joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f730
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0
push 0
call fcn.0040ea80
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x60]
push ecx
call fcn.0040eaa0
add esp, 8
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x164]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x40f7b2
push 0x483225
mov ecx, dword [ebp + 8]
call fcn.00404ab0
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
jmp 0x40f882
push str.TrustAgentlogsTAInstall
push 0x104
lea ecx, [ebp - 0x164]
push ecx
call fcn.004588c4
add esp, 0xc
push 0
lea edx, [ebp - 0x164]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x40f813
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x40f813
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40f813
push 0x483226
mov ecx, dword [ebp + 8]
call fcn.00404ab0
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
jmp 0x40f882
lea ecx, [ebp - 0x164]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00404ab0
mov dword [ebp - 4], 0
mov byte [ebp - 0xd], 0x5c
lea ecx, [ebp - 0x3c]
call fcn.00404350
sub eax, 1
push eax
lea ecx, [ebp - 0x3c]
call fcn.004047e0
movsx edx, byte [eax]
movsx eax, byte [ebp - 0xd]
cmp edx, eax
je 0x40f85b
movzx ecx, byte [ebp - 0xd]
push ecx
push 1
lea ecx, [ebp - 0x3c]
call fcn.004082b0
lea edx, [ebp - 0x3c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004049e0
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00404920
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x410130
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x411f90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c], 0xffffffff
je 0x411fab
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x1c], 0
jne 0x411fb3
mov ecx, dword [ebp - 8]
call fcn.00411a50
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0x10]
push edx
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41205b
cmp dword [ebp - 0x10], 4
jne 0x41205b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6d
jne 0x411ff9
mov byte [ebp - 1], 1
jmp 0x411ffd
mov byte [ebp - 1], 0
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 1]
mov byte [eax], cl
push 0
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404750
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004047a0
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x412059
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x412059
mov ecx, dword [ebp + 8]
call fcn.004047a0
push eax
push str._Receive_succeed_:_s_n
call fcn.004119d0
add esp, 8
mov al, 1
jmp 0x41208a
jmp 0x41207c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6d
jne 0x412070
mov byte [ebp - 2], 1
jmp 0x412074
mov byte [ebp - 2], 0
mov edx, dword [ebp + 0xc]
mov al, byte [ebp - 2]
mov byte [edx], al
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00404750
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x412090
Capabilities:
Connect pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jne 0x412108
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x4120c1
mov byte [ebp - 1], 1
jmp 0x4120c5
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
test ecx, ecx
jne 0x412108
push str.Not_Connect_n
call fcn.004119d0
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.00411a50
movzx edx, al
test edx, edx
jne 0x412108
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x217
je 0x412108
xor al, al
jmp 0x4121cd
mov ecx, dword [ebp - 8]
call fcn.00411d80
movzx eax, al
test eax, eax
jne 0x41213a
push str.Not_Init_n
call fcn.004119d0
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.00411a50
movzx ecx, al
test ecx, ecx
jne 0x41213a
xor al, al
jmp 0x4121cd
mov ecx, dword [ebp + 8]
call fcn.004047a0
push eax
push str._Send_succeed_:_s_n
call fcn.004119d0
add esp, 8
mov ecx, dword [ebp + 8]
call fcn.00404350
mov dword [ebp - 0x14], eax
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41219e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x18], 0
jne 0x41219a
mov ecx, dword [ebp - 8]
call fcn.00411f60
jmp 0x412108
xor al, al
jmp 0x4121cd
push 0
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404350
push eax
mov ecx, dword [ebp + 8]
call fcn.004047a0
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4121cb
xor al, al
jmp 0x4121cd
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x418fd0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470f00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x270
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x27c], 0x22c
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x419021
xor al, al
jmp 0x41912d
lea edx, [ebp - 0x27c]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x41912b
lea ecx, [ebp - 0x258]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00404640
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00404350
push eax
lea ecx, [ebp - 0x38]
call fcn.00404370
push eax
lea edx, [ebp - 0x50]
push edx
call fcn.00414960
add esp, 0xc
mov byte [ebp - 4], 1
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x14], 0
jmp 0x419088
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
call fcn.00403f50
cmp dword [ebp - 0x14], eax
jae 0x4190d0
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.00413810
push eax
call fcn.004169e0
add esp, 8
movzx eax, al
test eax, eax
je 0x4190ce
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00413810
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00415500
mov byte [ebp - 0xd], 1
jmp 0x41907f
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x41910b
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00404920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00404510
jmp 0x419021
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x419db0
Capabilities:
Copy file
Delete file
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [ebp + 8]
cmp eax, dword [0x494b34]
jae 0x419ddb
jmp 0x419f98
cmp dword [ebp + 0xc], 0
jne 0x419de6
jmp 0x419f98
lea ecx, [ebp - 0x10]
call fcn.0041a0b0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 8
ja 0x419e01
cmp dword [ebp + 8], 0
jae 0x419e08
mov dword [ebp + 8], 0
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.GWCLI
mov edx, dword [ebp + 8]
shl edx, 4
add edx, 0x494aa0
push edx
movzx eax, word [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x26]
push ecx
movzx edx, word [ebp - 0x28]
push edx
movzx eax, word [ebp - 0x2a]
push eax
movzx ecx, word [ebp - 0x2e]
push ecx
push str.__02d__02d__02d:_02d:_02d___s___s_
lea edx, [ebp - 0x10]
push edx
call fcn.0041a950
add esp, 0x24
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x10]
call fcn.00419fb0
mov dword [ebp - 0x18], 0
push 0x4854f8
lea ecx, [ebp - 0x10]
call fcn.0041a040
push 0x4854fc
lea ecx, [ebp - 0x10]
call fcn.0041a070
mov eax, dword [0x494b30]
and eax, 1
je 0x419ea8
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x419ea8
lea ecx, [ebp - 0x10]
call fcn.00402550
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [0x494b30]
and ecx, 2
je 0x419f89
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push 0
push 0x80
push 4
push 0
push 5
push 0x40000000
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x419f66
push 2
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x400000
jbe 0x419f09
mov dword [ebp - 0x1c], 1
push 2
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x500000
jbe 0x419f3a
push 0
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041a0d0
push eax
lea ecx, [ebp - 0x10]
call fcn.00402550
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0
je 0x419f89
push 0
push str.c:gwlogbk.txt
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041a090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41aca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x41acb9
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x41acbd
xor al, al
jmp 0x41acf7
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41accf
xor al, al
jmp 0x41acf7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.0041ad00
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jne 0x41aced
mov dword [ebp - 4], 1
jmp 0x41acf4
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x41aec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x40]
call fcn.004046a0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsInterfaceLayer.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41af8f
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0x208
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push str.Path
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41af55
mov dword [ebp - 0x18], 1
jmp 0x41af5c
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24], 0
je 0x41af8f
cmp dword [ebp - 0x14], 4
je 0x41af7e
cmp dword [ebp - 0x14], 5
jne 0x41af80
jmp 0x41af8f
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0040e8f0
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp + 8]
call fcn.004045d0
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404510
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x41afd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x40]
call fcn.004046a0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4857d8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b09f
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0x208
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push 0x485860
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b065
mov dword [ebp - 0x18], 1
jmp 0x41b06c
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24], 0
je 0x41b09f
cmp dword [ebp - 0x14], 4
je 0x41b08e
cmp dword [ebp - 0x14], 5
jne 0x41b090
jmp 0x41b09f
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0040e8f0
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp + 8]
call fcn.004045d0
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404510
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x41eca0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471172
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041f4a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0041f3c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00417400
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x10], 0
jne 0x41ed59
push 0x14
call fcn.0043897c
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x41ed36
push 0
push 0x10000
mov ecx, dword [ebp - 0x14]
call fcn.0041f4d0
mov dword [ebp - 0x18], eax
jmp 0x41ed3d
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x468
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x4286d6
push 0x410
push 0
lea ecx, [ebp - 0x474]
push ecx
call fcn.00450820
add esp, 0xc
lea edx, [ebp - 0x474]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4286be
push 0x486484
lea ecx, [ebp - 0x34]
call fcn.00404640
mov dword [ebp - 4], 0
push 0x486488
lea ecx, [ebp - 0x34]
call fcn.0040cf70
push 0x486498
lea ecx, [ebp - 0x34]
call fcn.0040cf70
lea ecx, [ebp - 0x34]
call fcn.00404370
push eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.0042f170
add esp, 8
push 0x4864a4
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 1
push 0x4864c4
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.00404370
push eax
lea eax, [ebp - 0x474]
push eax
push 0
lea ecx, [ebp - 0x64]
call fcn.00404370
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00428b10
movzx ecx, al
test ecx, ecx
jne 0x42868e
push 0x4864dc
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
mov byte [ebp - 0xd], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00404510
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00404510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404510
mov al, byte [ebp - 0xd]
jmp 0x4286ec
mov byte [ebp - 0xe], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00404510
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00404510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404510
mov al, byte [ebp - 0xe]
jmp 0x4286ec
push 0x4864f8
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
xor al, al
jmp 0x4286ec
push 0x486518
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x428700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4713c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x428875
push 0x410
push 0
lea ecx, [ebp - 0x470]
push ecx
call fcn.00450820
add esp, 0xc
lea edx, [ebp - 0x470]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x42885f
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x7f]
test edx, edx
je 0x42885d
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x30]
call fcn.00404640
mov dword [ebp - 4], 0
push 0x486684
lea ecx, [ebp - 0x30]
call fcn.00404450
push 0x486688
lea ecx, [ebp - 0x30]
call fcn.00404450
push 0x486698
lea ecx, [ebp - 0x30]
call fcn.00404450
push 0x4866a4
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
lea edx, [ebp - 0x60]
push edx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 1
push 0x4866c4
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.00404370
push eax
lea ecx, [ebp - 0x30]
call fcn.00404370
push eax
push 0
lea ecx, [ebp - 0x60]
call fcn.00404370
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00428b10
movzx edx, al
test edx, edx
jne 0x428836
push str.create_link_file_start_menu_about_zero_trust_startup_failed_
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00404510
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.00404510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00404510
jmp 0x428889
push 0x48671c
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
jmp 0x428889
push 0x48673c
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4288a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471416
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4b4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x428ae4
push 0x410
push 0
lea ecx, [ebp - 0x4c0]
push ecx
call fcn.00450820
add esp, 0xc
lea edx, [ebp - 0x4c0]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x428ace
push 0x486760
lea ecx, [ebp - 0x50]
call fcn.00404640
mov dword [ebp - 4], 0
push 0x486764
lea ecx, [ebp - 0x50]
call fcn.0040cf70
lea ecx, [ebp - 0x50]
call fcn.00404370
push eax
lea ecx, [ebp - 0x4c0]
push ecx
call fcn.0042f170
add esp, 8
lea edx, [ebp - 0x4c0]
push edx
lea ecx, [ebp - 0x68]
call fcn.00404640
mov byte [ebp - 4], 1
lea eax, [ebp - 0x68]
push eax
call fcn.00403320
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x42897a
mov dword [ebp - 0x1c], 1
jmp 0x428981
mov dword [ebp - 0x1c], 0
mov dl, byte [ebp - 0x1c]
mov byte [ebp - 0xd], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.00404510
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x4289c6
lea ecx, [ebp - 0x4c0]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00404640
mov byte [ebp - 4], 2
lea edx, [ebp - 0x80]
push edx
call fcn.00403190
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80]
call fcn.00404510
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x7c]
test ecx, ecx
jne 0x428abd
lea edx, [ebp - 0x4c0]
push edx
lea ecx, [ebp - 0x38]
call fcn.00404640
mov byte [ebp - 4], 3
push 0x486774
lea ecx, [ebp - 0x38]
call fcn.00404450
push 0x48677c
lea ecx, [ebp - 0x38]
call fcn.00404450
push str..lnk
lea ecx, [ebp - 0x38]
call fcn.00404450
push 0x486798
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
lea ecx, [ebp - 0xb0]
push ecx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 4
push str._setup.ico
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
lea eax, [ebp - 0x98]
push eax
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x98]
call fcn.00404370
push eax
lea ecx, [ebp - 0x38]
call fcn.00404370
push eax
push 0
lea ecx, [ebp - 0xb0]
call fcn.00404370
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00428b10
movzx ecx, al
test ecx, ecx
jne 0x428a93
push str.create_link_file_start_menu_about_zero_trust_offload__failed_
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x98]
call fcn.00404510
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb0]
call fcn.00404510
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00404510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.00404510
jmp 0x428af8
push str.SHGetPathFromIDListW_failed_
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
jmp 0x428af8
push str.SHGetSpecialFolderLocation_failed_
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret