joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019c0c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10019ca9
push ebx
push esi
call fcn.10019bd5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10019b1e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10019c56
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10019ca8
push edi
push eax
call fcn.1001720b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10019c76
call fcn.100171d1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10019ca7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10019b1e
add esp, 0x20
test eax, eax
jne 0x10019c95
push edi
call fcn.100171d1
jmp 0x10019c9d
push ebx
call fcn.100171d1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4062d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0828
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4ff1a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x4063fd
cmp byte [edi + 0x49], bl
je 0x4063fd
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x40638f
mov ecx, 0xf
mov dword [ebp - 0x18], ecx
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x406344
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x40635c
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x406393
dec eax
je 0x406397
sub eax, 2
je 0x4063ee
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040f350
xor al, al
jmp 0x4063ff
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x4063a7
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x4063d0
cmp ebx, 0x10
jae 0x4063b6
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.004921c9
add esp, 0x10
cmp esi, eax
jne 0x406380
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x4063ee
test esi, esi
jne 0x406350
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00405e70
jmp 0x40634a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040f350
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004911d1
mov esp, ebp
pop ebp
ret
Function at 0x408a50
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1302
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ff1a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
lea eax, [edi + 0x68]
mov dword [edi], 0x4c45f4
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.std::ios_base.0
mov dword [ebp - 4], ebx
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov eax, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [edi]
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov esi, dword [edx + 4]
add esi, edi
mov ecx, esi
call fcn.0040d340
lea eax, [edi + 0x10]
push 0x20
mov ecx, esi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
call fcn.0040aaf0
mov byte [esi + 0x40], al
cmp dword [esi + 0x38], ebx
jne 0x408af2
mov eax, dword [esi + 0xc]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, esi
call fcn.0040dbb0
mov dword [ebp - 4], 4
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea esi, [edi + 0x10]
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.0040a6a0
mov byte [ebp - 4], 5
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x502ac4]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a6a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af053
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ff1a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00490004
mov dword [ebp - 4], 0
push 4
call fcn.00490d21
mov edi, eax
add esp, 4
test edi, edi
je 0x40a728
call fcn.0048f9cd
mov dword [edi], eax
call fcn.0048f78c
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0048f6c1
mov byte [ebp - 4], 1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40a71a
inc eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0048f6e9
jmp 0x40a72a
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412a50
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8198
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4ff1a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, ecx
lea edi, [ebx + 0xa8]
mov dword [ebp - 0x258], 0
cmp dword [edi + 0x10], 0
mov dword [ebp - 0x25c], esi
je 0x412ae0
cmp dword [edi + 0x14], 8
jb 0x412aa9
mov eax, dword [edi]
jmp 0x412aab
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
test al, al
je 0x412ae0
xor ebx, ebx
push 0xffffffffffffffff
push ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push edi
mov ecx, esi
mov word [esi], ax
call fcn.0040f1f0
mov dword [ebp - 4], ebx
jmp 0x412c8f
cmp byte [ebx + 0x134], 0
je 0x412b5f
cmp dword [ebx + 0x128], 0
je 0x412b5f
call fcn.0042c710
mov ecx, edi
test eax, eax
je 0x412b2e
push 9
push str.C:Users_
call fcn.00410dc0
push 0xffffffffffffffff
push 0
add ebx, 0x118
push ebx
mov ecx, eax
call fcn.00410cb0
push 0x13
push str.AppDataLocalTemp
mov ecx, eax
call fcn.00410dc0
jmp 0x412c6a
push 0x1a
push str.C:Documents_and_Settings_
call fcn.00410dc0
push 0xffffffffffffffff
push 0
add ebx, 0x118
push ebx
mov ecx, eax
call fcn.00410cb0
push 0x14
push str.Local_SettingsTemp
mov ecx, eax
call fcn.00410dc0
jmp 0x412c6a
lea ecx, [ebp - 0x254]
call fcn.00412d50
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x238]
push ecx
call fcn.00418a60
add esp, 8
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.00409ad0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x224], 8
jb 0x412ba9
mov edx, dword [ebp - 0x238]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], 0
mov word [ebp - 0x238], ax
mov byte [ebp - 4], al
cmp dword [ebp - 0x240], 0x10
jb 0x412be1
mov ecx, dword [ebp - 0x254]
push ecx
call fcn.00490458
add esp, 4
cmp dword [ebx + 0xb8], 0
mov dword [ebp - 0x240], 0xf
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x254], 0
jne 0x412c6a
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x21a]
push eax
mov word [ebp - 0x21c], dx
call fcn.004911e0
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x412c6a
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412c42
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x21c]
push edx
mov ecx, edi
call fcn.0040e680
mov eax, 0x5c
call fcn.00419780
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push edi
mov ecx, esi
mov word [esi], ax
call fcn.0040f1f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x258], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004911d1
mov esp, ebp
pop ebp
ret 4
Function at 0x415740
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af053
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ff1a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00490004
mov dword [ebp - 4], 0
push 4
call fcn.00490d21
mov edi, eax
add esp, 4
test edi, edi
je 0x4157c8
call fcn.0048f9cd
mov dword [edi], eax
call fcn.0048f78c
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0048f6c1
mov byte [ebp - 4], 1
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4157ba
inc eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0048f6e9
jmp 0x4157ca
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b170
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1908
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x4ff1a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov esi, 0xf
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040e860
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x41b1d3
push 0x14
push str.dwIr23Cew_T_R471_
lea ecx, [ebp - 0x2c]
call fcn.0040ebe0
cmp edi, ebx
jne 0x41b1fa
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0x10
jb 0x41b1f0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00490458
add esp, 4
mov dword [ebp - 0x18], esi
xor eax, eax
jmp 0x41b292
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x98], 0x67452301
mov dword [ebp - 0x94], 0xefcdab89
mov dword [ebp - 0x90], 0x98badcfe
mov dword [ebp - 0x8c], 0x10325476
jae 0x41b23d
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x98]
call fcn.00431f60
cmp byte [ebp - 0x30], bl
jne 0x41b25c
mov ecx, esi
mov byte [ebp - 0x30], 1
call fcn.00432010
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push ecx
push edx
mov ecx, edi
call fcn.0041af80
add esp, 8
mov esi, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0x10
jb 0x41b289
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00490458
add esp, 4
mov dword [ebp - 0x18], 0xf
mov eax, esi
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004911d1
mov esp, ebp
pop ebp
ret
Function at 0x41b6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4edc08
push 0x4993e0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4ff1a0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [esi], edx
xor edi, edi
mov eax, dword [ebp + 0xc]
cmp eax, 4
jl 0x41b844
mov ecx, eax
and ecx, 0x80000003
jns 0x41b71a
dec ecx
or ecx, 0xfffffffc
inc ecx
jne 0x41b844
mov dword [ebp - 4], edx
mov dword [ebp - 0x28], edx
cmp edx, eax
jge 0x41b749
mov cl, byte [edx + ebx]
cmp cl, 0x80
jae 0x41b83d
movzx ecx, cl
cmp byte [ecx + 0x500f10], 0xff
je 0x41b83d
inc edx
jmp 0x41b723
push eax
call fcn.00490047
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 0xc]
push edx
push 0
push eax
call fcn.004911e0
add esp, 0x10
cmp edi, dword [ebp + 0xc]
jge 0x41b80d
movzx eax, byte [edi + ebx]
mov cl, byte [eax + 0x500f10]
inc edi
mov dword [ebp - 0x1c], edi
movzx edx, byte [edi + ebx]
inc edi
mov dword [ebp - 0x1c], edi
movzx eax, byte [edx + 0x500f10]
mov ebx, eax
shr ebx, 4
and ebx, 3
movzx ecx, cl
add ecx, ecx
add ecx, ecx
or ebx, ecx
mov ecx, dword [esi]
mov edx, dword [ebp - 0x24]
mov byte [edx + ecx], bl
inc dword [esi]
mov ecx, dword [esi]
mov dword [ebp - 0x20], ecx
mov ebx, dword [ebp + 8]
mov cl, byte [edi + ebx]
inc edi
mov dword [ebp - 0x1c], edi
cmp cl, 0x3d
je 0x41b810
movzx ecx, cl
movzx ecx, byte [ecx + 0x500f10]
mov dword [ebp - 0x2c], ecx
shr ecx, 2
and ecx, 0xf
and eax, 0xf
shl eax, 4
or ecx, eax
mov eax, dword [ebp - 0x20]
mov byte [eax + edx], cl
inc dword [esi]
mov ecx, dword [esi]
mov dword [ebp - 0x20], ecx
mov al, byte [edi + ebx]
inc edi
mov dword [ebp - 0x1c], edi
cmp al, 0x3d
je 0x41b810
movzx eax, al
mov al, byte [eax + 0x500f10]
mov ecx, dword [ebp - 0x2c]
and ecx, 3
shl ecx, 6
movzx eax, al
or ecx, eax
mov eax, dword [ebp - 0x20]
mov byte [eax + edx], cl
inc dword [esi]
jmp 0x41b761
mov edx, dword [ebp - 0x24]
mov dword [ebp - 4], 0xfffffffe
mov eax, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41eb80
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3516
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x4ff1a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x248], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
jb 0x41ebd9
mov eax, dword [eax]
push 0x20219
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x240]
call fcn.00420780
test eax, eax
jne 0x41ed70
push 0x206
lea edx, [ebp - 0x216]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x218], cx
call fcn.004911e0
add esp, 0xc
mov dword [ebp - 0x244], 0x104
xor esi, esi
mov edi, dword [ebp - 0x240]
lea eax, [ebp - 0x250]
push eax
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x244]
push ecx
lea edx, [ebp - 0x218]
push edx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41ed55
mov word [ebp - 0x234], ax
mov edi, 7
lea eax, [ebp - 0x218]
inc esi
mov dword [ebp - 0x244], 0x104
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x224], ebx
lea edx, [eax + 2]
jmp 0x41ec80
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41ec80
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x234]
call fcn.0040e680
mov byte [ebp - 4], 1
push 4
push ebx
push str..KB
lea ecx, [ebp - 0x234]
call fcn.0041a490
cmp eax, 0xffffffff
jne 0x41ed20
push 8
push ebx
push str._Office
lea ecx, [ebp - 0x234]
call fcn.0041a490
cmp eax, 0xffffffff
jne 0x41ed20
mov edi, dword [ebp - 0x248]
lea ecx, [ebp - 0x234]
call fcn.00419ee0
mov byte [ebp - 4], bl
cmp dword [ebp - 0x220], 8
jb 0x41ed02
mov edx, dword [ebp - 0x234]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], ax
jmp 0x41ec21
mov byte [ebp - 4], bl
cmp dword [ebp - 0x220], 8
jb 0x41ed3b
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.00490458
add esp, 4
xor edx, edx
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], dx
jmp 0x41ec21
cmp edi, ebx
je 0x41ed68
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x240], ebx
mov edi, ebx
mov dword [ebp - 0x23c], ebx
jmp 0x41ed76
mov edi, dword [ebp - 0x240]
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x41edac
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x240], ebx
mov eax, esi
mov dword [ebp - 0x23c], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004911d1
mov esp, ebp
pop ebp
ret
Function at 0x4218b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1d10
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4ff1a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, ecx
cmp dword [esi + 0x10], 0
mov edi, edx
je 0x421908
cmp dword [esi + 0x14], 8
jb 0x4218f5
mov eax, dword [esi]
jmp 0x4218f7
mov eax, esi
push eax
call ebx
cmp eax, 1
sete al
test al, al
jne 0x4219ae
cmp dword [edi + 0x10], 0
je 0x42192b
cmp dword [edi + 0x14], 8
jb 0x421918
mov eax, dword [edi]
jmp 0x42191a
mov eax, edi
push eax
call ebx
cmp eax, 1
sete al
test al, al
jne 0x4219ae
mov edx, edi
lea ecx, [ebp - 0x48]
call fcn.004219d0
mov edi, eax
mov dword [ebp - 4], 0
mov edx, esi
lea ecx, [ebp - 0x2c]
call fcn.004219d0
mov edx, eax
mov byte [ebp - 4], 1
mov eax, edi
call fcn.00407ea0
mov bl, al
mov byte [ebp - 4], 0
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jb 0x421971
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00490458
add esp, 4
xor edi, edi
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], esi
jb 0x421999
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.00490458
add esp, 4
test bl, bl
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], edi
mov byte [ebp - 0x48], 0
setne al
jmp 0x4219b0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004911d1
mov esp, ebp
pop ebp
ret
Function at 0x423ad0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [esi + 0x10], 0
push ebx
push edi
je 0x423b7e
mov ebx, 8
cmp dword [esi + 0x14], ebx
jb 0x423af0
mov eax, dword [esi]
jmp 0x423af2
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
test al, al
je 0x423b7e
mov ecx, esi
call fcn.004222c0
test al, al
je 0x423b16
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], ebx
jb 0x423b1f
mov eax, dword [esi]
jmp 0x423b21
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
jne 0x423b7e
cmp byte [ebp + 8], al
je 0x423b7e
cmp dword [esi + 0x14], ebx
jb 0x423b3c
mov eax, dword [esi]
jmp 0x423b3e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x423b5f
and eax, 0xfffffffe
cmp dword [esi + 0x14], ebx
jb 0x423b55
mov ecx, dword [esi]
jmp 0x423b57
mov ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], ebx
jb 0x423b68
mov eax, dword [esi]
jmp 0x423b6a
mov eax, esi
push eax
call edi
test eax, eax
jne 0x423b7e
mov ecx, esi
call fcn.00424e90
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x423b90
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, eax
cmp dword [esi + 0x10], 0
jne 0x423ba7
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x423baf
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x423bd1
push esi
call fcn.00423700
add esp, 4
push esi
call fcn.00423300
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
push 0
call fcn.00423ad0
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret