joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412020
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x41214b
test ebx, ebx
je 0x4120f7
cmp word [ebx], 0
je 0x4120f7
cmp byte [esi + 0x128], 0
je 0x412089
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x412090
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
call fcn.004108a0
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
push 0x52a4d0
push 0x52a3bc
mov edx, esi
call fcn.004114a0
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x52a3bc
mov edx, esi
call fcn.004114a0
push 0x52a4b8
push 0x52a3bc
mov edx, esi
call fcn.004114a0
push ebx
push 0x52a3bc
mov edx, esi
call fcn.004114a0
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x412106
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
call fcn.004108a0
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
push 0x52a4d0
push 0x52a3bc
mov edx, esi
call fcn.004114a0
add ebx, 4
push ebx
push 0x52a3bc
mov edx, esi
call fcn.004114a0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x41222c
test ebx, ebx
je 0x4121e4
cmp word [ebx], 0
je 0x4121e4
cmp byte [esi + 0x128], 0
je 0x412179
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x412180
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.0040fa50
xor edi, edi
mov esi, eax
call fcn.004108a0
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
push 0x52a4e0
push 0x52a3bc
mov edx, esi
call fcn.004114a0
mov ecx, dword [esp + 0x28]
add ecx, 4
add esp, 8
push ecx
mov ecx, esi
call fcn.004109f0
mov esi, eax
push 0x52a4b8
push 0x52a3bc
mov edx, esi
call fcn.004114a0
add esp, 8
push ebx
mov ecx, esi
call fcn.004109f0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
je 0x4121f2
add esi, 0x18
jmp 0x4121f5
mov esi, dword [esi + 0x14]
mov ecx, ebp
call fcn.0040fa50
mov edi, eax
push 0x52a4e0
push 0x52a3bc
mov edx, edi
call fcn.004114a0
add esi, 4
push esi
push 0x52a3bc
mov edx, edi
call fcn.004114a0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov al, 1
pop ebx
pop ecx
ret 0x10
Function at 0x412240
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x41235f
test ebx, ebx
je 0x41230c
cmp word [ebx], 0
je 0x41230c
cmp byte [esi + 0x128], 0
je 0x41228e
add esi, 0x18
mov dword [esp + 0x1c], esi
jmp 0x412295
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
call fcn.004108a0
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
push 0x52a4f8
push 0x52a3bc
mov edx, esi
call fcn.004114a0
mov edx, dword [esp + 0x24]
add edx, 4
push edx
push 0x52a3bc
mov edx, esi
call fcn.004114a0
push 0x52a510
push 0x52a3bc
mov edx, esi
call fcn.004114a0
push ebx
push 0x52a3bc
mov edx, esi
call fcn.004114a0
push 0x52a518
push 0x52a3bc
mov edx, esi
call fcn.004114a0
add esp, 0x28
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x41231b
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
call fcn.004108a0
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
push 0x52a4f8
push 0x52a3bc
mov edx, esi
call fcn.004114a0
add ebx, 4
push ebx
push 0x52a3bc
mov edx, esi
call fcn.004114a0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc

Function at 0x4124f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
mov ebx, ecx
mov ecx, 0x401
lea esi, [edi + 8]
mov dword [edi + 0x120], ecx
call fcn.00411b60
cmp byte [esi + 0x114], 0
je 0x41251d
add esi, 4
jmp 0x41251f
mov esi, dword [esi]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 4]
push 0x3ff
add esi, 4
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
call fcn.004111b0
test esi, esi
je 0x4125a0
mov ecx, edi
call fcn.00410db0
cmp byte [ebx + 0x128], 0
je 0x412557
add ebx, 0x18
jmp 0x41255a
mov ebx, dword [ebx + 0x14]
mov ecx, ebp
call fcn.0040fa50
mov edi, esi
mov esi, eax
call fcn.004108a0
mov ecx, ebp
call fcn.0040fa50
mov esi, eax
push 0x52a550
push 0x52a3bc
mov edx, esi
call fcn.004114a0
add ebx, 4
push ebx
push 0x52a3bc
mov edx, esi
call fcn.004114a0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x4132b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f17cb
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x33c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x13a]
push ecx
mov esi, edx
mov word [esp + 0x13c], ax
call fcn.004d6770
add esp, 0xc
lea edx, [esp + 0x130]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41335d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.0040fa50
mov esi, eax
push 0x52b0e8
push 0x52a3bc
mov edx, esi
call fcn.004114a0
push edi
push 0x52a3b4
mov edx, esi
call fcn.004114a0
add esp, 0x10
xor al, al
jmp 0x41340b
lea eax, [esp + 0x130]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413367
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12e], 0x5c
jne 0x4133a9
lea eax, [esp + 0x130]
lea edx, [eax + 2]
jmp 0x413390
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413390
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x12e], cx
lea ecx, [esp + 0xc]
call fcn.00410c10
lea eax, [esp + 0x130]
lea edx, [esp + 0xc]
call fcn.00410e40
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x4133d4
mov eax, dword [esp + 0x14]
add eax, 4
lea edx, [edi + 0x130]
call fcn.00410e40
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x413409
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x413409
push eax
call fcn.004d1d15
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x33c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.004d158d
add esp, 0x33c
ret
Function at 0x413b40
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x4d4]
call fcn.00410e40
cmp byte [esi + 0x5f0], 0
lea eax, [esi + 0x4e0]
jne 0x413b6e
mov eax, dword [esi + 0x4dc]
add esi, 0x5f8
add eax, 4
mov edx, esi
call fcn.00410e40
mov eax, esi
call fcn.00411a20
pop edi
mov al, 1
pop esi
ret

Function at 0x414830
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [esp + 0x430]
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x1e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x24], ax
call fcn.004d6770
add esp, 0xc
push 0x104
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x414897
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004d158d
add esp, 0x424
ret
push esi
push 0x206
lea ecx, [esp + 0x22a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x230], ax
call fcn.004d6770
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x4148f7
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004d158d
add esp, 0x424
ret
push edi
push esi
call fcn.004d1df2
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x41490e
xor al, al
jmp 0x4149b9
mov ecx, dword [esp + 0x1c]
push edi
push esi
push ecx
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4149ae
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4149ae
cmp dword [esp + 0x10], 4
jb 0x4149ae
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
lea ecx, [esp + 0x230]
push str.StringFileInfo_04x_04xCompanyName
push ecx
call fcn.00415670
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x230]
push ecx
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4149ae
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jbe 0x4149ae
mov eax, dword [esp + 0x18]
cmp word [eax + ecx*2 - 2], bx
jne 0x4149a2
mov edx, ebp
call fcn.00410e40
jmp 0x4149ac
push eax
mov eax, ecx
mov ebx, ebp
call fcn.00410ea0
mov bl, 1
push edi
call fcn.004d1d15
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d158d
add esp, 0x424
ret
Function at 0x416960
Capabilities:
Timestomp file

Disassembly:
push 0xffffffffffffffff
push 0x4f2076
mov eax, dword fs:[0]
push eax
sub esp, 0x164
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x174]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x184]
mov edi, ecx
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x4169a4
mov eax, dword [edi + 8]
push 0
push 0x80
push 3
push 0
push 7
push 0x100
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4169e7
mov ecx, ebp
call fcn.0040fa50
push 0x52b5a0
push 0x52a3bc
mov edx, eax
call fcn.004114a0
add esp, 8
jmp 0x416abd
xor eax, eax
lea ecx, [esp + 0x188]
push ecx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x18], ax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov word [esp + 0x26], ax
call fcn.004d4ee0
mov eax, dword [esp + 0x44]
movzx edx, word [esp + 0x3c]
mov ecx, dword [esp + 0x40]
add eax, 0x76c
inc ecx
mov word [esp + 0x18], ax
movzx eax, word [esp + 0x48]
mov word [esp + 0x1a], cx
mov cx, word [esp + 0x38]
mov word [esp + 0x1e], dx
movzx edx, word [esp + 0x34]
add esp, 8
mov word [esp + 0x18], cx
mov word [esp + 0x14], ax
movzx eax, word [esp + 0x28]
lea ecx, [esp + 0x20]
mov word [esp + 0x1a], dx
push ecx
lea edx, [esp + 0x14]
push edx
mov word [esp + 0x24], ax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
test eax, eax
jne 0x416b4d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [edi + 0x11c], 0
lea esi, [edi + 0xc]
jne 0x416acc
mov esi, dword [edi + 8]
lea ecx, [esp + 0x4c]
call fcn.00410c10
lea eax, [esi + 4]
lea edx, [esp + 0x4c]
call fcn.00410e40
mov dword [esp + 0x17c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebp
mov edi, eax
call fcn.0040fa50
mov esi, eax
call fcn.004108a0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebp
call fcn.0040fa50
lea ecx, [esp + 0x4c]
push ecx
push 0x52b5b0
mov ecx, eax
call fcn.00410a10
cmp byte [esp + 0x168], 0
mov dword [esp + 0x4c], vtable.t_str.0
jne 0x416b49
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x58]
cmp eax, edx
je 0x416b49
push eax
call fcn.004d1d15
add esp, 4
xor al, al
jmp 0x416b55
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [esp + 0x174]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x170
ret 0xc
Function at 0x417180
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f31d7
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push esi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4171d3
mov eax, dword [esi + 8]
push 2
add eax, 4
push 0x52b60c
push eax
call fcn.004d1926
add esp, 0xc
test eax, eax
je 0x417350
mov ecx, esi
call fcn.00416540
test al, al
je 0x41727e
cmp byte [ebp + 0xc], 0
je 0x417350
cmp byte [esi + 0x11c], 0
je 0x417215
add esi, 0xc
jmp 0x417218
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.00410c10
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.00410e40
lea eax, [esp + 0x10]
push eax
push 0x52b614
mov ecx, ebx
mov dword [esp + 0x278], 1
call fcn.0040fa50
mov ecx, eax
call fcn.00410a10
cmp byte [esp + 0x12c], 0
mov dword [esp + 0x10], vtable.t_str.0
jne 0x417277
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x417277
push eax
call fcn.004d1d15
add esp, 4
xor al, al
jmp 0x417352
lea ecx, [esp + 0x134]
call fcn.00415be0
lea edx, [esp + 0x134]
push edx
mov ecx, esi
mov dword [esp + 0x274], 2
call fcn.00417ac0
test al, al
je 0x4172bb
push 0
push ebx
lea ecx, [esp + 0x13c]
call fcn.00417180
test al, al
je 0x417326
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4172ca
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x417336
cmp byte [esi + 0x11c], al
je 0x4172e7
add esi, 0xc
jmp 0x4172ea
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.00410c10
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.00410e40
lea eax, [esp + 0x10]
push eax
push 0x52b630
mov byte [esp + 0x278], 4
call fcn.00410870
mov ecx, eax
call fcn.00410a10
lea ecx, [esp + 0x10]
call fcn.004161d0
lea ecx, [esp + 0x134]
call fcn.004161d0
xor al, al
jmp 0x417352
mov eax, esi
call fcn.004186c0
mov eax, esi
call fcn.00418670
lea ecx, [esp + 0x134]
call fcn.004161d0
mov al, 1
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.004d158d
mov esp, ebp
pop ebp
ret 8
Function at 0x419020
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x478
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x474], eax
mov eax, dword [esp + 0x47c]
push esi
push edi
push 0x52bd68
push eax
lea eax, [esp + 0x14]
push eax
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.004d55ad
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x41907b
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x474]
xor ecx, esp
call fcn.004d158d
add esp, 0x478
ret
push eax
push 0x400
lea ecx, [esp + 0x80]
push 1
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
call fcn.004d58a0
add esp, 0x10
test eax, eax
je 0x4190f5
lea edx, [esp + 0x78]
push edx
lea esi, [esp + 0x14]
call fcn.0041cb80
mov eax, dword [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x84]
push 1
push ecx
call fcn.004d58a0
add esp, 0x14
test eax, eax
jne 0x4190c7
lea eax, [esp + 0x10]
call fcn.0041cc90
mov edx, dword [esp + 0xc]
push edx
call fcn.004d5934
mov ecx, dword [esp + 0x480]
add esp, 4
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.004d158d
add esp, 0x478
ret

Function at 0x419150
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.0041df20

Function at 0x419250
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 4]
push ebx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00419300
mov byte [esp + 0xb], al
mov eax, dword [esp + 0x70]
add esp, 4
lea ebx, [esp + 8]
call fcn.0041d770
mov al, byte [esp + 7]
pop ebx
add esp, 0x64
ret

Function at 0x4192b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret
Function at 0x4197a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x10], ebx
cmp ax, word [edi]
je 0x41982b
jmp 0x4197c0
lea eax, [ebx + 1]
cmp eax, 0x201
jge 0x41983b
xor edx, edx
xor esi, esi
mov edi, edi
movzx ecx, word [edi]
xor eax, eax
cmp ax, cx
je 0x41983b
cmp cx, 0x61
jb 0x4197ee
cmp cx, 0x7a
ja 0x4197ee
movzx ecx, cx
sub ecx, 0x61
jmp 0x419800
cmp cx, 0x30
jb 0x41983b
cmp cx, 0x39
ja 0x41983b
movzx ecx, cx
sub ecx, 0x16
mov eax, ebx
and eax, 0x1f
shl edx, 5
xor eax, ecx
add eax, edx
inc esi
add edi, 2
cmp esi, 4
movzx edx, ax
jl 0x4197d0
inc dword [esp + 0x10]
mov word [ebp], dx
xor ecx, ecx
inc ebx
add ebp, 2
cmp cx, word [edi]
jne 0x4197c0
mov eax, dword [esp + 0x10]
pop edi
xor edx, edx
pop esi
mov word [ebp], dx
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret

Function at 0x419850
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x804
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x551f40
push esi
call fcn.004d35bd
add esp, 8
test eax, eax
je 0x419896
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004d158d
add esp, 0x804
ret
mov eax, 0x4000
test word [0x551f46], ax
je 0x4199b6
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.0041a760
add esp, 8
push 0x551cf0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4199b5
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ecx]
mov ecx, 0x52a134
mov eax, 0x551d1c
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x419916
test dx, dx
je 0x419912
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x419916
add eax, 4
add ecx, 4
test dx, dx
jne 0x4198f0
xor eax, eax
jmp 0x41991b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41999d
mov ecx, 0x52bd0c
mov eax, 0x551d1c
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x419956
test dx, dx
je 0x419952
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x419956
add eax, 4
add ecx, 4
test dx, dx
jne 0x419930
xor eax, eax
jmp 0x41995b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41999d
push 0x551d1c
push esi
push 0x52be34
lea edx, [esp + 0x18]
call fcn.0041a760
add esp, 0xc
test byte [0x551cf0], 0x10
je 0x41998e
lea edx, [esp + 0xc]
push edx
call fcn.00419850
add esp, 4
jmp 0x41999d
push 4
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x551cf0
push edi
call ebp
test eax, eax
jne 0x4198e0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004d158d
add esp, 0x804
ret
Function at 0x4199f0
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x804
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x551cc0
push esi
call fcn.004d35bd
add esp, 8
test eax, eax
je 0x419a36
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004d158d
add esp, 0x804
ret
mov eax, 0x4000
test word [0x551cc6], ax
je 0x419b56
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.0041a760
add esp, 8
push 0x551a70
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x419b38
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ecx]
mov ecx, 0x52a134
mov eax, 0x551a9c
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x419ab6
test dx, dx
je 0x419ab2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x419ab6
add eax, 4
add ecx, 4
test dx, dx
jne 0x419a90
xor eax, eax
jmp 0x419abb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x419b20
mov ecx, 0x52bd0c
mov eax, 0x551a9c
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x419af6
test dx, dx
je 0x419af2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x419af6
add eax, 4
add ecx, 4
test dx, dx
jne 0x419ad0
xor eax, eax
jmp 0x419afb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x419b20
push 0x551a9c
push esi
push 0x52be34
lea edx, [esp + 0x18]
call fcn.0041a760
lea edx, [esp + 0x18]
push edx
call fcn.004199f0
add esp, 0x10
push 0x551a70
push edi
call ebx
test eax, eax
jne 0x419a80
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004d158d
add esp, 0x804
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004d158d
add esp, 0x804
ret