joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019ce
Capabilities:
Accept command line arguments

Disassembly:
push ebp
lea ebp, [esp - 0x7c0]
sub esp, 0x840
mov eax, dword [0x404008]
xor eax, ebp
mov dword [ebp + 0x7bc], eax
push esi
push edi
mov esi, 0x208
xor edi, edi
push esi
lea eax, [ebp + 0x3a6]
push edi
push eax
mov word [ebp + 0x3a4], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp + 0x3a4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp + 0x5b2]
push edi
push eax
mov word [ebp + 0x5b0], di
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp + 0x19a]
push edi
push eax
mov word [ebp + 0x198], di
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov word [ebp - 0x74], di
call sub.MSVCR80.dll_memset
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x5b0]
push eax
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp + 0x3a4]
push eax
call fcn.0040135d
xor esi, esi
inc esi
add esp, 0x34
cmp word [ebp + 0x5b0], di
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
je 0x401ab4
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x5b0]
push eax
call fcn.00401601
add esp, 0x10
test eax, eax
jne 0x401ab4
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
push 0xffffffffffffffff
push edi
push 0x804
push esi
push esi
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp + 0x3a4]
push eax
lea eax, [ebp + 0x198]
push eax
push str.QQPCMgr
call fcn.00401689
push 0x403358
push 0x2710
call fcn.00401986
add esp, 0x38
call fcn.0040127e
mov ecx, dword [ebp + 0x7bc]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401da8
add ebp, 0x7c0
leave
ret
Function at 0x401da8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x404008]
jne 0x401db2
repz ret
jmp fcn.00402112
Function at 0x410000
Capabilities:
Encode data using xor

Disassembly:
push 0x59c
pop ebx
push 0xbf2f0d
pop ecx
mov edx, 0xbf2f0d
sub ecx, 0xd
mov eax, 0x410026
xor dword [eax + ebx], edx
push 0xbf2f0d
pop edi
sub ebx, 4
jne 0x410019
nop
nop
nop
call fcn.004101ac
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov al, 0xd8
add byte [eax], al
add byte [eax + eax], dl
in al, 0x59
add byte [eax], al
add byte [edx - 0xf7fe], dh
invalid

Function at 0x410598
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jns 0x4105ac
add ecx, 3
sar ecx, 2
xor eax, eax
cmp ecx, eax
jle 0x4105bd
xor dword [edx + eax*4], ebx
inc eax
cmp ecx, eax
jg 0x4105b5
pop ebx
pop ebp
ret 0xc
Function at 0x408ed6
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0x462700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x2d8], ax
lea eax, [ebp - 0x2d6]
push eax
call fcn.004317b0
add esp, 0xc
lea eax, [ebp - 0x2d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x408fa9
push 0
call fcn.00432745
push eax
call fcn.00432712
pop ecx
pop ecx
xor ebx, ebx
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push eax
call fcn.004317b0
call fcn.00432724
push eax
push str.gcq_x
lea eax, [ebp - 0xd0]
push 0x64
push eax
call fcn.00431e0b
add esp, 0x1c
cmp eax, 0xffffffff
je 0x408fa3
lea eax, [ebp - 0x2d8]
push eax
mov ecx, esi
call fcn.00401e93
lea eax, [ebp - 0xd0]
push eax
push esi
call fcn.004016ad
cmp dword [esi + 0x14], 8
jb 0x408f94
mov eax, dword [esi]
jmp 0x408f96
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408fb9
inc ebx
cmp ebx, 0x64
jl 0x408f33
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004313d1
leave
ret
mov ecx, esi
call fcn.00408023
xor eax, eax
jmp 0x408fac

Function at 0x40901f
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4506bc
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x462700]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push esi
mov eax, dword [0x462700]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
call fcn.00408ed6
test eax, eax
je 0x409074
xor al, al
jmp 0x409110
push ebx
call fcn.004089bb
pop ecx
test al, al
je 0x40906d
lea eax, [esp + 0x34]
push 0x456624
push eax
mov ebx, esi
call fcn.0040cc19
xor ebx, ebx
mov dword [esp + 0x68], ebx
push dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call fcn.0040cc8a
add esp, 0x10
mov byte [esp + 0x60], 1
push eax
mov ecx, edi
call fcn.00401651
mov byte [esp + 0x60], bl
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.0040229e
or dword [esp + 0x60], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x3c]
call fcn.0040229e
cmp dword [edi + 0x14], 8
jb 0x4090e1
mov ecx, dword [edi]
jmp 0x4090e3
mov ecx, edi
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x4090ef
mov eax, dword [eax]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40906d
mov ecx, edi
call fcn.00408023
mov ecx, esi
call fcn.00408023
mov al, 1
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004313d1
mov esp, ebp
pop ebp
ret
Function at 0x409614
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x462700]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.004317b0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4096a7
cmp dword [ebp - 0x114], 5
jne 0x40966e
xor eax, eax
inc eax
cmp dword [ebp - 0x110], eax
jne 0x4096a3
jmp 0x4096a9
cmp dword [ebp - 0x114], 6
jne 0x4096a1
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x409686
push 2
pop eax
jmp 0x4096a9
cmp eax, 1
jne 0x40968f
push 3
jmp 0x409683
cmp eax, 2
jne 0x409698
push 4
jmp 0x409683
ja 0x4096a3
cmp dword [ebp - 0x114], 6
jae 0x4096a7
push 5
jmp 0x409683
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004313d1
leave
ret

Function at 0x40e9fd
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x44db21
call fcn.00435c39
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x40eaf1
cmp byte [esi + 0x49], bl
je 0x40eaf1
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40ea32
xor al, al
jmp 0x40eaf3
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040e902
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40ea94
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x40ea99
dec eax
je 0x40ea9d
dec eax
dec eax
je 0x40eaed
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407e53
mov al, bl
jmp 0x40eaf3
mov edx, dword [ebp - 0x2c]
jmp 0x40ea5b
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40eaa9
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x40eacf
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40eabc
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.00432cfa
add esp, 0x10
cmp edi, eax
jne 0x40ea7e
cmp byte [esi + 0x49], 0
je 0x40eaed
test edi, edi
jne 0x40ea4d
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040e99d
jmp 0x40ea4d
mov bl, 1
jmp 0x40ea80
mov al, 1
call fcn.00435cbc
ret
Function at 0x40ec29
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ec8d
cmp dword [ebp + 0xc], 1
je 0x40ec65
cmp dword [ebp + 0xc], 2
je 0x40ec65
push 0xd
pop eax
jmp 0x40ec8d
mov eax, dword [ebp - 4]
test edi, edi
je 0x40ec87
test eax, eax
je 0x40ec82
test al, 1
jne 0x40ec60
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40ec87
jmp 0x40ec60
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x4102c7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x462700]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [esi + 0x18], edi
ja 0x410358
lea eax, [ebp - 0x210]
push eax
push edi
push dword [esi + 4]
mov dword [ebp - 0x210], edi
push 5
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
js 0x410358
cmp dword [ebp - 0x210], edi
je 0x410358
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.004317b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x41034c
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 8]
call fcn.00401e93
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_ILFree]
mov ecx, dword [ebp - 4]
xor ecx, ebp
lea eax, [esi + 8]
pop edi
call fcn.004313d1
leave
ret
Function at 0x41121f
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x418dd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c387
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x462700]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.00430f21
add esp, 4
cmp eax, ebx
je 0x418eba
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], 2
lea edi, [esi + 0x18]
push 8
mov dword [ebp - 0x10], edi
mov dword [edi], ebx
call fcn.00430f21
add esp, 4
cmp eax, ebx
je 0x418ea3
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 4
call fcn.0040720c
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 5
call fcn.0040720c
mov byte [ebp - 4], 6
mov word [esi + 0x7c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00401f5e
push 0x45b03c
lea edx, [ebp - 0x1c]
push edx
call fcn.00430fa1
push ebx
lea ecx, [ebp - 0x28]
call fcn.00401f5e
push 0x45b03c
lea eax, [ebp - 0x28]
push eax
call fcn.00430fa1
int3

Function at 0x41d9a9
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x462700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x210], esi
call fcn.004317b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x1c
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
pop esi
test eax, eax
js 0x41da25
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 0x210]
test eax, eax
js 0x41da1f
call dword [sym.imp.SHELL32.dll_ILFree]
jmp 0x41da69
call dword [sym.imp.SHELL32.dll_ILFree]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 2
push str.Local_AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x41da77
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.00401e93
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004313d1
leave
ret
Function at 0x420138
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44ff08
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x462700]
xor eax, esp
mov dword [esp + 0xf4], eax
push ebx
push esi
mov eax, dword [0x462700]
xor eax, esp
push eax
lea eax, [esp + 0x108]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 5
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov esi, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x4202d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x14]
push eax
call fcn.00404d15
mov dword [esp + 0x110], ebx
push esi
push ecx
lea eax, [esp + 0x1c]
push 0x45665c
push eax
call fcn.0040616a
add esp, 0xc
push eax
call fcn.004096fb
push 0xf
pop esi
push 0x23
push str.path_manager::get_current_user_name
lea ecx, [esp + 0xd0]
mov dword [esp + 0xe4], esi
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
call fcn.00407efb
mov byte [esp + 0x110], 1
push 0x10
push str.path_manager.cpp
lea ecx, [esp + 0xb4]
mov dword [esp + 0xc8], esi
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
call fcn.00407efb
mov byte [esp + 0x110], 2
lea eax, [esp + 0xe4]
push eax
lea ecx, [esp + 0x18]
call fcn.00404dc4
mov byte [esp + 0x110], 3
push eax
lea eax, [esp + 0xcc]
push eax
push 0xc4
push 2
call fcn.004109b9
lea ecx, [esp + 0xbc]
mov ebx, eax
call fcn.004109f8
mov byte [esp + 0x110], 2
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0xec]
call fcn.00407e53
mov byte [esp + 0x110], 1
push ebx
push 1
lea ecx, [esp + 0xb4]
call fcn.00407e53
mov byte [esp + 0x110], bl
push ebx
push 1
lea ecx, [esp + 0xd0]
call fcn.00407e53
or dword [esp + 0x110], 0xffffffff
lea ecx, [esp + 0x64]
call fcn.00404d81
lea ecx, [esp + 0x64]
call fcn.00407b8a
push 2
pop eax
jmp 0x4202ef
push dword [esp + 0xc]
lea ecx, [esi + 0x54]
call fcn.00401e93
push dword [esp + 0xc]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
xor eax, eax
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xf4]
xor ecx, esp
call fcn.004313d1
mov esp, ebp
pop ebp
ret
Function at 0x420412
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44feb7
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x462700]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push esi
mov eax, dword [0x462700]
xor eax, esp
push eax
lea eax, [esp + 0x2a0]
mov dword fs:[0], eax
xor eax, eax
push 0x18e
mov word [esp + 0x108], ax
xor ebx, ebx
lea eax, [esp + 0x10a]
push ebx
push eax
mov esi, ecx
call fcn.004317b0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x108]
push eax
mov dword [esp + 0x18], 0xc8
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x4205cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x14]
push eax
call fcn.00404d15
mov dword [esp + 0x2a8], ebx
push esi
push ecx
lea eax, [esp + 0x1c]
push 0x45665c
push eax
call fcn.0040616a
add esp, 0xc
push eax
call fcn.004096fb
push 0xf
pop esi
push 0x23
push str.path_manager::get_process_user_name
lea ecx, [esp + 0xb8]
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
call fcn.00407efb
mov byte [esp + 0x2a8], 1
push 0x10
push str.path_manager.cpp
lea ecx, [esp + 0xd4]
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
call fcn.00407efb
mov byte [esp + 0x2a8], 2
lea eax, [esp + 0xe8]
push eax
lea ecx, [esp + 0x18]
call fcn.00404dc4
mov byte [esp + 0x2a8], 3
push eax
lea eax, [esp + 0xb4]
push eax
push 0xe4
push 2
call fcn.004109b9
lea ecx, [esp + 0xdc]
mov ebx, eax
call fcn.004109f8
mov byte [esp + 0x2a8], 2
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0xf0]
call fcn.00407e53
mov byte [esp + 0x2a8], 1
push ebx
push 1
lea ecx, [esp + 0xd4]
call fcn.00407e53
mov byte [esp + 0x2a8], bl
push ebx
push 1
lea ecx, [esp + 0xb8]
call fcn.00407e53
or dword [esp + 0x2a8], 0xffffffff
lea ecx, [esp + 0x64]
call fcn.00404d81
lea ecx, [esp + 0x64]
call fcn.00407b8a
push 2
pop eax
jmp 0x4205e1
lea eax, [esp + 0x104]
push eax
lea ecx, [esi + 0x70]
call fcn.00401e93
xor eax, eax
mov ecx, dword [esp + 0x2a0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x28c]
xor ecx, esp
call fcn.004313d1
mov esp, ebp
pop ebp
ret
Function at 0x420941
Capabilities:
Get common file path

Disassembly:
push 0x300
mov eax, 0x44fe63
call fcn.00435c39
xor ebx, ebx
lea eax, [ebp - 0x274]
push eax
push ebx
push ebx
push dword [ebp + 8]
mov esi, ecx
push ebx
mov dword [ebp - 0x274], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp eax, ebx
jge 0x420a8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x30c]
push eax
call fcn.00404d15
mov dword [ebp - 4], ebx
push esi
push ecx
lea eax, [ebp - 0x30c]
push 0x45665c
push eax
call fcn.0040616a
add esp, 0xc
push eax
call fcn.004096fb
push 0xf
pop esi
push 0x21
push str.path_manager::get_path_from_csidl
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], ebx
mov byte [ebp - 0x238], bl
call fcn.00407efb
mov byte [ebp - 4], 1
push 0x10
push str.path_manager.cpp
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x244], ebx
mov byte [ebp - 0x254], bl
call fcn.00407efb
mov byte [ebp - 4], 2
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x30c]
call fcn.00404dc4
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x238]
push eax
push 0x12c
push 2
call fcn.004109b9
lea ecx, [ebp - 0x254]
mov ebx, eax
call fcn.004109f8
mov byte [ebp - 4], 2
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x270]
call fcn.00407e53
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x254]
call fcn.00407e53
mov byte [ebp - 4], bl
push ebx
lea ecx, [ebp - 0x238]
push 1
call fcn.00407e53
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.00404d81
lea ecx, [ebp - 0x2bc]
call fcn.00407b8a
push 2
pop eax
jmp 0x420bdd
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.004317b0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 0x274]
cmp eax, ebx
jge 0x420bc7
call dword [sym.imp.SHELL32.dll_ILFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x30c]
push eax
call fcn.00404d15
mov dword [ebp - 4], 4
push esi
push ecx
lea eax, [ebp - 0x30c]
push 0x45665c
push eax
call fcn.0040616a
add esp, 0xc
push eax
call fcn.004096fb
push 0xf
pop esi
push 0x21
push str.path_manager::get_path_from_csidl
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x244], ebx
mov byte [ebp - 0x254], bl
call fcn.00407efb
mov byte [ebp - 4], 5
push 0x10
push str.path_manager.cpp
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], ebx
mov byte [ebp - 0x238], bl
call fcn.00407efb
mov byte [ebp - 4], 6
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x30c]
call fcn.00404dc4
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x254]
push eax
push 0x134
push 2
call fcn.004109b9
lea ecx, [ebp - 0x238]
mov ebx, eax
call fcn.004109f8
mov byte [ebp - 4], 6
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x270]
call fcn.00407e53
mov byte [ebp - 4], 5
push esi
push 1
lea ecx, [ebp - 0x238]
call fcn.00407e53
mov byte [ebp - 4], 4
push esi
lea ecx, [ebp - 0x254]
jmp 0x420a62
call dword [sym.imp.SHELL32.dll_ILFree]
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.00401e93
xor eax, eax
call fcn.00435cbc
ret 4
Function at 0x423da5
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x423db5
sub ecx, edx
xor edi, edi
mov dword [ebp - 4], ecx
test ecx, ecx
jle 0x423e7f
mov al, byte [ebp + 0xb]
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0x3d
je 0x423e7f
mov cl, byte [edx]
test cl, cl
je 0x423e1d
lea ebx, [ecx - 0x41]
cmp bl, 0x19
ja 0x423ded
sub cl, 0x41
jmp 0x423e1a
lea ebx, [ecx - 0x61]
cmp bl, 0x19
ja 0x423dfa
sub cl, 0x47
jmp 0x423e1a
lea ebx, [ecx - 0x30]
cmp bl, 9
ja 0x423e07
add cl, 4
jmp 0x423e1a
cmp cl, 0x2b
jne 0x423e11
add cl, 0x13
jmp 0x423e1a
cmp cl, 0x2f
setne cl
add cl, 0x3f
inc edx
jmp 0x423e1f
mov cl, 0x41
cmp cl, 0x40
je 0x423dda
mov dword [ebp + 0xc], edx
cmp cl, 0x41
je 0x423e7f
mov edx, edi
and edx, 0x80000003
jns 0x423e3b
dec edx
or edx, 0xfffffffc
inc edx
sub edx, 0
je 0x423e70
dec edx
je 0x423e61
dec edx
je 0x423e52
dec edx
jne 0x423e75
mov dl, al
or dl, cl
mov byte [esi], dl
inc esi
jmp 0x423e75
mov dl, cl
shr dl, 2
or dl, al
mov byte [esi], dl
inc esi
shl cl, 6
jmp 0x423e73
mov dl, cl
shr dl, 4
or dl, al
mov byte [esi], dl
inc esi
shl cl, 4
jmp 0x423e73
shl cl, 2
mov al, cl
inc edi
cmp edi, dword [ebp - 4]
jl 0x423dce
pop edi
mov eax, esi
sub eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret