joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d9d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x592174]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x42da52
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x42da52
test ecx, ecx
je 0x42da4e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x42da10
xor eax, eax
jmp 0x42da57
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x42da61
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0050b0b7
add esp, 0xc
ret 0xc

Function at 0x42eb50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x578e40
push 0x50db50
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x592174]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x434], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x42ebaa
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0042ec90
mov bl, al
mov byte [ebp - 0x42d], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x42ebed
test bl, bl
jne 0x42ec6e
cmp edi, 0x1a
jne 0x42ec6e
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x42ec07
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp - 0x42c]
push eax
call fcn.0050d5d0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x42c]
push eax
push 0x568608
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x42c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ec41
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x42c]
push eax
mov ecx, esi
call fcn.00418830
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0050b0b7
mov esp, ebp
pop ebp
ret
Function at 0x431960
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x539390
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x592174]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
lea eax, [ebp + 4]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x431a29
lea edx, [ebp + 4]
mov dword [ebp], 0
xor esi, esi
mov dword [ebp - 0x14], edx
mov dword [ebp], esi
mov dword [ebp - 4], esi
cmp ebx, 0x3fe
jbe 0x431a4e
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0050b71f
add esp, 4
mov edi, eax
mov esi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp], esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x431a15
cmp eax, ebx
ja 0x431a15
mov edx, esi
xor ecx, ecx
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [edx + eax*2], ecx
jmp 0x431a76
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x431a29
push edi
call fcn.0050b728
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.0050b0b7
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x431b36
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x431b36
mov word [ebp + eax + 4], cx
xor eax, eax
xor edi, edi
test ebx, ebx
je 0x431b1b
mov ecx, dword [ebp - 0x10]
mov ebx, 2
nop word [eax + eax]
cmp word [edx + ebx - 2], 0
jne 0x431b0f
cmp eax, edi
je 0x431b0f
lea eax, [edx + eax*2]
push eax
lea ecx, [ebp - 0x30]
call fcn.00418560
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00419a70
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x431af2
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x431ae8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x431b3b
push edx
push ecx
call fcn.0050b392
add esp, 8
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov edx, dword [ebp - 0x14]
mov word [ebp - 0x30], ax
lea eax, [edi + 1]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
inc edi
add ebx, 2
cmp edi, ecx
jb 0x431a90
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x431b2f
push esi
call fcn.0050b728
add esp, 4
mov al, 1
jmp 0x431a2b
call fcn.0050b84e
call fcn.0050f799
int3
Function at 0x431b50
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x592174]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 1
mov esi, ecx
call fcn.0050b0c8
mov dword [esi], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call fcn.0050d5d0
add esp, 0x10
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x431bac
cmp dword [esp + 8], 6
mov ecx, dword [esi]
setae dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.0050b0b7
add esp, 0x120
ret
Function at 0x4350e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x435118
mov edx, dword [esp + 4]
test edx, edx
je 0x435118
cmp dword [eax], 0xffffffff
je 0x435118
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x435118
mov al, 1
ret 0xc
xor al, al
ret 0xc

Function at 0x435120
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx]
push esi
push edi
test eax, eax
je 0x43515a
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x43515a
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x43515a
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 0
push esi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43515a
cmp edi, dword [esi]
jne 0x43515a
pop edi
mov al, 1
pop esi
ret 0xc
pop edi
xor al, al
pop esi
ret 0xc

Function at 0x4351d0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x592174]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x435233
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x435233
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43520e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x435233
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0050b0b7
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.0050b0b7
add esp, 8
ret 4

Function at 0x435330
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x4353de
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x28], xmm0
call fcn.00435250
test al, al
je 0x4353de
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0
push edi
push dword [ebp + 8]
xorps xmm0, xmm0
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.00435250
test al, al
je 0x4353de
mov eax, dword [ebp + 8]
xor bl, bl
cmp dword [esp + 0x10], eax
jne 0x4353b4
cmp dword [esp + 0x14], edi
jne 0x4353b4
mov eax, dword [esi]
test eax, eax
jne 0x4353a1
xor bl, bl
jmp 0x4353b4
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x43539d
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne bl
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x24]
mov ecx, esi
movlpd qword [esp + 0x1c], xmm0
push dword [esp + 0x24]
call fcn.00435250
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x435600
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x592174]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.0050d5d0
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43567e
cmp dword [esp + 0x14], 6
jb 0x43567e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, 0x80000001
call fcn.00435410
add esp, 0xc
test al, al
je 0x43567e
cmp word [esi], 0
jne 0x4356d6
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, 0x80000000
call fcn.00435410
add esp, 0xc
test al, al
je 0x4356aa
cmp word [esi], 0
jne 0x4356d6
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, 0x80000001
call fcn.00435410
add esp, 0xc
test al, al
je 0x4356eb
cmp word [esi], 0
je 0x4356eb
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0050b0b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.0050b0b7
mov esp, ebp
pop ebp
ret
Function at 0x435d20
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x283c]
mov eax, 0x283c
call fcn.0050b9f0
push 0xffffffffffffffff
push 0x539928
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x592174]
xor eax, ebp
mov dword [ebp + 0x2838], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2000
lea eax, [ebp + 0x630]
mov dword [ebp - 0x10], 0
push 0
push eax
call fcn.0050d5d0
add esp, 0xc
mov eax, 0x22
mov word [ebp + 0x630], ax
test esi, esi
je 0x435f67
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jl 0x435f67
push esi
call edi
cmp eax, 0xffa
jge 0x435f67
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 0x630]
push eax
call esi
push 0x567fa4
lea eax, [ebp + 0x630]
push eax
call esi
push str.Shell32.dll
lea ecx, [ebp - 0x30]
call fcn.00418560
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call fcn.00430170
mov ecx, eax
call fcn.00430230
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x435e35
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x435e2b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x435f8c
push edx
push ecx
call fcn.0050b392
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
test esi, esi
je 0x435f67
push 0x568a80
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x435f67
lea ecx, [ebp]
call fcn.00435700
xor edi, edi
lea esi, [ebp]
cmp word [esi], 0
je 0x435e94
push 1
push 0
lea eax, [ebp + 0x630]
push eax
push esi
push str.open
push 0
call ebx
cmp eax, 0x20
ja 0x435ea2
inc edi
add esi, 0x210
cmp edi, 3
jl 0x435e74
jmp 0x435ec7
imul eax, edi, 0x210
cmp dword [ebp + eax + 0x208], 0
mov eax, dword [ebp + eax + 0x20c]
jne 0x435ebc
add eax, 0x10
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x435f69
push 1
push 0
push 0
lea eax, [ebp + 0x630]
push eax
push str.open
push 0
call ebx
cmp eax, 0x20
jbe 0x435eec
mov eax, 0x10
jmp 0x435f69
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
mov dword [ebp - 0x18], str._programfiles_x86__Internet_Exploreriexplore.exe
mov dword [ebp - 0x14], str._programfiles_Internet_Exploreriexplore.exe
push 0x208
lea eax, [ebp + 0x2630]
push 0
push eax
call fcn.0050d5d0
add esp, 0xc
lea eax, [ebp + 0x2630]
push 0x103
push eax
push dword [ebp + esi*4 - 0x18]
call edi
lea eax, [ebp + 0x2630]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x435f5c
push 1
push 0
lea eax, [ebp + 0x630]
push eax
lea eax, [ebp + 0x2630]
push eax
push str.open
push 0
call ebx
cmp eax, 0x20
ja 0x435ee2
inc esi
cmp esi, 2
jb 0x435f02
mov eax, dword [ebp - 0x10]
jmp 0x435f69
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2838]
xor ecx, ebp
call fcn.0050b0b7
lea esp, [ebp + 0x283c]
pop ebp
ret
call fcn.0050f799
int3
Function at 0x4380d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539c58
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x592174]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
mov edi, dword [ebp + 0xc]
push esi
push eax
call fcn.004389a0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041d8a0
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x1c], 0
test eax, eax
jne 0x438154
xor bl, bl
jmp 0x438172
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43816c
cmp eax, 0x80
je 0x43816c
xor bl, bl
jmp 0x438172
mov byte [ebp - 0x14], 1
mov bl, 1
mov byte [ebp - 0x1c], bl
mov byte [ebp - 4], 2
lea eax, [ebp - 0x39]
push eax
push edi
push esi
mov byte [ebp - 0x39], 0
call fcn.00438260
test al, al
jne 0x4381a0
cmp byte [ebp - 0x39], al
je 0x4381a0
cmp dword [esi + 0x14], 8
jb 0x438199
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
test bl, bl
je 0x4381ba
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4381b6
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4381da
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x43821d
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x438213
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43824f
push edx
push ecx
call fcn.0050b392
add esp, 8
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050b0b7
mov esp, ebp
pop ebp
ret 8
call fcn.0050f799
int3
Function at 0x439a70
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x592174]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.0050d5d0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x439b07
cmp dword [esp + 8], 6
jb 0x439b07
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.0050b0b7
add esp, 0x118
ret
Function at 0x439b20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539ed0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x592174]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.wintrust.dll
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00418830
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00430170
mov ecx, eax
call fcn.00430230
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x439bd5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439bcb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439d0e
push edx
push ecx
call fcn.0050b392
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
push 0xb
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], eax
push str.crypt32.dll
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00418830
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00430170
mov ecx, eax
call fcn.00430230
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x439c6a
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439c5d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439d13
push edx
push ecx
call fcn.0050b392
mov eax, dword [ebp - 0x10]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], cx
test edi, edi
je 0x439cfc
test eax, eax
je 0x439cfc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push edi
call esi
push str.CryptCATAdminAcquireContext
push edi
mov dword [ebx + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push edi
mov dword [ebx + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push edi
mov dword [ebx + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push edi
mov dword [ebx + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push edi
mov dword [ebx + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebx + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebx + 0x1c], eax
call esi
push str.WinVerifyTrust
push edi
mov dword [ebx + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [ebx + 0x24], eax
call esi
mov dword [ebx + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0050f799
call fcn.0050f799
int3
Function at 0x43b4d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537578
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x592174]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and edi, 0xffffb1af
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x43b50f
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push eax
call ebx
test eax, eax
je 0x43b524
mov al, 1
jmp 0x43b5c3
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.0043c750
test al, al
je 0x43b56e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x43b56e
mov bl, 1
jmp 0x43b570
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x43b5ad
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43b5a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43b5df
push edx
push ecx
call fcn.0050b392
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050b0b7
mov esp, ebp
pop ebp
ret
call fcn.0050f799
int3

Function at 0x43b5f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537578
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x592174]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43b626
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43b6d0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.0043c750
test al, al
je 0x43b67f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x43b6bc
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43b6b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43b6ed
push edx
push ecx
call fcn.0050b392
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050b0b7
mov esp, ebp
pop ebp
ret
call fcn.0050f799
int3