joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412a20
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x1028
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1024], eax
mov ecx, dword [esp + 0x1038]
push ebx
push ebp
mov ebp, dword [esp + 0x103c]
push esi
mov esi, dword [esp + 0x1038]
push edi
mov edi, dword [esp + 0x1040]
mov dword [esp + 0x18], ecx
test edi, edi
je 0x412a6c
mov eax, dword [edi]
or eax, dword [edi + 4]
mov byte [esp + 0x10], 1
jne 0x412a71
mov byte [esp + 0x10], 0
test ebp, ebp
je 0x412a82
mov eax, dword [ebp]
or eax, dword [ebp + 4]
mov byte [esp + 0x12], 1
jne 0x412a87
mov byte [esp + 0x12], 0
test ecx, ecx
je 0x412a97
mov eax, dword [ecx]
or eax, dword [ecx + 4]
mov byte [esp + 0x11], 1
jne 0x412a9c
mov byte [esp + 0x11], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x412ad0
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.00416a90
test al, al
je 0x412b0a
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x412b0a
test bl, 1
je 0x412b0a
push 0
push esi
mov byte [esp + 0x1b], 1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x412b0f
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.00416a90
test al, al
je 0x412b0f
push 0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x412b0f
mov byte [esp + 0x13], 0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x412b73
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.00416a90
test al, al
je 0x412bfe
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x412bfe
cmp byte [esp + 0x10], 0
je 0x412b86
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.004238c0
cmp byte [esp + 0x12], 0
je 0x412b99
lea eax, [esp + 0x2c]
mov ecx, ebp
push eax
call fcn.004238c0
cmp byte [esp + 0x11], 0
je 0x412bae
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
call fcn.004238c0
movzx eax, byte [esp + 0x10]
lea ecx, [esp + 0x1c]
neg eax
mov edi, dword [esp + 0x14]
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x24]
push eax
movzx eax, byte [esp + 0x15]
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x30]
push eax
movzx eax, byte [esp + 0x1a]
neg eax
sbb eax, eax
and eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 0
je 0x412bfe
push ebx
push esi
call fcn.00412c20
mov ecx, dword [esp + 0x1034]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x1028
ret 0x10
Function at 0x412c20
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
push dword [esp + 0x1014]
mov esi, dword [esp + 0x1014]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x412c85
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00416a90
test al, al
je 0x412c85
push dword [esp + 0x1014]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
jmp 0x412c87
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 8

Function at 0x412d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44364b
mov eax, dword fs:[0]
push eax
mov eax, 0x3054
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.00416e50
test al, al
je 0x412e2e
lea ecx, [ebp - 0x3060]
call fcn.00413430
push esi
lea ecx, [ebp - 0x3060]
mov dword [ebp - 4], 0
call fcn.00413600
push 0
lea eax, [ebp - 0x2058]
mov dword [ebp - 0x1048], 0
push eax
lea ecx, [ebp - 0x3060]
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0x103c], 0
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x1034], 0
call fcn.004134e0
lea ecx, [ebp - 0x3060]
mov bl, al
call fcn.00413450
mov al, bl
jmp 0x412e67
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x412e64
push 0x800
lea eax, [ebp - 0x1010]
push eax
push esi
call fcn.00416a90
test al, al
je 0x412e61
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f943
mov esp, ebp
pop ebp
ret 4
Function at 0x413620
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x1260]
push edi
mov edi, dword [esp + 0x126c]
push eax
cmp esi, 0xffffffff
jne 0x4136cf
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4136f4
push 0x800
lea eax, [esp + 0x260]
push eax
push ebx
call fcn.00416a90
test al, al
je 0x41369d
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4136f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4136c2
cmp eax, 3
je 0x4136c2
cmp eax, 0x12
je 0x4136c2
mov eax, 1
mov byte [edi + 0x1044], al
jmp 0x41379f
xor eax, eax
mov byte [edi + 0x1044], al
jmp 0x41379f
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4136f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne cl
or eax, 0xffffffff
mov byte [edi + 0x1044], cl
jmp 0x4137a1
push 0x800
push ebx
push edi
call fcn.00422a80
push 0x800
lea eax, [esp + 0x3c]
push eax
push edi
call fcn.00417380
mov ecx, dword [esp + 0x28]
xor eax, eax
add eax, dword [esp + 0x2c]
mov dword [edi + 0x1000], eax
mov eax, dword [esp + 0xc]
adc ecx, 0
mov dword [edi + 0x1008], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 0x1028], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0x102c], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x1030], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x1034], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1038], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x103c], eax
lea eax, [esp + 0x20]
mov dword [edi + 0x1004], ecx
lea ecx, [edi + 0x1010]
push eax
call fcn.00423e80
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0x1018]
call fcn.00423e80
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0x1020]
call fcn.00423e80
mov eax, esi
mov ecx, dword [esp + 0x125c]
mov dword [edi + 0x1040], 0
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x1254
ret 0xc
Function at 0x416670
Capabilities:
Get common file path

Disassembly:
sub esp, 0xc
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov edi, dword [esp + 0x1c]
xor eax, eax
xor bl, bl
mov word [edi], ax
lea eax, [esp + 0xc]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4166f7
push edi
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4166f7
cmp word [edi], 0
je 0x4166f7
mov esi, dword [esp + 0x20]
push esi
push edi
call fcn.004159a0
push esi
push 0x44778c
push edi
call fcn.00422a40
push edi
call fcn.004124b0
mov bl, al
test bl, bl
jne 0x4166f7
cmp byte [esp + 0x24], al
je 0x4166f7
push 0
push 0
push edi
call fcn.00412810
test eax, eax
sete bl
mov eax, dword [esp + 0x10]
push dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x445258]
call esi
mov ecx, dword [esp + 0x14]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0xc
ret 0xc

Function at 0x416910
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
xor eax, eax
push esi
mov esi, dword [esp + 0x14]
push edi
mov word [esi], ax
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SoftwareWinRARPaths
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x1c]
test eax, eax
jne 0x416969
lea eax, [esp + 0xc]
mov dword [esp + 0xc], edi
push eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
push str.AppData
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x416979
push esi
call fcn.004124b0
test al, al
jne 0x4169b5
push dword [esp + 0x20]
push edi
push esi
call fcn.00416670
test al, al
jne 0x4169b5
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.00417280
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x4169b0
cmp word [esi + 2], 0x3a
jne 0x4169ad
lea ecx, [esi + 8]
cmp eax, ecx
jb 0x4169b0
sub eax, 2
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
add esp, 0xc
ret 0xc
Function at 0x416a90
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x1010]
push esi
mov esi, dword [esp + 0x1010]
movzx eax, word [esi]
test ax, ax
jne 0x416ac7
xor al, al
jmp 0x416c9e
push edi
push eax
call fcn.004228c0
mov edi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x416ad3
movzx eax, word [esi]
sub edi, ecx
sar edi, 1
push ebp
cmp eax, 0x5c
jne 0x416af4
cmp word [esi + 2], ax
lea ebp, [esi + 2]
je 0x416b2a
push eax
call fcn.004228c0
movzx eax, ax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x416bc1
cmp word [esi + 2], 0x3a
lea ebp, [esi + 2]
jne 0x416bc1
movzx eax, word [esi + 4]
cmp eax, 0x5c
je 0x416b2a
cmp eax, 0x2f
jne 0x416bc1
movzx eax, word [esi]
push eax
call fcn.004228c0
movzx eax, ax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x416b73
cmp word [ebp], 0x3a
jne 0x416b73
lea eax, [edi + 4]
mov edi, dword [esp + 0x1020]
cmp edi, eax
jbe 0x416c9a
push edi
push 0x447870
push ebx
call fcn.00422a80
push edi
push esi
push ebx
call fcn.00422a40
mov al, 1
jmp 0x416c9c
cmp word [esi], 0x5c
jne 0x416c9a
cmp word [ebp], 0x5c
jne 0x416c9a
mov esi, dword [esp + 0x1020]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x416c9a
push esi
push 0x447870
push ebx
call fcn.00422a80
push esi
push 0x44787c
push ebx
call fcn.00422a40
push esi
push ebp
push ebx
call fcn.00422a40
mov al, 1
jmp 0x416c9c
lea eax, [esp + 0x10]
push eax
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x416c9a
cmp eax, 0x7ff
ja 0x416c9a
movzx eax, word [esi]
cmp eax, 0x5c
je 0x416c61
cmp eax, 0x2f
je 0x416c61
push 0x800
lea eax, [esp + 0x14]
push eax
call fcn.004159a0
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416c07
sub ecx, edx
lea eax, [edi + 4]
mov edi, dword [esp + 0x1020]
sar ecx, 1
add eax, ecx
cmp edi, eax
jbe 0x416c9a
push edi
push 0x447870
push ebx
call fcn.00422a80
push edi
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00422a40
cmp word [esi], 0x2e
jne 0x416c55
movzx eax, word [esi + 2]
push eax
call fcn.00416e30
test al, al
je 0x416c55
add esi, 4
push edi
push esi
push ebx
call fcn.00422a40
mov al, 1
jmp 0x416c9c
lea eax, [edi + 6]
mov edi, dword [esp + 0x1020]
cmp edi, eax
jbe 0x416c9a
push edi
push 0x447870
push ebx
call fcn.00422a80
xor eax, eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x10]
push edi
push eax
push ebx
call fcn.00422a40
push edi
push esi
push ebx
call fcn.00422a40
mov al, 1
jmp 0x416c9c
xor al, al
pop ebp
pop edi
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 0xc
Function at 0x418b90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, 1
push esi
mov esi, dword [esp + 0xc]
xor cl, cl
cmp esi, eax
jbe 0x418bac
xor cl, byte [eax + edx]
inc eax
cmp eax, esi
jb 0x418ba4
cmp cl, byte [edx]
jne 0x418bed
push esi
push edx
push 0xffffffffffffffff
call fcn.0040ae60
xor edx, edx
not eax
xor ecx, ecx
nop
cmp dword [ecx + 0x45142c], eax
jne 0x418bd0
cmp dword [ecx + 0x451428], esi
je 0x418bdd
add ecx, 0xc
inc edx
cmp ecx, 0x48
jb 0x418bc0
pop esi
ret 0xc
lea eax, [edx + edx*2]
mov ecx, dword [eax*4 + 0x451430]
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
pop esi
ret 0xc

Function at 0x419890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4439aa
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x451a14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], 0
mov edx, 0x1c
mov dword [esi + 0x14], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x24], 0
mov eax, dword [eax + 0x84e0]
mov dword [esi + 0x40], eax
mul edx
mov dword [ebp - 4], 0
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042fd23
xor edx, edx
mov dword [esi + 0x44], eax
add esp, 4
cmp dword [esi + 0x40], edx
jbe 0x41995b
xor ecx, ecx
lea esp, [esp]
mov eax, dword [esi + 0x44]
lea ecx, [ecx + 0x1c]
inc edx
mov dword [ecx + eax - 0x1c], esi
mov eax, dword [esi + 0x44]
mov dword [eax + ecx - 0x18], 0
cmp edx, dword [esi + 0x40]
jb 0x419940
cmp byte [ebp + 0xc], 0
je 0x41997c
mov dword [esi + 0x3c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x338
call fcn.0042f902
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4199a0
push dword [esi + 0x40]
mov ecx, eax
call fcn.00423230
jmp 0x4199a2
xor eax, eax
push 0x4000010
mov byte [ebp - 4], 0
mov dword [esi + 0x3c], eax
call fcn.0042fd23
mov ecx, eax
mov dword [esi + 0x1c], eax
not ecx
add esp, 4
inc ecx
and ecx, 0xf
add ecx, eax
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41d5b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x2010
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x200c], eax
push esi
mov esi, dword [esp + 0x2018]
push edi
mov edi, dword [esp + 0x2020]
cmp edi, esi
je 0x41d5ea
push dword [esp + 0x2024]
push esi
push edi
call fcn.00422a80
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SoftwareWinRARGeneral
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d6bf
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d610
sub ecx, edx
mov eax, 0x7ff
sar ecx, 1
sub eax, ecx
add eax, eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1018]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.LanguageFolder
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41d6b5
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
push 0x800
push eax
lea eax, [esp + 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x800
lea eax, [esp + 0x18]
push eax
call fcn.004159a0
push 0x800
push esi
call fcn.00417280
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00422a40
lea eax, [esp + 0x14]
push eax
call fcn.004124b0
test al, al
je 0x41d6b5
push dword [esp + 0x2024]
lea eax, [esp + 0x18]
push eax
push edi
call fcn.00422a80
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2014]
pop edi
pop esi
xor ecx, esp
call fcn.0042f943
add esp, 0x2010
ret 0xc

Function at 0x41d6e0
Capabilities:
Check os version

Disassembly:
mov eax, 0x1120
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x111c], eax
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1130]
cmp byte [esi], 0
je 0x41d721
push dword [0x45c2c0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x45c2c4]
mov dword [0x45c2c0], eax
mov byte [esi], 0
lea eax, [esp + 0x124]
push 0x800
test edi, edi
je 0x41d73a
push edi
push eax
call fcn.00422a80
jmp 0x41d743
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push 0x447980
lea eax, [esp + 0x12c]
push eax
call fcn.00417380
push 0x800
lea eax, [esp + 0x128]
push eax
push eax
call fcn.0041d5b0
lea eax, [esp + 8]
mov dword [esp + 8], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x18], 2
jne 0x41d7b1
mov eax, dword [esp + 0xc]
cmp eax, 5
ja 0x41d79d
jne 0x41d7b1
cmp word [esp + 0x11c], 2
jb 0x41d7b1
push 2
push 0
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x41d7bf
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x45c2c0], eax
pop edi
setne al
mov byte [esi], al
test al, al
mov eax, dword [esp + 0x1128]
pop esi
mov dword [0x45c2c4], eax
jne 0x41d7e2
mov dword [0x45c2c0], eax
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.0042f943
add esp, 0x1120
ret 8
Function at 0x41e1d0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
cmp dword [esp + 8], 0
mov edx, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
movups xmm2, xmmword [esi + 8]
lea edi, [esi + 0x18]
jbe 0x41e245
mov ecx, dword [esp + 0xc]
mov eax, ecx
add ecx, 0x10
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 4]
movups xmm3, xmmword [eax]
mov eax, ecx
dec ecx
add eax, eax
movups xmm1, xmmword [edi + eax*8]
pxor xmm1, xmm3
test ecx, ecx
jle 0x41e221
mov eax, ecx
shl eax, 4
add eax, edi
movups xmm0, xmmword [eax]
dec ecx
lea eax, [eax - 0x10]
aesdec xmm1, xmm0
test ecx, ecx
jg 0x41e211
cmp byte [esi + 1], 0
movups xmm0, xmmword [edi]
aesdeclast xmm1, xmm0
je 0x41e233
pxor xmm1, xmm2
mov eax, edx
movaps xmm2, xmm3
add edx, 0x10
sub dword [esp + 0x10], 1
movups xmmword [eax], xmm1
jne 0x41e1e6
pop edi
movups xmmword [esi + 8], xmm2
pop esi
ret 0xc

Function at 0x41e250
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push edi
mov edi, ecx
mov ebp, 1
cmp dword [edi + 4], ebp
jle 0x41e38f
push ebx
push esi
mov esi, 0x10
jmp 0x41e280
xor eax, eax
movzx ecx, byte [esi + edi + 0x1b]
movzx edx, byte [esi + edi + 0x1a]
movzx ebx, byte [eax + ecx*4 + 0x463180]
xor bl, byte [eax + edx*4 + 0x462d80]
movzx ecx, byte [esi + edi + 0x19]
movzx edx, byte [esi + edi + 0x1e]
xor bl, byte [eax + ecx*4 + 0x462980]
movzx ecx, byte [esi + edi + 0x18]
xor bl, byte [eax + ecx*4 + 0x462580]
movzx ecx, byte [esi + edi + 0x1f]
mov byte [esp + eax + 0x10], bl
movzx ebx, byte [eax + ecx*4 + 0x463180]
xor bl, byte [eax + edx*4 + 0x462d80]
movzx ecx, byte [esi + edi + 0x1d]
movzx edx, byte [edi + esi + 0x22]
xor bl, byte [eax + ecx*4 + 0x462980]
movzx ecx, byte [esi + edi + 0x1c]
xor bl, byte [eax + ecx*4 + 0x462580]
movzx ecx, byte [edi + esi + 0x23]
mov byte [esp + eax + 0x14], bl
movzx ebx, byte [eax + ecx*4 + 0x463180]
xor bl, byte [eax + edx*4 + 0x462d80]
movzx ecx, byte [edi + esi + 0x21]
movzx edx, byte [esi + edi + 0x26]
xor bl, byte [eax + ecx*4 + 0x462980]
movzx ecx, byte [edi + esi + 0x20]
xor bl, byte [eax + ecx*4 + 0x462580]
movzx ecx, byte [esi + edi + 0x27]
mov byte [esp + eax + 0x18], bl
movzx ebx, byte [eax + ecx*4 + 0x463180]
movzx ecx, byte [esi + edi + 0x25]
xor bl, byte [eax + edx*4 + 0x462d80]
xor bl, byte [eax + ecx*4 + 0x462980]
movzx ecx, byte [esi + edi + 0x24]
xor bl, byte [eax + ecx*4 + 0x462580]
mov byte [esp + eax + 0x1c], bl
inc eax
cmp eax, 4
jl 0x41e282
mov eax, dword [esp + 0x10]
inc ebp
mov dword [edi + esi + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [edi + esi + 0x1c], eax
mov eax, dword [esp + 0x18]
mov dword [edi + esi + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + esi + 0x24], eax
add esi, 0x10
cmp ebp, dword [edi + 4]
jl 0x41e280
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
pop edi
pop ebp
xor ecx, esp
call fcn.0042f943
add esp, 0x14
ret
Function at 0x41f4c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
test eax, eax
jne 0x41f4e5
push edi
push 0
push ebp
call fcn.00432370
mov eax, dword [esp + 0x1c]
add esp, 0xc
push edi
push ebp
push dword [esp + 0x20]
mov ecx, esi
push dword [esp + 0x20]
push eax
call fcn.0041f220
test al, al
jne 0x41f5a0
cmp dword [esp + 0x14], 0
push ebx
jne 0x41f560
cmp dword [esi + 0x24], edi
je 0x41f535
push dword [esi + 0x20]
call fcn.0042fd2c
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042fd23
add esp, 8
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
xor ebx, ebx
test edi, edi
je 0x41f560
mov ebp, dword [esp + 0x1c]
nop
movzx edx, word [ebx + ebp]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x20]
mov eax, dword [eax + edx*4]
mov dword [ecx + ebx*4], eax
add ebx, 2
cmp ebx, edi
jb 0x41f540
mov ebp, dword [esp + 0x20]
jmp 0x41f560
mov ecx, dword [esi + 0xc]
xor edx, edx
imul ecx, dword [esp + 0x18]
mov eax, dword [esi + 0x1c]
add ecx, dword [esp + 0x14]
mov ecx, dword [eax + ecx*4]
mov eax, dword [esi + 4]
mov ebx, dword [eax + ecx*4]
test edi, edi
je 0x41f599
mov edi, edi
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + edx*4]
mov eax, dword [esi]
add ecx, ebx
mov ax, word [eax + ecx*4]
xor word [edx + ebp], ax
add edx, 2
cmp edx, edi
jb 0x41f580
pop ebx
lea ebx, [ebx]
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x420490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.0042f960
mov eax, dword [0x451a14]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
mov ebx, ecx
cmp byte [esi], 0
je 0x420589
push ebp
push edi
lea edi, [ebx + 0x101e]
push edi
call fcn.00417280
mov ebp, eax
cmp ebp, edi
jbe 0x4204f5
xor eax, eax
push edi
mov word [ebp - 2], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0x5c
mov word [ebp - 2], cx
cmp eax, 0xffffffff
je 0x4204f5
test eax, 0x400
je 0x4204f5
mov byte [esi], 0
push 0x447a14
push edi
call fcn.00432c8c
add esp, 8
test eax, eax
jne 0x420524
cmp byte [esi], al
je 0x420587
mov ecx, dword [ebx + 0x40f0]
test ecx, ecx
je 0x420529
push 1
push 1
push eax
push edi
call fcn.00407ab0
test al, al
je 0x420529
mov byte [esi], 0
jmp 0x420587
cmp byte [esi], 0
je 0x420587
mov ecx, dword [ebx + 0x30e0]
test ecx, ecx
je 0x42053e
push edi
call fcn.00422b40
mov ebp, dword [ebx + 0x30e4]
test ebp, ebp
je 0x420561
mov esi, dword [ebx + 0x30ec]
mov ecx, ebp
push 1
call fcn.0041c5d0
mov ecx, dword [ebp + 4]
mov eax, dword [ebp]
mov dword [eax + ecx*4 - 4], esi
push 0x800
lea eax, [esp + 0x14]
push eax
push edi
call fcn.00415a20
lea eax, [esp + 0x10]
push eax
push 0x57
call fcn.0040ccc0
mov ecx, 0x45c338
call fcn.0040d310
pop edi
pop ebp
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.0042f943
add esp, 0x1004
ret 4