joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c47d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
push 0x42470c
xor edi, edi
push edi
push 0x18
push 0x403270
push 0x403280
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
mov ebx, 0x80070000
test esi, esi
jle 0x40c4c4
movzx esi, si
or esi, ebx
test esi, esi
js 0x40c564
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push 0x2001f
push edi
push 0x403308
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x40c4f4
movzx esi, si
or esi, ebx
test esi, esi
js 0x40c55b
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push edi
push 0x403380
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40c52b
movzx esi, si
or esi, ebx
test esi, esi
js 0x40c55b
mov eax, dword [0x42470c]
push dword [ebp - 0xc]
not eax
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
push edi
push 0x403380
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jle 0x40c55b
movzx esi, si
or esi, ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c99d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 4
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 1
push eax
push 0
push 2
push dword [0x4041f4]
call dword [sym.imp.iertutil.dll_Ordinal_654]
mov esi, eax
test esi, esi
js 0x40ca61
push ebx
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
push 0x403480
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40ca40
push 0x401f0c
lea eax, [ebp - 0x20c]
push eax
push 0x403494
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00408504
mov esi, eax
add esp, 0x14
test esi, esi
js 0x40ca40
push dword [0x4045b8]
lea edx, [ebp - 0x414]
call fcn.0040dbd3
mov esi, eax
test esi, esi
jns 0x40ca60
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
push 4
push eax
push 0
push 2
push dword [0x4041f4]
call dword [sym.imp.iertutil.dll_Ordinal_654]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00423360
mov esp, ebp
pop ebp
ret
Function at 0x40ca77
Capabilities:
Get common file path
Get program files directory
Get system information on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
mov esi, ecx
mov dword [ebp - 0x210], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x210], ebx
je 0x40caed
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
push 0x4034f8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x40cb50
push 0x40353c
lea ecx, [ebp - 0x20c]
call fcn.0040ed20
test eax, eax
js 0x40cb50
mov edx, edi
jmp 0x40cb3c
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push ebx
push 0x26
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40cb50
push 0x403558
lea ecx, [ebp - 0x20c]
call fcn.0040ed20
test eax, eax
js 0x40cb50
push 0x40353c
lea ecx, [ebp - 0x20c]
call fcn.0040ed20
test eax, eax
js 0x40cb50
mov edx, 0x104
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00408495
test eax, eax
js 0x40cb50
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423360
mov esp, ebp
pop ebp
ret 8

Function at 0x40cc68
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov bl, dl
mov edi, ecx
call fcn.0040cb6a
mov esi, eax
test esi, esi
js 0x40cd9a
test bl, bl
jne 0x40cca0
cmp byte [edi + 0xc], bl
je 0x40cd9a
lea eax, [ebp - 0x604]
push eax
push 0x20019
push 0
push dword [edi + 0x10]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x40ccca
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40cd9a
mov eax, dword [edi]
xor ebx, ebx
mov dword [ebp - 0x61c], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x618], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x614], eax
lea eax, [ebp - 0x600]
mov byte [ebp - 0x610], 1
mov dword [ebp - 0x60c], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x608]
mov dword [ebp - 0x608], 0xff
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push dword [ebp - 0x604]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jle 0x40cd3d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40cd79
lea eax, [ebp - 0x204]
push eax
push dword [edi + 0x10]
lea eax, [ebp - 0x600]
push 0x403f34
push 0x1fe
push eax
call fcn.00408504
mov esi, eax
add esp, 0x14
test esi, esi
js 0x40cd81
mov dl, 1
lea ecx, [ebp - 0x61c]
call fcn.0040cc68
mov esi, eax
jmp 0x40cd81
cmp esi, 0x80070103
je 0x40cd8c
inc ebx
test esi, esi
jns 0x40ccff
jmp 0x40cd8e
xor esi, esi
push dword [ebp - 0x604]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423360
mov esp, ebp
pop ebp
ret
Function at 0x40cf03
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
xor esi, esi
mov ebx, edx
cmp ax, word [edi + 4]
jae 0x40cf4f
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
movzx eax, si
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x40cf48
mov eax, dword [ebp - 4]
cmp byte [eax], 0
jne 0x40cf48
push ebx
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40cf5a
inc esi
cmp si, word [edi + 4]
jb 0x40cf1a
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor dl, dl
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 0x10]
mov al, byte [ecx + 1]
je 0x40cf72
or al, 3
mov byte [esi], 1
mov byte [ecx + 1], al
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov eax, edx
and eax, dword [ebp + 8]
cmp eax, dword [ebp + 8]
je 0x40cf96
or edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 4]
mov byte [esi], 1
and byte [ecx + 1], 0xef
mov ecx, dword [ebp - 4]
or byte [ecx + 1], 3
mov al, 1
jmp 0x40cf51

Function at 0x40d653
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
test edi, edi
je 0x40d673
call fcn.0040d54b
mov ecx, edi
or ecx, 1
cmp eax, ecx
jne 0x40d6a7
and dword [ebp - 4], 0
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.0040d787
test eax, eax
js 0x40d6a7
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x40d6a7
xor esi, esi
jmp 0x40d777
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
mov edx, edi
push eax
call fcn.0040d487
mov esi, eax
test esi, esi
js 0x40d777
mov eax, dword [ebp - 4]
movzx eax, word [eax + 2]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x40d769
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x40d74b
mov ecx, dword [ebp - 4]
lea esi, [edi + 0x14]
movzx eax, word [ecx + 2]
push eax
push ecx
push eax
push esi
call dword [sym.imp.msvcrt.dll_memcpy_s]
add esp, 0x10
push 0
push esi
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
test eax, eax
je 0x40d74b
push edi
push 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
je 0x40d726
xor esi, esi
jmp 0x40d73f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40d73d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40d760
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40d760
mov byte [eax], 1
jmp 0x40d760
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40d760
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40d76e
mov esi, 0x8007000e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40de7c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x4247bc], 0
jne 0x40ded6
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x4046a0
push reloc.SHLWAPI.dll_ParseURLW
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ded5
push esi
push esi
push esi
push esi
push 0x404734
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov dword [0x4247bc], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
cmp dword [0x4247bc], 1
sete al
mov esp, ebp
pop ebp
ret

Function at 0x40deeb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4247b8], 0
push esi
jne 0x40df6d
call fcn.0040de7c
test eax, eax
je 0x40df63
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x4046a0
push reloc.SHLWAPI.dll_ParseURLW
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40df6d
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x404718
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40df58
cmp dword [ebp - 8], eax
sete al
inc eax
mov dword [0x4247b8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40df6d
mov dword [0x4247b8], 2
xor eax, eax
cmp dword [0x4247b8], 1
pop esi
sete al
mov esp, ebp
pop ebp
ret
Function at 0x40f291
Capabilities:
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x21
push ebx
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jne 0x40f396
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call sub.msvcrt.dll_wcsrchr
pop ecx
pop ecx
test eax, eax
je 0x40f2e2
xor ecx, ecx
mov word [eax], cx
push edi
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.004096ea
mov esi, eax
test esi, esi
jne 0x40f396
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov esi, eax
test esi, esi
je 0x40f31e
cmp esi, 0x50
je 0x40f31e
cmp esi, 0xb7
jne 0x40f389
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 0x2002
test edi, eax
jne 0x40f342
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x404800
lea ecx, [ebp - 0x20c]
call fcn.0040ed20
mov esi, eax
test esi, esi
js 0x40f396
push ebx
push ebx
push 3
mov dl, 1
lea ecx, [ebp - 0x20c]
call fcn.0040f236
mov esi, eax
test esi, esi
js 0x40f396
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40f396
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f396
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423360
mov esp, ebp
pop ebp
ret
Function at 0x40f3ae
Capabilities:
Get common file path
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov bl, dl
mov eax, 0x80070057
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x40f4a1
mov eax, dword [esi]
cmp eax, 6
jne 0x40f3fc
cmp dword [ebp + 8], 0
je 0x40f3fc
push dword [ebp + 8]
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.00408495
jmp 0x40f425
cmp eax, 0xffffffff
jne 0x40f40c
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x40f429
lea ecx, [ebp - 0x20c]
or eax, 0x8000
push ecx
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40f4a1
cmp dword [esi + 0xc], 0
je 0x40f43d
push dword [esi + 0xc]
lea ecx, [ebp - 0x20c]
call fcn.0040ed20
test eax, eax
js 0x40f471
cmp dword [esi], 6
jne 0x40f453
call fcn.0040f7b1
test eax, eax
je 0x40f453
mov al, 1
jmp 0x40f455
xor al, al
test al, al
jne 0x40f46f
push edi
push dword [esi + 8]
mov dl, bl
lea ecx, [ebp - 0x20c]
push dword [esi + 4]
call fcn.0040f236
jmp 0x40f471
xor eax, eax
cmp dword [esi + 0x10], 0xffffffff
je 0x40f4a1
push dword [esi + 0x10]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40f48f
xor eax, eax
jmp 0x40f4a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40f4a1
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423360
mov esp, ebp
pop ebp
ret 8
Function at 0x40f4b9
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x484
mov eax, dword [0x424004]
xor eax, esp
mov dword [esp + 0x480], eax
push ebx
mov bl, byte [ebp + 8]
lea eax, [esp + 7]
push esi
push edi
push eax
mov edi, ecx
mov byte [esp + 0x13], 0
push 0
mov dl, bl
mov dword [esp + 0x20], edi
call fcn.0040f3ae
mov esi, eax
test bl, bl
je 0x40f50d
cmp byte [esp + 0xf], 0
jne 0x40f507
cmp byte [ebp + 0xc], 0
je 0x40f50d
mov al, 1
xor ebx, ebx
jmp 0x40f511
xor ebx, ebx
mov al, bl
mov byte [esp + 0x10], al
test esi, esi
js 0x40f68a
test al, al
je 0x40f68a
cmp dword [edi], 0xffffffff
jne 0x40f538
xor eax, eax
mov esi, ebx
mov word [esp + 0x280], ax
jmp 0x40f570
lea eax, [esp + 0x280]
push eax
push ebx
push ebx
push dword [edi]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x40f68a
push 0x40254c
lea eax, [esp + 0x284]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
cmp dword [edi + 0xc], 0
je 0x40f58f
push dword [edi + 0xc]
lea eax, [esp + 0x284]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
push 0x402538
lea eax, [esp + 0x284]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x40f68a
lea edi, [esp + 0x280]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, bx
jne 0x40f5d4
mov ebx, dword [esp + 0x18]
sub edi, ecx
push 0x2e
sar edi, 1
pop eax
cmp word [esp + 0x5c], ax
je 0x40f666
cmp word [esp + 0x5e], ax
je 0x40f666
xor eax, eax
mov word [esp + edi*2 + 0x27e], ax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x284]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x28]
or dword [esp + 0x28], 0xffffffff
add esp, 0xc
or dword [esp + 0x2c], 0xffffffff
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 8]
push dword [esp + 0x10]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x284]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
shr eax, 4
and al, 1
movzx eax, al
push eax
call fcn.0040f4b9
test esi, esi
js 0x40f666
test eax, eax
jns 0x40f666
mov esi, eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40f5ea
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x48c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00423360
mov esp, ebp
pop ebp
ret 8
Function at 0x40f6a8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov ebx, 0x4240f0
push edi
mov dword [ebp - 0x210], eax
xor edi, edi
push eax
push 1
mov ecx, ebx
call fcn.0040f4b9
mov esi, eax
test esi, esi
js 0x40f799
mov eax, dword [ebp - 0x210]
add edi, 0x14
add ebx, 0x14
cmp edi, 0xdc
jb 0x40f6cf
xor edi, edi
mov ecx, dword [edi + 0x4049d0]
call fcn.0040f291
mov esi, eax
test esi, esi
js 0x40f799
add edi, 4
cmp edi, 0x10
jb 0x40f6f9
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40f784
push 0x404800
lea ecx, [ebp - 0x20c]
call fcn.0040ed20
mov esi, eax
test esi, esi
js 0x40f799
push 0
push 0
push 3
mov dl, 1
lea ecx, [ebp - 0x20c]
call fcn.0040f236
mov esi, eax
test esi, esi
js 0x40f799
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f784
or eax, 0x2000
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x40f799
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f799
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423360
mov esp, ebp
pop ebp
ret

Function at 0x40f7b1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x4247c0]
test ecx, ecx
jne 0x40f80a
push 1
push 6
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40f804
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
mov ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 2
mov dword [0x4247c0], ecx
jmp 0x40f80a
mov ecx, dword [0x4247c0]
xor eax, eax
cmp ecx, 1
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.00423360
mov esp, ebp
pop ebp
ret

Function at 0x410590
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push esi
push edi
push 4
mov edi, ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x4105bc
and dword [esi], 0
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
jmp 0x4105be
xor esi, esi
mov dword [edi + 0x14], esi
test esi, esi
je 0x4105f2
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4105db
mov eax, dword [edi + 0x14]
mov dword [ecx], eax
jmp 0x4105dd
xor ecx, ecx
mov dword [edi + 0x10], ecx
neg ecx
sbb ecx, ecx
and ecx, 0x7ff8fff2
add ecx, 0x8007000e
jmp 0x4105f7
mov ecx, 0x8007000e
pop edi
mov eax, ecx
pop esi
ret
Function at 0x410b14
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov edi, ecx
push eax
push 0
push 2
and dword [edi], 0
mov esi, 0x80004005
push 0x404b88
push 0x404ba0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x410b8b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [edi], esi
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00423360
mov esp, ebp
pop ebp
ret

Function at 0x410ed7
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
cmp byte [0x424844], 0
jne 0x41101f
push esi
mov esi, 0x424894
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x424844], 0
jne 0x411017
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x2c], 5
jne 0x410f31
push 2
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
and dword [0x4241cc], 0
jmp 0x41100f
mov ecx, 0x4241e8
call fcn.0041720e
test eax, eax
je 0x410f72
mov ecx, 0x4241f0
call fcn.0041720e
test eax, eax
jne 0x410f69
push 0x10
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
mov dword [0x4241cc], 3
jmp 0x41100f
call fcn.00410e7a
test al, al
je 0x410f8e
push 0x20
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
mov dword [0x4241cc], 2
jmp 0x41100f
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ecx, ax
mov eax, ecx
push 4
and eax, 0x3ff
pop edx
cmp ax, dx
jne 0x410ff8
and ecx, 0xfc00
mov eax, 0x800
cmp cx, ax
jne 0x410ff8
call fcn.00417249
test al, al
je 0x410ff8
lea eax, [ebp - 4]
xor ebx, ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
push ebx
call dword [sym.imp.NETAPI32.dll_NetGetJoinInformation]
test eax, eax
jne 0x410f4d
cmp dword [ebp - 4], 3
jne 0x410fe3
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
test bl, bl
je 0x410f4d
push 4
jmp 0x410ffa
push 8
push 0x218
call dword [sym.imp.urlmon.dll_Ordinal_410]
mov dword [0x4241cc], 1
mov byte [0x424844], 1
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, dword [0x4241cc]
mov esp, ebp
pop ebp
ret