joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x42a45c]
test esi, esi
jle 0x415010
mov eax, dword [0x42a460]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x414f40
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x414fbf
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x414f30
mov dword [esp], ebx
call fcn.00415880
mov edi, eax
test eax, eax
je 0x415037
mov eax, dword [0x42a460]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00415990
mov edx, dword [0x42a460]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x415017
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x414fb8
sub eax, 4
and eax, 0xfffffffb
jne 0x414fc6
add dword [0x42a45c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x42a460]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x414fb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00414eb0
xor esi, esi
jmp 0x414f4a
mov eax, dword [0x42a460]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00414eb0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00414eb0
lea esi, [esi]
nop

Function at 0x4154f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x42a478
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x42a470]
sub esp, 4
test ebx, ebx
je 0x415545
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x41553e
test esi, esi
je 0x41553e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x415520
mov dword [esp], 0x42a478
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403a00
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push esi
push 0
push 0x400
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
test ebx, ebx
jne 0x403a40
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d6b
mov esp, ebp
pop ebp
ret
push edi
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403a6c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d6b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x403ad2
cmp dword [ebp - 0x18], esi
jne 0x403ac3
push dword [ebp - 0x1c]
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x403ac0
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 8], 0x103
mov eax, 1
movzx ebx, bl
push esi
cmove ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x403a84
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408d6b
mov esp, ebp
pop ebp
ret

Function at 0x403b00
Capabilities:
Enumerate threads
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov esi, ecx
push 4
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403b3a
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d6b
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x403b99
cmp dword [ebp - 0x14], esi
jne 0x403b8a
push dword [ebp - 0x18]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x403b87
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
movzx ebx, bl
mov eax, 1
push esi
cmovne ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x403b53
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00408d6b
mov esp, ebp
pop ebp
ret
Function at 0x405910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
movzx eax, bx
mov dword [ebp - 0x34], eax
mov esi, ecx
cmp di, bx
jne 0x40594d
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d6b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x405987
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x405987
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d6b
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405a57
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ecx], eax
jne 0x4059b4
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4059e7
push dword [esi + 0x4c]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
movzx ecx, bx
cmp ax, di
cmove ecx, edi
pop edi
pop esi
mov ax, cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d6b
mov esp, ebp
pop ebp
ret 4
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x405a26
sub eax, 1
je 0x405a26
sub eax, 2
jne 0x405a57
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x4059bf
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x405a44
push dword [esi + 0x4c]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x405a57
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x30], ecx
movzx eax, ax
mov byte [esi + 0x3e], 1
cmovne edi, eax
mov ecx, dword [ebp - 4]
mov ax, di
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408d6b
mov esp, ebp
pop ebp
ret 4
Function at 0x405f50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x406014
cmp byte [esi + 0x3e], 0
je 0x406014
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x406002
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x405fc9
sub eax, 1
je 0x405fcd
sub eax, 2
jne 0x406002
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d6b
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405feb
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x406002
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d6b
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d6b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00408d6b
mov esp, ebp
pop ebp
ret

Function at 0x408c87
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x408cae
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x408cb1
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00408c63
pop esi
leave
ret 8

Function at 0x40979e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4097dd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4097dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4097dd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4097dd
cmp dword [ecx + 0x74], 0xe
jbe 0x4097dd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40ea40
Capabilities:
Get session information
Print debug messages

Disassembly:
sub esp, 0x830
mov eax, dword [0x434150]
xor eax, esp
mov dword [esp + 0x82c], eax
push ebp
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0x18
xor ebp, ebp
push 0xffffffffffffffff
push ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x40eaea
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
test eax, eax
je 0x40eb21
mov ebp, 1
test edi, edi
je 0x40ea95
mov edx, dword [eax + 4]
mov dword [edi], edx
test esi, esi
je 0x40eaad
add eax, 0x82
push eax
push 0x104
push esi
call fcn.004142eb
add esp, 0xc
test ebx, ebx
je 0x40eac7
mov eax, dword [esp + 0xc]
add eax, 0x60
push eax
push 0x104
push ebx
call fcn.004142eb
add esp, 0xc
mov ecx, dword [edi]
push ecx
push ebx
push esi
push 0x42ff68
lea edx, [esp + 0x20]
push 0x410
push edx
call fcn.004142eb
add esp, 0x18
lea eax, [esp + 0x10]
push eax
jmp 0x40eb0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430010
lea ecx, [esp + 0x18]
push 0x410
push ecx
call fcn.004142eb
add esp, 0x10
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 4]
test eax, eax
je 0x40eb21
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [esp + 0x830]
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00411220
add esp, 0x830
ret

Function at 0x40eb40
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x434150]
xor eax, esp
mov dword [esp + 0x820], eax
mov eax, dword [esp + 0x828]
push edi
push esi
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40eba8
mov ecx, dword [esi]
push ecx
push 0x4300a0
lea edx, [esp + 0xc]
push 0x410
push edx
call fcn.004142eb
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [edi + 1]
pop edi
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.00411220
add esp, 0x824
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430120
lea ecx, [esp + 0xc]
push 0x410
push ecx
call fcn.004142eb
add esp, 0x10
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x824]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00411220
add esp, 0x824
ret

Function at 0x40ebf0
Capabilities:
Get session information
Print debug messages

Disassembly:
sub esp, 0x828
mov eax, dword [0x434150]
xor eax, esp
mov dword [esp + 0x824], eax
push ebx
lea eax, [esp + 4]
push eax
push esi
push edi
xor ebx, ebx
push ecx
push ebx
mov dword [esp + 0x18], ebx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x40ec3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430190
lea edx, [esp + 0x10]
push 0x410
push edx
call fcn.004142eb
add esp, 0x10
jmp 0x40ec5d
mov ecx, dword [esi]
push ecx
push edi
push 0x430230
lea edx, [esp + 0x14]
push 0x410
push edx
mov ebx, 1
call fcn.004142eb
add esp, 0x14
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x828]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00411220
add esp, 0x828
ret
Function at 0x40ec80
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x82c
mov eax, dword [0x434150]
xor eax, esp
mov dword [esp + 0x828], eax
mov eax, dword [esp + 0x834]
push ebp
mov ebp, dword [esp + 0x834]
push esi
push edi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov esi, ebx
call fcn.0040eb40
mov esi, eax
add esp, 4
test esi, esi
je 0x40ed78
mov ecx, dword [ebx]
lea esi, [esp + 0xc]
mov edi, 5
mov dword [esp + 0xc], 0
call fcn.0040ebf0
mov esi, eax
test esi, esi
je 0x40ed78
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40ed17
test ebp, ebp
je 0x40ed17
push eax
push 0x104
push ebp
call fcn.004142eb
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x40ed0f
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [esp + 0xc], 0
mov ecx, dword [ebx]
lea esi, [esp + 0xc]
mov edi, 7
call fcn.0040ebf0
mov esi, eax
test esi, esi
je 0x40ed78
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
test eax, eax
je 0x40ed5a
test edi, edi
je 0x40ed5a
push eax
push 0x104
push edi
call fcn.004142eb
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x40ed5a
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [ebx]
push ecx
push edi
push ebp
push 0x4302c8
lea edx, [esp + 0x24]
push 0x410
push edx
call fcn.004142eb
add esp, 0x18
jmp 0x40ed8f
push 0x430370
lea eax, [esp + 0x18]
push 0x410
push eax
call fcn.004142eb
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x834]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.00411220
add esp, 0x82c
ret

Function at 0x40edc0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x434150]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push esi
mov esi, ecx
lea ecx, [esp + 4]
push ecx
push 1
push 0
push eax
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ee52
mov edx, dword [esp + 4]
push ebp
push ebx
push edi
push esi
push eax
push 0x4304b0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [esi]
mov ebp, eax
cmp esi, 2
je 0x40ee22
cmp esi, 1
jne 0x40ee44
push 0x104
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
mov dword [ebx], eax
call fcn.0041684f
add esp, 0xc
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
call fcn.00411220
add esp, 0x210
ret
Function at 0x40f1c0
Capabilities:
Get user security identifier
Print debug messages

Disassembly:
sub esp, 0xc44
mov eax, dword [0x434150]
xor eax, esp
mov dword [esp + 0xc40], eax
mov eax, dword [esp + 0xc48]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x410
mov esi, ecx
lea ecx, [esp + 0x24]
push ebx
push ecx
mov edi, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
xor ebp, ebp
call fcn.00411440
push esi
push edi
push 0x4307b0
lea edx, [esp + 0x38]
push 0x208
push edx
call fcn.004142eb
lea eax, [esp + 0x40]
push eax
push 0x4307bc
lea ecx, [esp + 0x458]
push 0x410
push ecx
call fcn.004142eb
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
add esp, 0x30
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
push ebp
lea ecx, [esp + 0x20]
push ecx
push ebp
lea edx, [esp + 0x34]
push edx
push ebp
call esi
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40f273
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov ebx, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40f28b
add eax, eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov ebp, eax
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebx, ebx
je 0x40f32c
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
push ebp
lea eax, [esp + 0x20]
push eax
push ebx
lea ecx, [esp + 0x34]
push ecx
push 0
call esi
test eax, eax
je 0x40f2f1
mov edx, dword [esp + 0x18]
push edx
push ebx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
jne 0x40f31c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430540
lea eax, [esp + 0x438]
push 0x410
push eax
call fcn.004142eb
add esp, 0x10
lea ecx, [esp + 0x430]
push ecx
jmp 0x40f31a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x430800
lea edx, [esp + 0x438]
push 0x410
push edx
call fcn.004142eb
add esp, 0x10
lea eax, [esp + 0x430]
push eax
call edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
je 0x40f340
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
push ecx
push 0x430864
lea edx, [esp + 0x438]
push 0x410
push edx
call fcn.004142eb
add esp, 0x10
lea eax, [esp + 0x430]
push eax
call edi
mov ecx, dword [esp + 0xc50]
xor eax, eax
cmp dword [esi], eax
pop edi
pop esi
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.00411220
add esp, 0xc44
ret
Function at 0x40fcd0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push ebp
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40fdc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40fd0f
cmp eax, 3
je 0x40fd19
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40fd19
test al, 0x10
je 0x40fd19
xor esi, esi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
movzx ecx, word [ebx]
push edi
xor edi, edi
mov eax, ebx
test cx, cx
je 0x40fd48
movzx ecx, cx
lea esp, [esp]
cmp cx, 0x5c
jne 0x40fd38
mov edi, eax
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40fd30
test edi, edi
jne 0x40fd66
mov esi, 0x80070003
push esi
push 0x82
push 0x42c4e0
call fcn.00410700
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
push ebp
xor eax, eax
push ebx
mov word [edi], ax
call fcn.0040fcd0
mov esi, eax
mov ecx, 0x5c
mov word [edi], cx
test esi, esi
jl 0x40fdc0
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40fdbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40fda7
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
test eax, eax
jle 0x40fdb5
and eax, 0xffff
or eax, 0x80070000
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret 8
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40fdd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x434150]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [esp + 0x41c]
push edi
mov edi, dword [esp + 0x424]
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40fe65
cmp eax, 0x104
jae 0x40fe65
lea ecx, [esp + 0x210]
push ecx
push 0
push esi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40fe4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40fe3d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x40fe48
mov esi, 0x80004005
push esi
push 0x53
jmp 0x40fe87
mov ecx, dword [esp + 0x428]
lea eax, [esp + 0x210]
push eax
push ecx
push edi
call fcn.00401c70
jmp 0x40fe93
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40fe79
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x40fe84
mov esi, 0x80004005
push esi
push 0x4e
push 0x42c4e0
call fcn.00410700
mov eax, esi
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.00411220
add esp, 0x414
ret 0xc