18
mov byte [ebp - 4], 2
push eax
call fcn.00449340
add esi, 0x30
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], esi
mov ecx, esi
push 0
push 0x798f50
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.00426e90
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 4
call fcn.00429f90
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov dword [esi + 0x140], 0
mov dword [esi + 0x144], 0
mov dword [esi + 0x140], 1
mov dword [esi + 0x144], 0x8681e8
push edi
mov dword [edi], eax
push ebx
push dword [ebp - 0x14]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov word [edi + 0xc], 0
call fcn.00427440
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00425f40
int3
Function at 0x50af10
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7348e0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 0
push eax
push 0
push 0
mov esi, 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_CredEnumerateW]
test eax, eax
je 0x50b02c
xor edi, edi
cmp edi, dword [ebp - 0x18]
jae 0x50b02c
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + edi*4]
mov dword [ebp - 0x38], eax
mov edx, dword [eax + 8]
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x3c], ecx
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50afb0
sub eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
sar eax, 1
push eax
push edx
call fcn.00426d40
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x50afd4
mov eax, dword [ebx]
push dword [ebx + 0x10]
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x20]
cmovae ecx, dword [ebp - 0x30]
push eax
push 0
call fcn.00457810
add esp, 0xc
cmp eax, 0xffffffff
je 0x50b00c
mov eax, dword [ebp - 0x38]
push 0
push 1
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_CredDeleteW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
lea ecx, [ebp - 0x30]
call fcn.00426ce0
inc edi
jmp 0x50af77
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x50b03a
push eax
call dword [sym.imp.ADVAPI32.dll_CredFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret 8

Function at 0x5164c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
test eax, eax
je 0x5164e3
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.006f2c59
add esp, 0x10
pop esi
pop ebp
ret 8
mov ecx, dword [esi + 0xec]
push ebx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0xe8]
jle 0x51654b
add eax, eax
push eax
mov dword [ebp + 0xc], eax
call fcn.006d0f4b
push dword [esi + 0xec]
mov ebx, eax
push dword [esi + 0xd0]
push ebx
call fcn.006e8ef0
mov eax, dword [esi + 0xd0]
lea ecx, [esi + 0xd4]
add esp, 0x10
cmp eax, ecx
je 0x516534
push eax
call fcn.006d0c28
add esp, 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0xec]
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xe8], eax
jmp 0x516551
mov ebx, dword [esi + 0xd0]
lea eax, [ecx + edi]
mov dword [esi + 0xec], eax
lea esi, [ecx - 1]
push edi
push dword [ebp + 8]
add esi, ebx
push esi
call fcn.006e8ef0
add esp, 0xc
mov byte [esi + edi], 0
pop edi
pop ebx
pop esi
pop ebp
ret 8
Function at 0x52a1f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x52a24e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x52a210
mov eax, dword [edi]
jmp 0x52a339
cmp eax, 0x4e0
jb 0x52a339
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x52a270
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x52a2c0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x52ebd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73802e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x857060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
lea eax, [ebp + 8]
mov dword [ebp - 4], 3
push eax
call fcn.00449340
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 4
push eax
lea ecx, [esi + 0x18]
call fcn.00449340
lea eax, [ebp + 0x38]
mov byte [ebp - 4], 5
push eax
lea ecx, [esi + 0x30]
call fcn.00449340
lea eax, [ebp + 0x50]
mov byte [ebp - 4], 6
push eax
lea ecx, [esi + 0x48]
call fcn.00449340
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x52ec72
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x52ec68
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52ed50
push edx
push ecx
call fcn.006d0bf7
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x52ecb8
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x52ecae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52ed50
push edx
push ecx
call fcn.006d0bf7
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x52ecfa
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x52ecf0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52ed50
push edx
push ecx
call fcn.006d0bf7
add esp, 8
mov edx, dword [ebp + 0x64]
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0xf
mov byte [ebp + 0x38], 0
cmp edx, 0x10
jb 0x52ed3c
mov ecx, dword [ebp + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x52ed32
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52ed50
push edx
push ecx
call fcn.006d0bf7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x60
call fcn.006f1bea
int3
Function at 0x537610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x739580
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
call fcn.00535000
mov ecx, eax
call fcn.005373d0
push eax
lea ecx, [ebp - 0x40]
call fcn.00449340
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
xorps xmm0, xmm0
mov esi, dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
movlpd qword [ebp - 0x50], xmm0
mov edi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0x58], ecx
movlpd qword [ebp - 0x48], xmm0
test esi, esi
je 0x5376cc
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
nop dword [eax + eax]
movzx ecx, byte [edx + ecx]
movzx eax, bl
xor ecx, eax
mov eax, dword [ebp - 0x54]
shrd ebx, edi, 8
shr edi, 8
xor ebx, dword [ecx*8 + 0x78fb38]
xor edi, dword [ecx*8 + 0x78fb3c]
add edx, 1
mov ecx, dword [ebp - 0x58]
adc eax, 0
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x54], eax
test eax, eax
jb 0x537690
ja 0x5376cf
cmp edx, esi
jb 0x537690
jmp 0x5376cf
mov dword [ebp - 0x4c], ebx
xor esi, esi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], edi
lea edx, [ebp - 0x48]
lea ebx, [esi + 8]
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
mov ecx, esi
shl esi, 8
shr ecx, 8
xor ecx, eax
movzx eax, cl
xor si, word [eax*2 + 0x78f938]
movzx esi, si
sub ebx, 1
jne 0x5376e0
push 2
push 0x7e8cb0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00426e90
mov ebx, dword [ebp - 0x4c]
lea eax, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x5c]
push esi
push edi
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.00537480
mov edx, dword [ebp - 0x14]
mov esi, eax
cmp edx, 0x10
jb 0x537768
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x53775e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5377ba
push edx
push ecx
call fcn.006d0bf7
add esp, 8
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x53779a
mov edx, dword [ebp - 0x40]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x537790
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5377ba
push ecx
push edx
call fcn.006d0bf7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret 4
call fcn.006f1bea
int3
Function at 0x5397c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x739988
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.00546bb0
test eax, eax
jne 0x53991d
push 1
push 0x79a7b0
lea ecx, [ebp - 0x28]
call fcn.0044a2e0
cmp dword [0x867f5c], 8
mov ecx, 0x867f48
push dword [0x867f58]
cmovae ecx, dword [0x867f48]
push ecx
mov ecx, eax
call fcn.0044a2e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x539882
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x539882
cmp eax, 0xb7
je 0x539882
cmp eax, 0x50
jne 0x53991d
push 1
push 0x79a7b0
lea ecx, [ebp - 0x28]
call fcn.0044a2e0
cmp dword [0x867e3c], 8
mov ecx, 0x867e28
push dword [0x867e38]
cmovae ecx, dword [0x867e28]
push ecx
mov ecx, eax
call fcn.0044a2e0
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x28]
push ecx
cmp eax, dword [esi + 8]
je 0x5398cb
mov ecx, eax
call fcn.00449230
add dword [esi + 4], 0x18
jmp 0x5398d3
push eax
mov ecx, esi
call fcn.00457540
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 0
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x28]
call fcn.005483b0
test eax, eax
jne 0x539919
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x28]
push ecx
cmp eax, dword [esi + 8]
je 0x539911
mov ecx, eax
call fcn.00449230
add dword [esi + 4], 0x18
xor esi, esi
jmp 0x539922
push eax
mov ecx, esi
call fcn.00457540
xor esi, esi
jmp 0x539922
mov esi, 1
lea ecx, [ebp - 0x28]
call fcn.00426ce0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret

Function at 0x53e090
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x53e0c1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x53e0b0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x544f10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73a5c3
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.00449230
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x54506f
push 2
push 0x7e9ca4
lea ecx, [ebp - 0x28]
call fcn.0044a2e0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x278]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x54506f
nop dword [eax]
test byte [ebp - 0x278], 0x10
jne 0x545049
xor eax, eax
mov dword [ebp - 0x284], 0
mov word [ebp - 0x294], ax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x280], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x544fc3
sub eax, edx
lea ecx, [ebp - 0x294]
sar eax, 1
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00426d40
mov byte [ebp - 4], 1
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x54502b
movups xmm0, xmmword [ebp - 0x294]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x284]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [esi + 4], 0x18
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x280], 7
mov word [ebp - 0x294], ax
jmp 0x54503a
lea ecx, [ebp - 0x294]
push ecx
push eax
mov ecx, esi
call fcn.0050b3c0
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0
call fcn.00426ce0
lea eax, [ebp - 0x278]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x544f90
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x279], 1
jmp 0x545076
mov byte [ebp - 0x279], 0
lea ecx, [ebp - 0x28]
call fcn.00426ce0
mov al, byte [ebp - 0x279]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret
Function at 0x546300
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73aa06
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x80
push eax
lea eax, [ebp - 0x118]
mov esi, 1
push eax
push 6
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
je 0x546404
lea ecx, [ebp - 0x118]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x546366
sub ecx, edx
lea eax, [ebp - 0x118]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00426d40
xor eax, eax
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5463b0
sub ecx, edx
lea eax, [ebp - 0x118]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x240]
call fcn.00426d40
push edi
lea eax, [ebp - 0x240]
mov dword [ebp - 4], 0
push eax
push 1
call fcn.004862b0
lea ecx, [ebp - 0x240]
mov bl, al
call fcn.00426ce0
test bl, bl
je 0x54649c
xor eax, eax
jmp 0x54649e
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x80
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov dword [ebp - 0x248], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x244], 7
mov word [ebp - 0x258], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x546450
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x258]
call fcn.00426d40
push edi
lea eax, [ebp - 0x258]
mov dword [ebp - 4], 1
push eax
push 1
call fcn.004862b0
lea ecx, [ebp - 0x258]
mov bl, al
call fcn.00426ce0
xor eax, eax
test bl, bl
cmovne esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret
Function at 0x546a50
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73aad8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x38
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x34], 0xff
jb 0x546aac
mov eax, dword [esi]
mov byte [eax], 0
lea eax, [ebp - 0x30]
movups xmm0, xmmword [0x7ea370]
push eax
push 0
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x546b81
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x546b81
mov ecx, edx
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x546b06
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4c]
call fcn.00426d40
mov edx, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0053bd60
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call fcn.00426ce0
push 1
push 0x79f118
mov ecx, esi
call fcn.0044ab30
push 5
push 0x7ea10c
mov ecx, esi
call fcn.0044ab30
push 1
push 0x79f118
mov ecx, esi
call fcn.0044ab30
push dword [ebp - 0x30]
xor esi, esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x546b86
mov esi, 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x546bb0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73ab08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x38
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x34], 0xff
jb 0x546c0c
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x30]
movups xmm0, xmmword [0x7ea3b8]
push eax
push ecx
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
push eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 4], ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x546cb3
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x546cb3
mov ecx, edx
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x546c56
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4c]
call fcn.00426d40
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
cmp esi, eax
je 0x546c8d
cmp dword [ebp - 0x38], 8
mov ecx, esi
push dword [ebp - 0x3c]
cmovae eax, dword [ebp - 0x4c]
push eax
call fcn.00426d40
lea ecx, [ebp - 0x4c]
call fcn.00426ce0
push dword [ebp - 0x30]
xor esi, esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x546cb8
mov esi, 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x546ce0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73ab38
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x2c], 0xff
jb 0x546d28
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x28]
movups xmm0, xmmword [0x7ea3a8]
push eax
push ecx
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], ecx
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 4], ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x546dc9
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x546dc9
mov ecx, edx
mov dword [ebp - 0x34], 0
xor eax, eax
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x546d72
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x44]
call fcn.00426d40
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
cmp esi, eax
je 0x546da9
cmp dword [ebp - 0x30], 8
mov ecx, esi
push dword [ebp - 0x34]
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.00426d40
lea ecx, [ebp - 0x44]
call fcn.00426ce0
push dword [ebp - 0x28]
xor esi, esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x546dce
mov esi, 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret