joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f72
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf0000000
push 0x18
xor esi, esi
push esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 1
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4040a4
push edi
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push 0x660e
push dword [ebp - 8]
push 0x10
pop edi
call fcn.00403390
add esp, 0x18
test eax, eax
je 0x404084
mov edi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push esi
lea eax, [ebp - 0x10]
push eax
push 4
push dword [ebp - 4]
call edi
test eax, eax
je 0x404066
push esi
push dword [ebp + 0xc]
push 1
push dword [ebp - 4]
call edi
test eax, eax
je 0x404058
push dword [ebp + 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp edi, esi
je 0x404079
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
push eax
push dword [ebp + 0x10]
mov dword [ecx], eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp + 0x1c]
push edi
push esi
push 1
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov dword [ebp - 0xc], eax
cmp eax, esi
jne 0x404079
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptDecrypt__0x_08x__n
call fcn.00409709
mov edi, dword [ebp + 0x18]
pop ecx
pop ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [edi], eax
mov eax, dword [ebp + 0x1c]
mov dword [eax], esi
jmp 0x404079
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptSetKeyParam__IV___0x_08x__n
jmp 0x404072
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptSetKeyParam__MODE___0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x404097
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___kull_m_crypto_hkey__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
jmp 0x4040b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptAcquireContext__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
mov eax, dword [ebp - 0xc]
pop esi
leave
ret
Function at 0x40414d
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
xor edi, edi
xor esi, esi
inc esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
call fcn.0040f198
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x40420e
push 8
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4041f2
lea eax, [ebp - 8]
push eax
push esi
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x4041d5
push dword [ebp + 0x18]
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404214
add esp, 0x10
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x4041e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptImportKey__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.004034e7
jmp 0x404204
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptAcquireContext__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x40490b
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
mov dword [edi], ebx
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x404992
push ebx
push esi
push ebx
push ebx
push 1
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x404989
push dword [esi]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
cmp eax, ebx
je 0x404989
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [esi]
lea eax, [ebp + 0x10]
push eax
push dword [edi]
push ebx
push 1
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x404989
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [edi], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 8]
pop ebx
leave
ret
Function at 0x404998
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push edi
xor edi, edi
mov dword [esi], edi
mov dword [eax], ebx
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x404a05
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
cmp eax, edi
je 0x4049fc
push ebx
push dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp + 0x10]
push dword [esi]
push edi
push 1
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x4049fc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 8]
pop edi
leave
ret
Function at 0x40563f
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push 0x9c
push 0x4f5b28
call fcn.0049dba0
mov byte [ebp - 0x44], 0
xor eax, eax
lea edi, [ebp - 0x43]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x4c]
lea ebx, [ebp - 0x38]
call fcn.0040551c
add esp, 0x14
mov dword [ebp - 0x20], eax
xor edi, edi
cmp eax, edi
jl 0x4057a9
lea eax, [ebp - 0xac]
push eax
push dword [ebp + 0x1c]
push dword [ebp - 0x28]
call fcn.004055dc
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp eax, edi
jl 0x405777
push dword [ebp - 0x2c]
push 0x40
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x405784
push edi
push 0x20
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0x2c]
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x30]
call sub.bcrypt.dll_BCryptGenerateSymmetricKey
mov dword [ebp - 0x20], eax
cmp eax, edi
jl 0x405761
push esi
push edi
lea eax, [ebp - 0x8c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], 1
lea eax, [ebp - 0x44]
mov dword [ebp - 0x84], eax
push 0xc
pop eax
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], 0x10
push edi
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x8c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x24]
call sub.bcrypt.dll_BCryptDecrypt
mov dword [ebp - 0x20], eax
push dword [ebp - 0x24]
call sub.bcrypt.dll_BCryptDestroyKey
jmp 0x40576e
push eax
push str.ERROR_SkpEncryptionWorker___BCryptGenerateSymmetricKey:_0x_08x_n
call fcn.00409709
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x405784
push eax
push str.ERROR_SkpEncryptionWorker___SkpDeriveSymmetricKey:_0x_08x_n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 0x28]
call sub.bcrypt.dll_BCryptDestroyKey
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
push dword [ebp - 0x38]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
push edi
push dword [ebp - 0x30]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
jmp 0x4057d9
push eax
push str.ERROR_SkpEncryptionWorker___SkpInitSymmetricEncryption:_0x_08x_n
call fcn.00409709
pop ecx
jmp 0x4057d8
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
call fcn.0049dbdb
ret
Function at 0x406658
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xa0
and dword [ebp + 0x50], 0
push ebx
push esi
push edi
push 0x40
mov edi, eax
lea eax, [ebp - 8]
push 0x36
push eax
call sub.msvcrt.dll_memset
push 0x40
lea eax, [ebp - 0x48]
push 0x5c
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
test edi, edi
jbe 0x4066a6
mov eax, dword [ebp + 0x60]
lea edx, [ebp - 8]
lea esi, [ebp - 0x48]
sub edx, eax
sub esi, eax
mov cl, byte [eax]
xor byte [edx + eax], cl
xor byte [esi + eax], cl
inc eax
dec edi
jne 0x40669a
mov eax, dword [ebp + 0x68]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, 0x40
push eax
push 0x40
mov dword [ebp + 0x4c], eax
call ebx
mov dword [ebp + 0x54], eax
test eax, eax
je 0x406795
push 0x10
pop ecx
push dword [ebp + 0x68]
mov edi, eax
push dword [ebp + 0x64]
add eax, 0x40
lea esi, [ebp - 8]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memcpy
push 0x14
lea eax, [ebp + 0x38]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x54]
push 0x8004
call fcn.0040325b
add esp, 0x20
test eax, eax
je 0x40678c
mov ecx, dword [ebp + 0x78]
mov eax, dword [ebp + 0x70]
lea eax, [eax + ecx + 0x54]
push eax
push 0x40
mov dword [ebp + 0x68], eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x40678c
cmp dword [ebp + 0x6c], 0
push 0x10
pop ecx
lea esi, [ebp - 0x48]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [ebx + 0x40]
pop ecx
lea esi, [ebp + 0x38]
rep movsd dword es:[edi], dword [esi]
je 0x40674a
cmp dword [ebp + 0x70], 0
je 0x40674a
push dword [ebp + 0x70]
lea eax, [ebx + 0x54]
push dword [ebp + 0x6c]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp + 0x74], 0
je 0x40676c
cmp dword [ebp + 0x78], 0
je 0x40676c
push dword [ebp + 0x78]
mov eax, dword [ebp + 0x70]
push dword [ebp + 0x74]
lea eax, [ebx + eax + 0x54]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0x14
push dword [ebp + 0x7c]
push dword [ebp + 0x68]
push ebx
push 0x8004
call fcn.0040325b
add esp, 0x14
push ebx
mov dword [ebp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 0x50]
pop edi
pop esi
pop ebx
add ebp, 0x58
leave
ret
Function at 0x406aa7
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
mov esi, edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
cmp dword [ebp + 0x1c], ebx
je 0x406b3a
cmp dword [ebp + 0x20], ebx
je 0x406b3a
push eax
call fcn.004057e6
mov ebx, eax
pop ecx
test ebx, ebx
je 0x406b8e
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x24]
push edi
push esi
push dword [ebp + 0x20]
mov esi, ebx
push dword [ebp + 0x1c]
call fcn.004068aa
add esp, 0x1c
mov dword [ebp - 4], eax
test eax, eax
je 0x406b31
mov esi, dword [ebp + 8]
test esi, esi
je 0x406b31
cmp dword [ebx + 0x30], 0
je 0x406b31
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x406b31
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
test eax, eax
je 0x406b31
push dword [ebx + 0x2c]
push dword [ebx + 0x30]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, ebx
call fcn.004058c3
jmp 0x406b8e
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push dword [ebp + 0xc]
push ebx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x406b8e
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + 0x18]
push eax
push 0x40
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp eax, ebx
je 0x406b85
push dword [esi]
push dword [ebp - 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x407749
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
push edi
mov dword [ebp - 8], 0x8004
cmp eax, 0x8009
je 0x40776c
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.00403d6c
push dword [esi + 0x28]
call fcn.00403e3e
push dword [esi + 0x28]
mov ebx, eax
call fcn.00403dcf
add esp, 0xc
lea edi, [eax + ebx]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4078e7
push 1
push edi
push eax
push dword [esi + 0x20]
lea eax, [esi + 0x34]
push eax
push 0x14
push dword [ebp + 8]
push dword [ebp - 8]
push 0x10
pop eax
call fcn.004036a9
add esp, 0x20
test eax, eax
je 0x4078de
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
xor edi, edi
push edi
push ebx
push dword [ebp - 0x10]
push dword [esi + 0x28]
call fcn.00403b70
add esp, 0x18
test eax, eax
je 0x4078cb
mov eax, dword [ebp - 0x10]
push edi
add eax, ebx
push eax
push 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x4078a7
mov eax, dword [esi + 0x4c]
push eax
push 0x40
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x4078a7
push dword [ebp - 0x14]
push dword [esi + 0x48]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4078a0
mov edi, dword [esi + 0x2c]
push 0x14
pop eax
cmp edi, eax
jae 0x40784b
mov eax, edi
push eax
push ebx
push dword [ebp + 0x10]
call sub.msvcrt.dll_memcpy
mov esi, dword [esi + 0x30]
add esp, 0xc
push 0x10
pop eax
cmp esi, eax
jae 0x407864
mov eax, esi
push eax
add edi, ebx
push edi
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcpy
lea eax, [esi - 0x10]
add esp, 0xc
mov dword [ebp - 4], 1
test eax, eax
je 0x4078a0
xor esi, esi
test eax, eax
jbe 0x4078a0
add edi, 0x10
cmp dword [ebp - 4], 0
je 0x4078a0
xor ecx, ecx
cmp byte [edi], cl
sete cl
and dword [ebp - 4], ecx
inc esi
inc edi
cmp esi, eax
jb 0x40788a
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0x18]
call fcn.004034e7
pop ecx
test eax, eax
jne 0x4078de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_close_hprov_delete_container__0x_08x__n
jmp 0x4078d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_dpapi_unprotect_credhist_entry_with_shaDerivedkey___kull_m_crypto_hkey_session__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407a3a
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [0x4fdee8], edi
je 0x407ae2
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
lea eax, [ebp - 4]
push eax
push edi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x407b2e
mov eax, dword [ebp - 4]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x407b2e
lea eax, [ebp - 4]
push eax
push ebx
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
mov dword [ebp - 8], eax
cmp eax, edi
je 0x407ad9
push dword [ebp + 8]
push str._n_nBase64_of_file_:__s_n_n
call fcn.00409709
pop ecx
xor esi, esi
pop ecx
cmp dword [ebp - 4], edi
jbe 0x407ace
movzx eax, word [ebx + esi*2]
push eax
push 0x4b3d60
call fcn.00409709
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 4]
jb 0x407ab7
push str._n
call fcn.00409709
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x407b2e
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, edi
je 0x407b2e
cmp esi, 0xffffffff
je 0x407b2e
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407b27
cmp edi, dword [ebp - 4]
jne 0x407b27
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407b36
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
mov ebx, eax
mov dword [ebp - 4], esi
cmp dword [0x4fdeec], esi
je 0x407b7b
push edi
push dword [ebp + 8]
call fcn.0040f58c
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x407bff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_file_readGeneric___kull_m_string_quick_base64_to_Binary__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
jmp 0x407bff
push esi
push dword [ebp + 0xc]
push 3
push esi
push 3
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x407bff
cmp eax, 0xffffffff
je 0x407bff
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x407bf6
cmp dword [ebp - 0x10], esi
jne 0x407bf6
mov eax, dword [ebp - 0x14]
push eax
push 0x40
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
cmp eax, esi
je 0x407bf6
push esi
lea ecx, [ebp - 0xc]
push ecx
push dword [ebx]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407beb
mov eax, dword [ebx]
cmp eax, dword [ebp - 0xc]
jne 0x407beb
mov dword [ebp - 4], 1
jmp 0x407bf6
push dword [edi]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x407c39
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407e59
test al, 0x10
je 0x407e59
cmp dword [ebp + 0x18], ebx
je 0x407ca7
cmp dword [ebp + 0x14], ebx
jne 0x407ca7
push dword [ebp + 8]
push 0x4ab22c
push ebx
push str._sDirectory__s
call fcn.00409709
add esp, 0x10
cmp dword [ebp + 0xc], ebx
je 0x407c9c
push dword [ebp + 0xc]
push 0x4b3e5c
call fcn.00409709
pop ecx
pop ecx
push 0x49ed98
call fcn.00409709
pop ecx
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x407e59
push dword [ebp + 8]
mov edi, 0x104
push edi
push esi
call fcn.004972e7
add esp, 0xc
test eax, eax
jne 0x407e52
push 0x4b3e68
push edi
push esi
call fcn.0049726a
add esp, 0xc
test eax, eax
jne 0x407e52
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jne 0x407cfb
mov eax, 0x4b3e6c
push eax
push edi
push esi
call fcn.0049726a
add esp, 0xc
test eax, eax
jne 0x407e52
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x407e52
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
lea eax, [esp + 0x44]
push 0x4b3e70
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x407e31
lea eax, [esp + 0x44]
push 0x4b3e74
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x407e31
push dword [ebp + 8]
push edi
push esi
call fcn.004972e7
add esp, 0xc
test eax, eax
jne 0x407e31
push 0x4b3e68
push edi
push esi
call fcn.0049726a
add esp, 0xc
test eax, eax
jne 0x407e31
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x407d8a
sub eax, edx
sar eax, 1
mov ebx, eax
lea eax, [esp + 0x44]
push eax
push edi
push esi
call fcn.0049726a
add esp, 0xc
test eax, eax
jne 0x407e31
cmp dword [ebp + 0x18], eax
je 0x407de4
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x1c]
shr eax, 3
not eax
and eax, 2
or eax, 0x44
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0x4ab22c
add eax, eax
push eax
push str._s_3u__c_s_n
call fcn.00409709
add esp, 0x18
xor eax, eax
cmp dword [ebp + 0x1c], eax
jne 0x407e16
test byte [esp + 0x18], 0x10
je 0x407e16
cmp dword [ebp + 0x10], eax
je 0x407e31
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
push dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
inc eax
push eax
push 1
push dword [ebp + 0xc]
push esi
call fcn.00407c39
add esp, 0x20
jmp 0x407e29
cmp dword [ebp + 0x20], eax
je 0x407e31
push dword [ebp + 0x24]
lea eax, [esi + ebx*2]
push eax
push esi
push dword [ebp + 0x14]
call dword [ebp + 0x20]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x407e48
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407d27
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c32
Capabilities:
Get domain controller name

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea ecx, [ebp - 4]
push ecx
xor edi, edi
or eax, 0x40020000
push eax
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
push edi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, edi
jne 0x408ca7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 4
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x408c61
sub eax, ecx
push esi
sar eax, 1
lea esi, [eax + eax + 2]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, edi
je 0x408c9c
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
push esi
add ecx, 4
push ecx
xor edi, edi
push eax
inc edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
pop esi
jmp 0x408cb4
push eax
push str.ERROR_kull_m_net_getDC___DsGetDcName:__u_n
call fcn.00409709
pop ecx
pop ecx
mov eax, edi
pop edi
leave
ret

Function at 0x408cb9
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor ecx, ecx
neg eax
sbb eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
and eax, 3
push edi
add eax, 4
mov edi, eax
lea eax, [ebp - 4]
push eax
push ecx
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
call esi
test eax, eax
jne 0x408d33
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x408d33
mov eax, dword [ebp - 4]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebx], eax
test eax, eax
je 0x408d46
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call esi
mov dword [ebp - 8], eax
test eax, eax
jne 0x408d46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_data___0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x408d46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_init___0x_08x__n
call fcn.00409709
pop ecx
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret