joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417462
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0
xor bl, bl
call fcn.00416588
test al, al
je 0x41754e
push 0x8007
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xc], 1
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x417529
xor edx, edx
cmp dword [ebp - 8], edx
jle 0x4174ee
mov ecx, dword [eax + edx*4]
test ecx, ecx
je 0x4174e8
cmp word [ecx], 0x2d
jne 0x4174e8
movzx ecx, word [ecx + 2]
cmp ecx, 0x66
je 0x4174e4
cmp ecx, 0x69
je 0x4174e0
cmp ecx, 0x6e
je 0x4174da
cmp ecx, 0x76
jne 0x4174e8
mov byte [ebp - 1], 1
jmp 0x4174e8
mov byte [ebp - 0xc], 0
jmp 0x4174e8
mov bl, 1
jmp 0x4174e8
mov byte [ebp - 0x10], 1
inc edx
cmp edx, dword [ebp - 8]
jl 0x4174af
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x417500
call fcn.00416f8a
jmp 0x417534
cmp byte [ebp - 1], 0
je 0x417529
call fcn.00406bd4
call fcn.00414c29
test byte [0x424730], 4
mov bl, al
je 0x417536
push 0
mov eax, 0x4233f0
call fcn.00406a4d
jmp 0x417536
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0041716a
mov bl, al
test bl, bl
je 0x41754e
test byte [0x424730], 2
je 0x41754e
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebx
leave
ret
xor eax, eax
test bl, bl
sete al
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x41755d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x47a
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x4175dd
push esi
push ebx
push dword [ebp + 0xc]
call fcn.004169d7
mov esi, eax
cmp esi, ebx
je 0x4175d5
sub eax, dword [0x424744]
push ebx
push ebx
push ebx
add eax, 0x417160
push eax
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x4175c7
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 1], 1
jmp 0x4175d5
push 0x8000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret 8
Function at 0x4175e6
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push edi
xor edi, edi
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp eax, 0xffffffff
je 0x417750
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x248], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x41773a
mov ecx, dword [ebp - 0x240]
cmp ecx, edi
jbe 0x41772a
cmp ecx, dword [0x4249a0]
je 0x41772a
xor eax, eax
cmp dword [ebp - 8], edi
jbe 0x41766e
mov edx, dword [ebp - 0xc]
cmp dword [edx + eax*4], ecx
je 0x41772a
inc eax
cmp eax, dword [ebp - 8]
jb 0x41765c
push ecx
call fcn.00416906
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x41772a
push dword [ebp - 0x240]
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x417725
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.00409d1c
push esi
mov edi, eax
call ebx
test edi, edi
je 0x417723
mov eax, dword [ebp - 0x1c]
cmp eax, dword [0x424740]
jne 0x41771d
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
cmp eax, dword [0x424738]
jne 0x41771d
mov ecx, dword [edi]
push eax
mov eax, dword [0x424734]
mov eax, dword [eax]
call fcn.0040878e
test eax, eax
jne 0x41771d
mov eax, dword [ebp - 8]
lea eax, [eax*4 + 4]
lea esi, [ebp - 0xc]
call fcn.00408698
test al, al
je 0x41771d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
push dword [ebp - 0x18]
inc dword [ebp - 8]
inc dword [ebp - 0x14]
mov dword [ecx + edx*4], eax
push dword [ebp - 0x240]
call fcn.0041755d
test al, al
je 0x41771d
mov byte [ebp - 1], 1
push edi
call fcn.0040871d
xor edi, edi
push dword [ebp - 0x18]
call ebx
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x41763b
push dword [ebp - 0x10]
call ebx
cmp dword [ebp - 0x14], edi
jne 0x417604
push dword [ebp - 0xc]
call fcn.0040871d
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417ca6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp word [0x424c00], 0
push esi
push edi
mov edi, 0x424c00
mov esi, 0x424e08
jne 0x417ce4
push 2
call fcn.00416c9b
mov ecx, edi
call fcn.00409268
add eax, eax
push eax
push edi
push esi
call fcn.00408759
xor ecx, ecx
push esi
mov word [eax + 0x424e08], cx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test ebx, ebx
je 0x417d00
or eax, 0xffffffff
mov ecx, edi
mov edx, ebx
call fcn.00408abb
push 0x40491c
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
cmp byte [esp + 0xc], 0
je 0x417d2e
cmp byte [0x42499c], 1
jbe 0x417d2e
push esi
call fcn.0040def6
push esi
call fcn.0040bed2
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x417d2e
push edi
call fcn.0040bed2
pop edi
pop esi
ret 4
Function at 0x417de7
Capabilities:
Get session user name
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
push edi
mov bl, 1
mov byte [ebp - 1], 0
jne 0x417e17
call fcn.0040e1d0
mov dword [esi], eax
test eax, eax
jne 0x417e13
xor al, al
jmp 0x41801c
mov byte [ebp - 1], 1
test byte [ebp + 0xc], 1
mov edi, 0x20000
je 0x417e69
lea eax, [ebp - 0x228]
push eax
call fcn.00416c49
push 0x2711
push esi
lea ecx, [ebp - 0x224]
call fcn.0040e291
mov bl, al
test bl, bl
je 0x417e8c
lea eax, [ebp - 0x3c]
push eax
call fcn.00416da7
cmp word [ebp - 0x3c], 0
je 0x417e65
push 0x2712
push esi
lea ecx, [ebp - 0x3c]
call fcn.0040e291
mov bl, al
test bl, bl
je 0x417e8c
test byte [ebp + 0xc], 2
je 0x417e8c
lea eax, [ebp - 8]
push eax
push edi
push 0x2713
push 4
pop ebx
mov eax, esi
mov dword [ebp - 8], 0x3000401
call fcn.0040e1e4
mov bl, al
test byte [ebp + 0xc], 4
je 0x417f05
test bl, bl
je 0x41800a
call fcn.0040881f
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
push 0x2719
push 4
pop ebx
mov eax, esi
call fcn.0040e1e4
mov bl, al
test bl, bl
je 0x41800a
call fcn.00408847
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
push 0x271b
push 4
pop ebx
mov eax, esi
call fcn.0040e1e4
mov bl, al
test bl, bl
je 0x41800a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
push 0x271a
push 4
pop ebx
mov eax, esi
call fcn.0040e1e4
mov bl, al
test bl, bl
je 0x41800a
test byte [ebp + 0xc], 8
je 0x417f5f
lea esi, [ebp - 0x10]
call fcn.00418a74
mov eax, esi
push eax
mov eax, dword [ebp + 8]
push edi
push 0x271c
push 6
pop ebx
call fcn.0040e1e4
mov bl, al
test bl, bl
je 0x418007
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push edi
push 0x271d
push 2
pop ebx
call fcn.0040e1e4
mov esi, dword [ebp + 8]
mov bl, al
test bl, bl
je 0x41800a
test byte [ebp + 0xc], 0x10
je 0x417feb
push 0x103
lea eax, [ebp - 0x248]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp + 8], eax
test eax, eax
je 0x417fa5
xor ecx, ecx
push 0x271e
mov word [ebp + eax*2 - 0x248], cx
push esi
lea ecx, [ebp - 0x248]
call fcn.0040e291
mov bl, al
mov dword [ebp + 8], 0x104
test bl, bl
je 0x41800a
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x248]
push eax
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
je 0x417feb
mov eax, dword [ebp + 8]
test eax, eax
je 0x417feb
xor ecx, ecx
push 0x271f
mov word [ebp + eax*2 - 0x248], cx
push esi
lea ecx, [ebp - 0x248]
call fcn.0040e291
mov bl, al
test bl, bl
je 0x41800a
test byte [ebp + 0xc], 0x20
je 0x41801a
push 2
push esi
call fcn.00417d33
push 0x17
push esi
call fcn.00417d33
jmp 0x41801a
mov esi, dword [ebp + 8]
cmp byte [ebp - 1], 1
jne 0x41801a
push dword [esi]
call fcn.0040871d
and dword [esi], 0
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4188dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
lea eax, [ebp - 0x424]
push eax
push 0xf6
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0xf5
ja 0x418996
lea eax, [ebp - 0x21c]
push eax
push ebx
push 0x404944
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x418996
lea eax, [ebp - 0x21c]
push eax
call fcn.0040dc45
test al, al
je 0x418996
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp + 8]
call fcn.0040c843
test al, al
je 0x418996
lea eax, [ebp - 0x21c]
push eax
push 2
pop eax
lea esi, [ebp - 0x10]
call fcn.0040daff
test al, al
je 0x41898a
lea eax, [ebp - 0x21c]
cmp dword [ebp + 8], ebx
je 0x41896f
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push eax
push 2
call fcn.004186c4
mov bl, al
lea eax, [ebp - 0x10]
call fcn.0040dba7
lea eax, [ebp - 0x21c]
push eax
call fcn.0040dc45
pop esi
mov al, bl
pop ebx
leave
ret 0xc

Function at 0x41899e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
lea eax, [ebp - 0xa4]
push eax
xor esi, esi
mov dword [ebp - 0xa4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x418a6c
push 2
pop eax
cmp dword [ebp - 0x94], eax
jne 0x418a6c
xor ecx, ecx
inc ecx
cmp byte [ebp + 0x76], cl
jne 0x418a2c
cmp dword [ebp - 0xa0], 5
jne 0x418a0b
cmp dword [ebp - 0x9c], esi
jne 0x4189f7
mov esi, ecx
jmp 0x418a6c
cmp dword [ebp - 0x9c], ecx
je 0x418a07
cmp dword [ebp - 0x9c], eax
jne 0x418a6c
mov esi, eax
jmp 0x418a6c
cmp dword [ebp - 0xa0], 6
jne 0x418a6c
cmp dword [ebp - 0x9c], esi
jne 0x418a20
push 4
jmp 0x418a6b
cmp dword [ebp - 0x9c], ecx
jne 0x418a6c
push 6
jmp 0x418a6b
cmp byte [ebp + 0x76], al
je 0x418a37
cmp byte [ebp + 0x76], 3
jne 0x418a6c
cmp dword [ebp - 0xa0], 5
jne 0x418a4c
cmp dword [ebp - 0x9c], eax
jne 0x418a6c
push 3
jmp 0x418a6b
cmp dword [ebp - 0xa0], 6
jne 0x418a6c
cmp dword [ebp - 0x9c], esi
jne 0x418a61
push 5
jmp 0x418a6b
cmp dword [ebp - 0x9c], ecx
jne 0x418a6c
push 7
pop esi
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x4193e3
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.004087d0
push 0x40
lea esi, [ebp - 0x70]
pop eax
call fcn.004066cb
push 0x41
lea esi, [ebp - 0x30]
pop eax
call fcn.004066cb
mov esi, 0x104
push esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x70]
push eax
lea edi, [ebp - 0x278]
mov eax, 0x80000002
call fcn.0040c992
cmp eax, 0xffffffff
je 0x41945b
cmp eax, ebx
jbe 0x41945b
push esi
lea eax, [ebp - 0x480]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.0041917f
cmp dword [ebp - 4], ebx
jne 0x4194c6
push 0x42
lea esi, [ebp - 0x48]
pop eax
call fcn.004066cb
mov eax, esi
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x26
mov dword [ebp - 0xc], eax
xor esi, esi
lea eax, [ebp - 0x278]
push eax
push ebx
push ebx
push dword [ebp + esi*4 - 0x18]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4194bd
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push 0x4191d9
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x278]
call fcn.0040e018
inc esi
cmp esi, 3
jb 0x419487
cmp dword [ebp - 4], ebx
jbe 0x4194d5
mov edi, dword [ebp - 8]
push 0x43
pop eax
call fcn.00418fa7
jmp 0x4194dd
push dword [ebp - 8]
call fcn.0040871d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4194e2
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
imul eax, eax, 0x8088405
push 0x20
push 0
push dword [esp + 0xc]
inc eax
push 0
push eax
mov dword [ecx], eax
call fcn.0040c0de
push edx
push eax
call fcn.0040c112
ret 4
Function at 0x419507
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x108
push ebx
push esi
push edi
call fcn.00409268
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x419627
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
call fcn.00408f57
test al, al
je 0x419627
sub esi, 4
xor ebx, ebx
mov dword [ebp - 4], 0xcf671
test esi, esi
jle 0x419573
push 8
lea ecx, [ebp - 4]
lea edi, [ebp + ebx - 0x108]
call fcn.004194e2
movsx ecx, al
mov al, byte [edi]
rol al, cl
inc ebx
mov byte [edi], al
cmp ebx, esi
jl 0x419554
mov dword [ebp - 4], 0x3039
mov dword [ebp - 8], 0x100
push esi
lea ecx, [ebp - 4]
call fcn.004194e2
push esi
lea ecx, [ebp - 4]
movsx edi, al
call fcn.004194e2
dec dword [ebp - 8]
movsx ecx, al
lea ecx, [ebp + ecx - 0x108]
mov bl, byte [ecx]
lea eax, [ebp + edi - 0x108]
mov dl, byte [eax]
mov byte [eax], bl
mov byte [ecx], dl
jne 0x419581
xor edi, edi
mov dword [ebp - 4], 0xa564
test esi, esi
jle 0x4195da
push 0x100
lea ecx, [ebp - 4]
call fcn.004194e2
xor byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
jl 0x4195c1
xor edi, edi
mov dword [ebp - 4], 0xd431
test esi, esi
jle 0x419600
push 0x100
lea ecx, [ebp - 4]
call fcn.004194e2
sub byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
jl 0x4195e7
xor eax, eax
test esi, esi
jle 0x41961a
movzx ecx, byte [ebp + eax - 0x108]
mov edx, dword [ebp + 8]
mov word [edx + eax*2], cx
inc eax
cmp eax, esi
jl 0x419606
mov ecx, dword [ebp + 8]
xor eax, eax
mov word [ecx + esi*2], ax
mov eax, esi
jmp 0x419629
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x419672
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov eax, 0x1fffe
call fcn.004086ed
mov esi, eax
xor edi, edi
mov dword [ebp - 0x10], esi
cmp esi, edi
je 0x41980e
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffff
push esi
push edi
push edi
push edi
call ebx
cmp eax, edi
jbe 0x419808
lea ecx, [eax + 1]
mov eax, esi
call fcn.004095a3
test al, al
je 0x419808
mov eax, 0xc08
call fcn.004086ed
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x419808
lea eax, [edi + 0x5fa]
push 0x45
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], esi
lea esi, [ebp - 0x6c]
pop eax
call fcn.004066cb
push 0x46
lea esi, [ebp - 0x2c]
pop eax
call fcn.004066cb
push 0x47
lea esi, [ebp - 0x1c]
pop eax
call fcn.004066cb
push 0x48
lea esi, [ebp - 0x54]
pop eax
call fcn.004066cb
push 0x49
lea esi, [ebp - 0x40]
pop eax
call fcn.004066cb
jmp 0x419724
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4197e8
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4197e8
push dword [ebp + 8]
mov esi, 0xff
push esi
push edi
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call ebx
test eax, eax
je 0x4197e8
push dword [ebp + 8]
add edi, 0x1fe
push esi
push edi
push 0
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 4]
call ebx
test eax, eax
je 0x4197e8
push dword [ebp + 8]
lea eax, [ebp - 0x40]
push esi
lea esi, [edi + 0x1fe]
push esi
push 0
push eax
push dword [ebp - 4]
call ebx
test eax, eax
je 0x4197e8
push esi
call fcn.00419507
test eax, eax
jle 0x4197e8
push 0x36
lea esi, [ebp - 0x8c]
pop eax
call fcn.004066cb
push dword [ebp - 8]
lea eax, [edi + 0x1fe]
push eax
push edi
mov edi, dword [ebp - 0xc]
mov eax, esi
push eax
mov edx, 0x307
call fcn.0040942b
add esp, 0x10
test eax, eax
jle 0x4197e8
mov esi, dword [ebp + 0xc]
push edi
mov ecx, esi
call fcn.00408b0e
test al, al
je 0x4197e8
inc dword [esi + 4]
mov eax, dword [ebp - 4]
push 1
call fcn.004095df
mov dword [ebp - 4], eax
test eax, eax
jne 0x419721
push dword [ebp - 8]
call fcn.0040871d
mov esi, dword [ebp - 0x10]
push esi
call fcn.0040871d
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41985e
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
push ebx
push esi
push edi
push 8
push 0
lea eax, [ebp - 8]
push eax
call fcn.004087d0
push 0x4a
lea esi, [ebp - 0xf8]
pop eax
call fcn.004066cb
push 0x4b
lea esi, [ebp - 0x68]
pop eax
call fcn.004066cb
mov ebx, 0x104
push ebx
mov eax, esi
push eax
lea eax, [ebp - 0xf8]
push eax
lea edi, [ebp - 0x300]
mov eax, 0x80000001
call fcn.0040c992
cmp eax, 0xffffffff
je 0x4198e7
test eax, eax
je 0x4198e7
push ebx
lea eax, [ebp - 0x508]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.00419672
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edi, edi
cmp dword [ebp - 4], edi
jne 0x419a0c
push 0x4d
lea esi, [ebp - 0x3c]
pop eax
call fcn.004066cb
push 0x4e
lea esi, [ebp - 0x94]
pop eax
call fcn.004066cb
push 0x4f
lea esi, [ebp - 0x50]
pop eax
call fcn.004066cb
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x10], eax
mov eax, esi
mov dword [ebp - 0x24], 0x24
mov dword [ebp - 0x20], 0x1a
mov dword [ebp - 0x1c], 0x26
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0xc], eax
mov esi, dword [ebp + edi*4 - 0x24]
lea eax, [ebp - 0x300]
push eax
xor eax, eax
push eax
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4199a0
cmp esi, 0x24
jne 0x419980
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x300]
push eax
call fcn.00419630
xor eax, eax
mov word [ebp - 0x2fa], ax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 8]
push eax
push 0x419815
push 2
push 3
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x300]
call fcn.0040e018
inc edi
cmp edi, 4
jb 0x419946
cmp dword [ebp - 4], 0
jne 0x419a10
push 0x4a
lea esi, [ebp - 0xb0]
pop eax
call fcn.004066cb
push 0x4c
lea esi, [ebp - 0x3c]
pop eax
call fcn.004066cb
push ebx
mov eax, esi
push eax
lea eax, [ebp - 0xb0]
push eax
lea edi, [ebp - 0x300]
mov eax, 0x80000001
call fcn.0040c992
cmp eax, 0xffffffff
je 0x419a0c
test eax, eax
je 0x419a0c
push ebx
lea eax, [ebp - 0x508]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.00419630
cmp dword [ebp - 4], 0
jbe 0x419a1f
mov edi, dword [ebp - 8]
push 0x50
pop eax
call fcn.00418fa7
jmp 0x419a27
push dword [ebp - 8]
call fcn.0040871d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419c8d
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.004087d0
push 0x57
lea esi, [ebp - 0x74]
pop eax
call fcn.004066cb
push 0x58
lea esi, [ebp - 0x28]
pop eax
call fcn.004066cb
mov esi, 0x104
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
lea edi, [ebp - 0x280]
mov eax, 0x80000001
call fcn.0040c992
cmp eax, 0xffffffff
je 0x419d05
cmp eax, ebx
jbe 0x419d05
push esi
lea eax, [ebp - 0x488]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x488]
push eax
call fcn.00419a2c
cmp dword [ebp - 4], ebx
jne 0x419d70
push 0x59
lea esi, [ebp - 0x40]
pop eax
call fcn.004066cb
mov eax, esi
mov dword [ebp - 0x18], 0x1a
mov dword [ebp - 0x14], 0x26
mov dword [ebp - 0x10], 0x23
mov dword [ebp - 0xc], eax
xor esi, esi
lea eax, [ebp - 0x280]
push eax
push ebx
push ebx
push dword [ebp + esi*4 - 0x18]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x419d67
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push 0x419a64
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x280]
call fcn.0040e018
inc esi
cmp esi, 3
jb 0x419d31
cmp dword [ebp - 4], ebx
jbe 0x419d7f
mov edi, dword [ebp - 8]
push 0x5a
pop eax
call fcn.00418fa7
jmp 0x419d87
push dword [ebp - 8]
call fcn.0040871d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41a025
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
push edi
push 0x61
lea esi, [ebp - 0x30]
pop eax
call fcn.004066cb
mov eax, esi
push 8
mov dword [ebp - 0xc], eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x23
call fcn.004087d0
xor edi, edi
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push dword [ebp + edi*4 - 0x18]
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x41a09b
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push 0x419d8c
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x238]
call fcn.0040e018
inc edi
cmp edi, 3
jb 0x41a065
cmp dword [ebp - 4], esi
jbe 0x41a0b3
mov edi, dword [ebp - 8]
push 0x62
pop eax
call fcn.00418fa7
jmp 0x41a0bb
push dword [ebp - 8]
call fcn.0040871d
pop edi
pop esi
leave
ret

Function at 0x41a0bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
push edi
lea eax, [ebp - 0x100]
push eax
call fcn.00408759
mov cl, byte [ebp - 0xff]
xor cl, byte [ebp - 0x100]
mov dl, byte [ebp - 0xfe]
xor eax, eax
or cl, 0x50
mov byte [ebp - 2], al
cmp dl, al
je 0x41a111
push esi
lea esi, [ebp - 0xfe]
xor dl, cl
movzx edx, dl
mov word [edi + eax*2], dx
inc eax
inc esi
mov dl, byte [esi]
test dl, dl
jne 0x41a0ff
pop esi
xor ecx, ecx
mov word [edi + eax*2], cx
leave
ret
Function at 0x41a38f
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
mov ecx, edi
call fcn.00409268
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x41a441
lea ecx, [ebp - 0x100]
mov eax, edi
call fcn.00408f57
test al, al
je 0x41a441
xor eax, eax
test esi, esi
jle 0x41a3d8
xor byte [ebp + eax - 0x100], 0x5c
inc eax
cmp eax, esi
jl 0x41a3cb
mov bl, byte [ebp - 0x100]
cmp bl, 0xff
jne 0x41a3f1
mov bl, byte [ebp - 0xfe]
lea eax, [ebp - 0xfd]
jmp 0x41a3f7
lea eax, [ebp - 0xff]
movzx ecx, byte [eax]
lea ecx, [eax + ecx + 1]
movzx eax, bl
lea edx, [eax + ecx]
lea esi, [ebp + esi - 0x100]
cmp edx, esi
ja 0x41a441
cmp eax, dword [ebp + 8]
jl 0x41a441
cmp byte [ebp - 0x100], 0xff
jne 0x41a423
add ecx, dword [ebp + 8]
sub bl, byte [ebp + 8]
movzx eax, bl
xor edx, edx
test eax, eax
jle 0x41a439
movzx esi, byte [edx + ecx]
mov word [edi + edx*2], si
inc edx
cmp edx, eax
jl 0x41a42c
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x41a443
xor eax, eax
pop esi
pop ebx
leave
ret 4