joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407080
Capabilities:
Get file version info

Disassembly:
sub esp, 0x31c
mov eax, dword [0x5af640]
xor eax, esp
mov dword [esp + 0x318], eax
push ebp
push esi
xor esi, esi
push 0x103
lea eax, [esp + 0x19]
push esi
mov dword [esp + 0x10], esi
push eax
mov byte [esp + 0x20], 0
call fcn.00523080
add esp, 0xc
push 0x208
lea ecx, [esp + 0x11c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x11c]
push eax
mov dword [esp + 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
cmp ebp, esi
je 0x40716e
push edi
push ebp
push 2
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0x10]
mov edi, eax
push edi
push ebp
push ecx
lea edx, [esp + 0x128]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x5883bc
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov di, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
push edx
push eax
lea ecx, [esp + 0x28]
push str._d._d._d._d
push ecx
call fcn.0052768c
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
pop edi
mov dword [ebx + 0x14], esi
lea eax, [esp + 0x14]
pop esi
mov dword [ebx + 0x18], 0xf
mov byte [ebx + 4], 0
lea edx, [eax + 1]
pop ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407185
sub eax, edx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, ebx
call fcn.0040c600
mov ecx, dword [esp + 0x318]
xor ecx, esp
mov eax, ebx
call fcn.00522f5c
add esp, 0x31c
ret

Function at 0x4071c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5af640]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.00523080
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x114]
sbb eax, eax
xor ecx, esp
inc eax
call fcn.00522f5c
add esp, 0x118
ret
Function at 0x407220
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x21c
mov eax, dword [0x5af640]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebp
mov ebp, dword [esp + 0x228]
push esi
push 0
mov esi, ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 8]
push ecx
push 0x5882e0
push 1
push 0
push 0x585278
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x407294
mov eax, dword [esp + 8]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0xc]
push ecx
push 0x5851b8
push eax
call edx
test eax, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
jge 0x40729b
mov edx, dword [ecx + 8]
push eax
call edx
xor al, al
jmp 0x40734d
test esi, esi
jne 0x4072ae
mov edx, dword [0x5b6a00]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
jmp 0x4072b5
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
test edi, edi
je 0x4072de
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4072c0
sub eax, edx
sar eax, 1
je 0x4072de
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push edi
push eax
call edx
test ebx, ebx
je 0x4072ef
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push ebx
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 0
push eax
call edx
test ebp, ebp
je 0x407319
mov eax, dword [esp + 0x10]
push ebp
push eax
lea ecx, [esp + 0x20]
push str._s_s
push ecx
call fcn.00523131
add esp, 0x10
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 1
lea ecx, [esp + 0x1c]
push ecx
push eax
call edx
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
test esi, esi
setge al
mov ecx, dword [esp + 0x220]
pop esi
pop ebp
xor ecx, esp
call fcn.00522f5c
add esp, 0x21c
ret 8
Function at 0x407e00
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x54de00
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
push esi
xor edi, edi
push edi
push 0x407fa0
call fcn.005238d5
mov dword [esi + 0x3ec], eax
add esp, 0xc
lea eax, [esp + 0x28]
push eax
call fcn.00409850
lea ecx, [esp + 0x28]
lea ebx, [esi + 0x25c]
push ecx
mov dword [esp + 0x4c], edi
call fcn.004096f0
lea edx, [esp + 0x10]
push edx
call fcn.00409850
lea eax, [esp + 0x10]
lea ebx, [esi + 0x274]
push eax
mov byte [esp + 0x4c], 1
call fcn.004096f0
mov ecx, dword [esp + 0x38]
sub ecx, dword [esp + 0x34]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x407ebc
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x1c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x407ebc
mov eax, esi
call fcn.00407f60
jmp 0x407ecb
push esi
push edi
push 0x407370
call fcn.005238d5
add esp, 0xc
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x407eef
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
push ecx
push edx
call fcn.00411260
mov eax, dword [esp + 0x24]
push eax
call fcn.004508d0
add esp, 0xc
mov ecx, dword [esp + 0x10]
push ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call fcn.004508d0
mov eax, dword [esp + 0x38]
add esp, 4
cmp eax, edi
je 0x407f2c
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
push edx
push ecx
call fcn.00411260
mov edx, dword [esp + 0x3c]
push edx
call fcn.004508d0
add esp, 0xc
mov eax, dword [esp + 0x28]
push eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call fcn.004508d0
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x40
ret
Function at 0x40c900
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x548ceb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.005224cc
push 4
mov dword [esp + 0x24], 0
call fcn.00450896
mov edi, eax
add esp, 4
test edi, edi
je 0x40c982
call fcn.00521cf2
mov dword [edi], eax
call fcn.00521b20
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00521a44
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40c977
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00521a6c
jmp 0x40c984
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x410210
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5494f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.0040ae40
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x410270
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0040cb10
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.0040ae40
cmp dword [esp + 0x28], 8
jb 0x4102bd
mov eax, dword [esp + 0x14]
push eax
call fcn.004508d0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x412010
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x54d368
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5af640]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x23c]
mov edi, ecx
xor ebx, ebx
lea ecx, [edi + 0x10]
mov dword [edi], ebx
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x588181
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], eax
mov byte [ecx + 4], bl
call fcn.0040c600
lea ecx, [edi + 0x2c]
mov dword [esp + 0x234], ebx
push ebx
mov esi, 7
xor edx, edx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x588b1c
mov word [ecx + 4], dx
call fcn.0040cc30
lea ebp, [edi + 0x50]
mov byte [edi + 0x48], bl
xor eax, eax
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], ax
lea esi, [edi + 0x6c]
mov byte [esp + 0x234], 2
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push ebx
mov word [esi + 4], cx
push 0x588b1c
mov ecx, esi
call fcn.0040cc30
push 0x206
lea eax, [esp + 0x22]
xor edx, edx
push ebx
mov byte [esp + 0x23c], 3
push eax
mov word [esp + 0x28], dx
call fcn.00523080
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x1c]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x412114
sub eax, ecx
sar eax, 1
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.0040cc30
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x4c], eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x412143
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, ebp
call fcn.0040cc30
call fcn.004121c0
mov ecx, edi
call fcn.00412340
test al, al
je 0x412173
cmp dword [0x5b7574], ebx
jne 0x412194
push 1
push str.ERROR
push 0x588e60
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, edi
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00522f5c
add esp, 0x224
ret 4
Function at 0x414260
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, ecx
test eax, eax
je 0x414326
test ebp, ebp
je 0x414326
mov ecx, dword [edi + 0x4c]
push ebx
push esi
push eax
movzx eax, word [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41431d
mov edx, dword [edi + 0x4c]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41431d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x18], eax
test eax, eax
je 0x41431d
mov eax, dword [edi + 0x4c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x588e88
push ebp
mov ebx, eax
call fcn.00527a8a
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x41431d
xor esi, esi
test ebx, ebx
jbe 0x41430b
lea ebx, [ebx]
mov edi, ebx
sub edi, esi
cmp edi, 0x800
jbe 0x4142f1
mov edi, 0x800
mov ecx, dword [esp + 0x18]
push ebp
push edi
lea edx, [esi + ecx]
push 1
push edx
call fcn.005286c4
add esi, edi
add esp, 0x10
cmp esi, ebx
jb 0x4142e0
push ebp
call fcn.00527dd5
add esp, 4
pop esi
pop ebx
pop edi
mov al, 1
pop ebp
ret 8
pop esi
pop ebx
pop edi
xor al, al
pop ebp
ret 8
pop edi
xor al, al
pop ebp
ret 8
Function at 0x4147c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x54c142
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x588f20
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.004156d0
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00416210
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x5b7e40]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.00415b00
test eax, eax
jne 0x4148b7
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x4148b0
or eax, 4
push ebx
push eax
call fcn.00401d90
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x416210
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x548c7b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005224cc
push 4
mov dword [esp + 0x20], 0
call fcn.00450896
mov edi, eax
add esp, 4
test edi, edi
je 0x41628e
call fcn.00521cf2
mov dword [edi], eax
call fcn.00521b20
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00521a44
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x416283
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00521a6c
jmp 0x416290
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4185b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54d313
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], edi
call fcn.00450896
add esp, 4
cmp eax, edi
je 0x418613
mov dword [eax], edi
jmp 0x418615
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.00450896
add esp, 4
cmp eax, edi
je 0x418630
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x418632
xor eax, eax
xor edx, edx
mov ecx, esi
mov dword [esi + 0x64], eax
mov dword [esi + 0x58], edi
call fcn.00421550
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x41c7c0
Capabilities:
Set registry value

Disassembly:
cmp dword [eax + 0x18], 8
mov edx, dword [eax + 0x14]
jb 0x41c7ce
mov eax, dword [eax + 4]
jmp 0x41c7d1
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x41c7dc
mov ecx, dword [ecx + 4]
jmp 0x41c7df
add ecx, 4
lea edx, [edx + edx + 2]
push edx
push eax
mov eax, dword [esp + 0xc]
push 1
push 0
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x41c807
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
ret 4
mov al, 1
ret 4

Function at 0x41c810
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x549e42
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.00526eb0
mov eax, dword [0x5af640]
xor eax, esp
mov dword [esp + 0x1010], eax
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x101c]
mov dword fs:[0], eax
mov dword [esp + 8], 0
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [esp + 0x10], esi
mov edi, ecx
mov word [esi + 4], ax
push 0x1000
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x102c], eax
push ecx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0x1000
call fcn.00523080
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x41c8a3
mov edi, dword [edi + 4]
jmp 0x41c8a6
add edi, 4
lea edx, [esp + 0xc]
push edx
mov edx, dword [ebx + 4]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x18]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c8d0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.0040cc30
mov eax, esi
mov ecx, dword [esp + 0x101c]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.00522f5c
add esp, 0x1020
ret
Function at 0x41c920
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x54aafb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5af640]
xor eax, esp
mov dword [esp + 0x224], eax
push ebp
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24c]
xor edi, edi
xor esi, esi
push 0x200
lea eax, [esp + 0x38]
push edi
push eax
mov dword [esp + 0x20], 0x200
call fcn.00523080
mov eax, dword [ebp + 4]
add esp, 0xc
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x48]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
jne 0x41ca09
xor ecx, ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41c9b7
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x20]
call fcn.0040cc30
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x248], edi
call fcn.00409640
mov dword [esp + 0x244], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x41ca10
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004508d0
add esp, 4
jmp 0x41ca10
cmp eax, 0x103
je 0x41ca1d
inc esi
cmp esi, 0x400
jl 0x41c965
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00522f5c
add esp, 0x238
ret 4
Function at 0x41cb70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x5af640]
xor eax, esp
mov dword [esp + 0x10c], eax
test byte [0x5b7eec], 1
mov eax, dword [esp + 0x11c]
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
jne 0x41cbd8
or dword [0x5b7eec], 1
push 0x54e980
mov dword [0x5b7ee8], 0xf
mov dword [0x5b7ee4], 0
mov byte [0x5b7ed4], 0
call fcn.005244ac
add esp, 4
cmp dword [0x5b7ee4], 0
jne 0x41cc3a
push 0x104
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.00523080
add esp, 0xc
push 0
push 0x21
lea eax, [esp + 0x20]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41cc10
sub eax, edx
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x5b7ed0
call fcn.0040c600
push 0x15
push str.BaasClientCookie.txt
mov eax, 0x5b7ed0
call fcn.0040e8a0
call fcn.0045e1d0
push str.Content_Type:application_x_www_form_urlencoded_charsetUTF_8
push 0
mov esi, eax
call fcn.00461090
mov ebx, eax
push ebx
push 0x2727
push esi
call fcn.0045e260
push 1
push 0x2f
push esi
call fcn.0045e260
push edi
push 0x2712
push esi
call fcn.0045e260
push ebp
push 0x271f
push esi
call fcn.0045e260
mov edx, dword [esp + 0x160]
push edx
push 0x3c
push esi
call fcn.0045e260
add esp, 0x44
cmp dword [esp + 0x130], 0
je 0x41cca7
push 1
push 0x2a
push esi
call fcn.0045e260
add esp, 0xc
mov edi, dword [esp + 0x10]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ccb0
sub eax, edx
je 0x41ccc3
push edi
push 0x2726
jmp 0x41cd3d
mov eax, dword [0x5b7ed4]
mov edi, 0x10
cmp dword [0x5b7ee8], edi
jae 0x41ccda
mov eax, 0x5b7ed4
push 0
push eax
call fcn.00528f81
add esp, 8
test eax, eax
je 0x41cd04
mov eax, dword [0x5b7ed4]
cmp dword [0x5b7ee8], edi
jae 0x41ccfb
mov eax, 0x5b7ed4
call fcn.0041d980
test eax, eax
je 0x41cd46
mov eax, dword [0x5b7ed4]
cmp dword [0x5b7ee8], edi
jae 0x41cd16
mov eax, 0x5b7ed4
push eax
push 0x2762
push esi
call fcn.0045e260
mov eax, dword [0x5b7ed4]
add esp, 0xc
cmp dword [0x5b7ee8], edi
jae 0x41cd37
mov eax, 0x5b7ed4
push eax
push 0x272f
push esi
call fcn.0045e260
add esp, 0xc
push 0
push 0x4e2c
push esi
call fcn.0045e260
push 0x44e8a0
push 0x4e2b
push esi
call fcn.0045e260
mov eax, dword [esp + 0x2c]
push eax
push 0x2711
push esi
call fcn.0045e260
push 1
push 0x63
push esi
call fcn.0045e260
push esi
call fcn.0045e290
push esi
mov edi, eax
call fcn.0045e340
push ebx
call fcn.004610f0
mov ecx, dword [esp + 0x158]
add esp, 0x3c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00522f5c
add esp, 0x110
ret