joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b706
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov bl, dl
mov edi, ecx
call fcn.0040b608
mov esi, eax
test esi, esi
js 0x40b838
test bl, bl
jne 0x40b73e
cmp byte [edi + 0xc], bl
je 0x40b838
lea eax, [ebp - 0x604]
push eax
push 0x20019
push 0
push dword [edi + 0x10]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x40b768
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40b838
mov eax, dword [edi]
xor ebx, ebx
mov dword [ebp - 0x61c], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x618], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x614], eax
lea eax, [ebp - 0x600]
mov byte [ebp - 0x610], 1
mov dword [ebp - 0x60c], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x608]
mov dword [ebp - 0x608], 0xff
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push dword [ebp - 0x604]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jle 0x40b7db
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40b817
lea eax, [ebp - 0x204]
push eax
push dword [edi + 0x10]
lea eax, [ebp - 0x600]
push 0x403994
push 0x1fe
push eax
call fcn.00407674
mov esi, eax
add esp, 0x14
test esi, esi
js 0x40b81f
mov dl, 1
lea ecx, [ebp - 0x61c]
call fcn.0040b706
mov esi, eax
jmp 0x40b81f
cmp esi, 0x80070103
je 0x40b82a
inc ebx
test esi, esi
jns 0x40b79d
jmp 0x40b82c
xor esi, esi
push dword [ebp - 0x604]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret

Function at 0x40b99e
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
xor esi, esi
mov ebx, edx
cmp ax, word [edi + 4]
jae 0x40b9ea
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
movzx eax, si
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x40b9e3
mov eax, dword [ebp - 4]
cmp byte [eax], 0
jne 0x40b9e3
push ebx
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40b9f5
inc esi
cmp si, word [edi + 4]
jb 0x40b9b5
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor dl, dl
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 0x10]
mov al, byte [ecx + 1]
je 0x40ba0d
or al, 3
mov byte [esi], 1
mov byte [ecx + 1], al
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov eax, edx
and eax, dword [ebp + 8]
cmp eax, dword [ebp + 8]
je 0x40ba31
or edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 4]
mov byte [esi], 1
and byte [ecx + 1], 0xef
mov ecx, dword [ebp - 4]
or byte [ecx + 1], 3
mov al, 1
jmp 0x40b9ec
Function at 0x40c0c7
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
test edi, edi
je 0x40c0e6
call fcn.0040bfbc
mov ecx, edi
or ecx, 1
cmp eax, ecx
jne 0x40c11a
and dword [ebp + 0x10], 0
lea edx, [ebp + 0x10]
mov ecx, ebx
call fcn.0040c1f8
test eax, eax
js 0x40c11a
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x40c11a
xor esi, esi
jmp 0x40c1ea
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
and dword [ebp + 0x10], 0
mov edx, edi
push eax
call fcn.0040bef9
mov esi, eax
test esi, esi
js 0x40c1ea
mov eax, dword [ebp + 0x10]
movzx eax, word [eax + 2]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40c1dc
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x40c1be
mov ecx, dword [ebp + 0x10]
lea esi, [edi + 0x14]
movzx eax, word [ecx + 2]
push eax
push ecx
push eax
push esi
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
push 0
push esi
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
test eax, eax
je 0x40c1be
push edi
push 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
je 0x40c199
xor esi, esi
jmp 0x40c1b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40c1b0
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40c1d3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40c1d3
mov byte [eax], 1
jmp 0x40c1d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40c1d3
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40c1e1
mov esi, 0x8007000e
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40c8ee
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x41e6f4], 0
jne 0x40c948
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x404028
push reloc.SHLWAPI.dll_ParseURLW
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c947
push esi
push esi
push esi
push esi
push 0x4040bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov dword [0x41e6f4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
cmp dword [0x41e6f4], 1
sete al
mov esp, ebp
pop ebp
ret
Function at 0x40c95d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x41e6f0], 0
push esi
jne 0x40c9df
call fcn.0040c8ee
test eax, eax
je 0x40c9d5
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x404028
push reloc.SHLWAPI.dll_ParseURLW
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c9df
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x4040a0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c9ca
cmp dword [ebp - 8], eax
sete al
inc eax
mov dword [0x41e6f0], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c9df
mov dword [0x41e6f0], 2
xor eax, eax
cmp dword [0x41e6f0], 1
pop esi
sete al
mov esp, ebp
pop ebp
ret

Function at 0x40dd0b
Capabilities:
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x21
push ebx
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jne 0x40de12
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call sub.msvcrt.dll_wcsrchr
pop ecx
pop ecx
test eax, eax
je 0x40dd5c
xor ecx, ecx
mov word [eax], cx
push edi
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0040875f
mov esi, eax
test esi, esi
jne 0x40de12
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov esi, eax
test esi, esi
je 0x40dd98
cmp esi, 0x50
je 0x40dd98
cmp esi, 0xb7
jne 0x40de05
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, 0x2002
test ecx, eax
jne 0x40ddbe
push ecx
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x404190
lea ecx, [ebp - 0x20c]
call fcn.0040d79f
mov esi, eax
test esi, esi
js 0x40de12
push ebx
push ebx
push 3
mov dl, 1
lea ecx, [ebp - 0x20c]
call fcn.0040dcb0
mov esi, eax
test esi, esi
js 0x40de12
push 0x2002
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x40de12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40de12
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret
Function at 0x40de2a
Capabilities:
Get common file path
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov bl, dl
mov eax, 0x80070057
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x40df1d
mov eax, dword [esi]
cmp eax, 6
jne 0x40de78
cmp dword [ebp + 8], 0
je 0x40de78
push dword [ebp + 8]
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.00407605
jmp 0x40dea1
cmp eax, 0xffffffff
jne 0x40de88
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x40dea5
lea ecx, [ebp - 0x20c]
or eax, 0x8000
push ecx
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40df1d
cmp dword [esi + 0xc], 0
je 0x40deb9
push dword [esi + 0xc]
lea ecx, [ebp - 0x20c]
call fcn.0040d79f
test eax, eax
js 0x40deed
cmp dword [esi], 6
jne 0x40decf
call fcn.0040e225
test eax, eax
je 0x40decf
mov al, 1
jmp 0x40ded1
xor al, al
test al, al
jne 0x40deeb
push edi
push dword [esi + 8]
mov dl, bl
lea ecx, [ebp - 0x20c]
push dword [esi + 4]
call fcn.0040dcb0
jmp 0x40deed
xor eax, eax
cmp dword [esi + 0x10], 0xffffffff
je 0x40df1d
push dword [esi + 0x10]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40df0b
xor eax, eax
jmp 0x40df1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40df1d
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret 8
Function at 0x40df35
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x484
mov eax, dword [0x41e004]
xor eax, esp
mov dword [esp + 0x480], eax
push ebx
mov bl, byte [ebp + 8]
lea eax, [esp + 7]
push esi
push edi
xor edx, edx
mov edi, ecx
push eax
mov byte [esp + 0x13], dl
push edx
mov dl, bl
mov dword [esp + 0x20], edi
call fcn.0040de2a
mov esi, eax
test bl, bl
je 0x40df89
cmp byte [esp + 0xf], 0
jne 0x40df83
cmp byte [ebp + 0xc], 0
je 0x40df89
mov al, 1
xor ecx, ecx
jmp 0x40df8d
xor ecx, ecx
mov al, cl
mov byte [esp + 0x10], al
test esi, esi
js 0x40e0fe
test al, al
je 0x40e0fe
cmp dword [edi], 0xffffffff
mov ebx, dword [sym.imp.msvcrt.dll_wcscat_s]
jne 0x40dfba
xor eax, eax
mov esi, ecx
mov word [esp + 0x280], ax
jmp 0x40dfee
lea eax, [esp + 0x280]
push eax
push ecx
push ecx
push dword [edi]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x40e0fe
push 0x4020e4
lea eax, [esp + 0x284]
push 0x104
push eax
call ebx
add esp, 0xc
cmp dword [edi + 0xc], 0
je 0x40e009
push dword [edi + 0xc]
lea eax, [esp + 0x284]
push 0x104
push eax
call ebx
add esp, 0xc
push 0x4020d0
lea eax, [esp + 0x284]
push 0x104
push eax
call ebx
add esp, 0xc
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x40e0fe
lea edi, [esp + 0x280]
xor edx, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x40e04c
sub edi, ecx
push 0x2e
sar edi, 1
pop eax
cmp word [esp + 0x5c], ax
je 0x40e0da
cmp word [esp + 0x5e], ax
je 0x40e0da
xor eax, eax
mov word [esp + edi*2 + 0x27e], ax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x284]
push 0x104
push eax
call ebx
mov ecx, dword [esp + 0x24]
add esp, 0xc
or dword [esp + 0x1c], 0xffffffff
xor edx, edx
or dword [esp + 0x2c], 0xffffffff
mov eax, dword [ecx + 4]
push dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [ecx + 8]
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x284]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
shr eax, 4
and al, 1
movzx eax, al
push eax
call fcn.0040df35
test esi, esi
js 0x40e0da
test eax, eax
jns 0x40e0da
mov esi, eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40e05e
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x48c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret 8
Function at 0x40e11c
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov ebx, 0x41e0e0
push edi
mov dword [ebp - 0x210], eax
xor edi, edi
push eax
push 1
mov ecx, ebx
call fcn.0040df35
mov esi, eax
test esi, esi
js 0x40e20d
mov eax, dword [ebp - 0x210]
add edi, 0x14
add ebx, 0x14
cmp edi, 0xdc
jb 0x40e143
xor edi, edi
mov ecx, dword [edi + 0x404360]
call fcn.0040dd0b
mov esi, eax
test esi, esi
js 0x40e20d
add edi, 4
cmp edi, 0x10
jb 0x40e16d
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40e1f8
push 0x404190
lea ecx, [ebp - 0x20c]
call fcn.0040d79f
mov esi, eax
test esi, esi
js 0x40e20d
push 0
push 0
push 3
mov dl, 1
lea ecx, [ebp - 0x20c]
call fcn.0040dcb0
mov esi, eax
test esi, esi
js 0x40e20d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40e1f8
or eax, 0x2000
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40e20d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40e20d
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret

Function at 0x40e225
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x41e6f8]
test ecx, ecx
jne 0x40e27e
push 1
push 6
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40e278
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
mov ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 2
mov dword [0x41e6f8], ecx
jmp 0x40e27e
mov ecx, dword [0x41e6f8]
xor eax, eax
cmp ecx, 1
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret

Function at 0x40edc0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push esi
push edi
push 4
mov edi, ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x40edec
and dword [esi], 0
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
jmp 0x40edee
xor esi, esi
mov dword [edi + 0x14], esi
test esi, esi
je 0x40ee22
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
mov ecx, eax
test ecx, ecx
je 0x40ee0b
mov eax, dword [edi + 0x14]
mov dword [ecx], eax
jmp 0x40ee0d
xor ecx, ecx
mov dword [edi + 0x10], ecx
neg ecx
sbb ecx, ecx
and ecx, 0x7ff8fff2
add ecx, 0x8007000e
jmp 0x40ee27
mov ecx, 0x8007000e
pop edi
mov eax, ecx
pop esi
ret
Function at 0x41020a
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
cmp byte [0x41e748], 0
jne 0x410352
push esi
mov esi, 0x41e780
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x41e748], 0
jne 0x41034a
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x2c], 5
jne 0x410264
push 2
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
and dword [0x41e1bc], 0
jmp 0x410342
mov ecx, 0x41e1c4
call fcn.00415813
test eax, eax
je 0x4102a5
mov ecx, 0x41e1cc
call fcn.00415813
test eax, eax
jne 0x41029c
push 0x10
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
mov dword [0x41e1bc], 3
jmp 0x410342
call fcn.004101ad
test al, al
je 0x4102c1
push 0x20
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
mov dword [0x41e1bc], 2
jmp 0x410342
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ecx, ax
mov eax, ecx
push 4
and eax, 0x3ff
pop edx
cmp ax, dx
jne 0x41032b
and ecx, 0xfc00
mov eax, 0x800
cmp cx, ax
jne 0x41032b
call fcn.0041584e
test al, al
je 0x41032b
lea eax, [ebp - 4]
xor ebx, ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
push ebx
call dword [sym.imp.NETAPI32.dll_NetGetJoinInformation]
test eax, eax
jne 0x410280
cmp dword [ebp - 4], 3
jne 0x410316
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
test bl, bl
je 0x410280
push 4
jmp 0x41032d
push 8
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
mov dword [0x41e1bc], 1
mov byte [0x41e748], 1
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, dword [0x41e1bc]
mov esp, ebp
pop ebp
ret
Function at 0x411b27
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
push esi
xor esi, esi
mov dword [ebp - 0x218], eax
push edi
mov dword [ebx], esi
lea ecx, [ebp - 0x220]
mov dword [eax], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
call fcn.0040c3e4
mov edi, eax
test edi, edi
jle 0x411b77
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x411d08
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
mov eax, dword [ebp - 0x214]
je 0x411ceb
test eax, eax
je 0x411ceb
cmp word [eax], si
je 0x411ceb
push eax
lea ecx, [ebp - 0x210]
call fcn.0040f1c4
mov esi, dword [ebp - 0x210]
test esi, esi
je 0x411cd7
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
push LoadStringW
push 0
push 0x404838
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411c5a
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0x404878
push 0
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x411c45
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.004122a6
mov esi, dword [ebp - 0x210]
mov edi, eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x228], 0
je 0x411c7f
push 0x404890
lea ecx, [ebp - 0x210]
call fcn.004122a6
push 1
push 0x212
mov edi, eax
call dword [sym.imp.urlmon.dll_Ordinal_414]
mov esi, dword [ebp - 0x210]
test edi, edi
js 0x411cdc
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, dword [ebp - 0x218]
add eax, eax
push eax
mov dword [ecx], eax
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov dword [ebx], eax
pop ecx
test eax, eax
je 0x411cd7
mov ecx, dword [ebp - 0x218]
push dword [ecx]
push esi
push dword [ecx]
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
test eax, eax
je 0x411cdc
push dword [ebx]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
and dword [ebx], 0
mov edi, 0x80004005
pop ecx
mov ecx, dword [ebp - 0x218]
and dword [ecx], 0
jmp 0x411cdc
mov edi, 0x8007000e
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x214]
jmp 0x411cf0
mov edi, 0x80004005
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
call esi
push dword [ebp - 0x220]
and dword [ebp - 0x214], 0
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ce8b
mov esp, ebp
pop ebp
ret
Function at 0x4125d2
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ecx], 0
push esi
mov esi, 0x80004005
je 0x41267e
cmp dword [ebp + 8], 0
je 0x41267e
cmp dword [ebp + 0x10], 0
je 0x41267e
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push esi
push 0x800c
push dword [ecx]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x412669
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x412649
push esi
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x20
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x41265e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41265e
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x41267e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41267e
movzx esi, si
or esi, 0x80070000
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41268c
Capabilities:
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
mov dword [ebp - 4], ecx
mov esi, 0x80004005
mov dword [ebp - 8], ecx
cmp dword [ebx], ecx
je 0x41279d
cmp dword [ebp + 8], ecx
je 0x41279d
cmp dword [ebp + 0x10], ecx
je 0x41279d
cmp dword [ebp + 0x18], ecx
je 0x41279d
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0x800c
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x412784
xor esi, esi
push esi
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x412764
lea eax, [ebp - 8]
mov dword [ebp + 8], esi
push eax
lea eax, [ebp + 8]
mov ecx, ebx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00412b4f
test eax, eax
js 0x412750
push esi
push esi
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
je 0x412730
mov esi, dword [ebp - 8]
jmp 0x412745
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x412745
movzx esi, si
or esi, 0x80070000
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x412779
push 1
push 0x1e1
mov esi, 0x80092004
call dword [sym.imp.urlmon.dll_Ordinal_414]
jmp 0x412779
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x412779
movzx esi, si
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x412799
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41279b
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x4127aa
push 1
push 0x20e
call dword [sym.imp.urlmon.dll_Ordinal_414]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18