joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413cc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x248
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x240], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x42]
push ecx
mov word [esp + 0x44], ax
call fcn.004f2770
add esp, 0xc
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x413d00
mov eax, dword [esi + 8]
add eax, 4
push eax
lea edx, [esp + 0x3c]
push 0x104
push edx
call fcn.004ee6af
add esp, 0xc
lea eax, [esp + 0x38]
push 0x5c
push eax
call fcn.004ef180
add esp, 8
test eax, eax
jne 0x413d61
cmp byte [esi + 0x11c], al
je 0x413d36
add esi, 0xc
jmp 0x413d39
mov esi, dword [esi + 8]
add esi, 4
push esi
push 0x5495b4
push edi
call fcn.004164e0
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004ecddb
add esp, 0x248
ret
xor ecx, ecx
lea edx, [esp + 8]
mov word [eax], cx
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.004eea16
add esp, 8
test eax, eax
je 0x413dd9
push 0
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x413db6
lea edx, [esp + 0x38]
push edx
push 0x5495c8
push edi
call fcn.004164e0
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004ecddb
add esp, 0x248
ret
push 0x10000000
lea eax, [esp + 0x3c]
push 1
push eax
call fcn.00423ee0
add esp, 0xc
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.00424280
add esp, 8
mov ecx, dword [esp + 0x244]
pop esi
xor ecx, esp
mov al, 1
call fcn.004ecddb
add esp, 0x248
ret
Function at 0x418ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x418bfb
test ebx, ebx
je 0x418ba7
cmp word [ebx], 0
je 0x418ba7
cmp byte [esi + 0x128], 0
je 0x418b39
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x418b40
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00416430
mov esi, eax
call fcn.004170f0
mov ecx, ebp
call fcn.00416430
mov esi, eax
push 0x549968
push 0x549858
mov edx, esi
call fcn.00417ed0
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x549858
mov edx, esi
call fcn.00417ed0
push 0x5463d8
push 0x549858
mov edx, esi
call fcn.00417ed0
push ebx
push 0x549858
mov edx, esi
call fcn.00417ed0
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x418bb6
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00416430
mov esi, eax
call fcn.004170f0
mov ecx, ebp
call fcn.00416430
mov esi, eax
push 0x549968
push 0x549858
mov edx, esi
call fcn.00417ed0
add ebx, 4
push ebx
push 0x549858
mov edx, esi
call fcn.00417ed0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x418cdc
test ebx, ebx
je 0x418c94
cmp word [ebx], 0
je 0x418c94
cmp byte [esi + 0x128], 0
je 0x418c29
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x418c30
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00416430
xor edi, edi
mov esi, eax
call fcn.004170f0
mov ecx, ebp
call fcn.00416430
mov esi, eax
push 0x549978
push 0x549858
mov edx, esi
call fcn.00417ed0
mov ecx, dword [esp + 0x28]
add ecx, 4
add esp, 8
push ecx
mov ecx, esi
call fcn.00417d40
mov esi, eax
push 0x5463d8
push 0x549858
mov edx, esi
call fcn.00417ed0
add esp, 8
push ebx
mov ecx, esi
call fcn.00417d40
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
je 0x418ca2
add esi, 0x18
jmp 0x418ca5
mov esi, dword [esi + 0x14]
mov ecx, ebp
call fcn.00416430
mov edi, eax
push 0x549978
push 0x549858
mov edx, edi
call fcn.00417ed0
add esi, 4
push esi
push 0x549858
mov edx, edi
call fcn.00417ed0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov al, 1
pop ebx
pop ecx
ret 0x10
Function at 0x418cf0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x418e0f
test ebx, ebx
je 0x418dbc
cmp word [ebx], 0
je 0x418dbc
cmp byte [esi + 0x128], 0
je 0x418d3e
add esi, 0x18
mov dword [esp + 0x1c], esi
jmp 0x418d45
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, ebp
call fcn.00416430
mov esi, eax
call fcn.004170f0
mov ecx, ebp
call fcn.00416430
mov esi, eax
push 0x549990
push 0x549858
mov edx, esi
call fcn.00417ed0
mov edx, dword [esp + 0x24]
add edx, 4
push edx
push 0x549858
mov edx, esi
call fcn.00417ed0
push 0x5499a8
push 0x549858
mov edx, esi
call fcn.00417ed0
push ebx
push 0x549858
mov edx, esi
call fcn.00417ed0
push 0x5499b0
push 0x549858
mov edx, esi
call fcn.00417ed0
add esp, 0x28
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x418dcb
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00416430
mov esi, eax
call fcn.004170f0
mov ecx, ebp
call fcn.00416430
mov esi, eax
push 0x549990
push 0x549858
mov edx, esi
call fcn.00417ed0
add ebx, 4
push ebx
push 0x549858
mov edx, esi
call fcn.00417ed0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc

Function at 0x418fa0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
mov ebx, ecx
mov ecx, 0x401
lea esi, [edi + 8]
mov dword [edi + 0x120], ecx
call fcn.00418590
cmp byte [esi + 0x114], 0
je 0x418fcd
add esi, 4
jmp 0x418fcf
mov esi, dword [esi]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 4]
push 0x3ff
add esi, 4
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
call fcn.00417b30
test esi, esi
je 0x419050
mov ecx, edi
call fcn.00417680
cmp byte [ebx + 0x128], 0
je 0x419007
add ebx, 0x18
jmp 0x41900a
mov ebx, dword [ebx + 0x14]
mov ecx, ebp
call fcn.00416430
mov edi, esi
mov esi, eax
call fcn.004170f0
mov ecx, ebp
call fcn.00416430
mov esi, eax
push 0x5499e8
push 0x549858
mov edx, esi
call fcn.00417ed0
add ebx, 4
push ebx
push 0x549858
mov edx, esi
call fcn.00417ed0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x41b180
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50d85b
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x33c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x13a]
push ecx
mov esi, edx
mov word [esp + 0x13c], ax
call fcn.004f2770
add esp, 0xc
lea edx, [esp + 0x130]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41b22d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00416430
mov esi, eax
push 0x54a750
push 0x549858
mov edx, esi
call fcn.00417ed0
push edi
push 0x549850
mov edx, esi
call fcn.00417ed0
add esp, 0x10
xor al, al
jmp 0x41b2db
lea eax, [esp + 0x130]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b237
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12e], 0x5c
jne 0x41b279
lea eax, [esp + 0x130]
lea edx, [eax + 2]
jmp 0x41b260
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b260
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x12e], cx
lea ecx, [esp + 0xc]
call fcn.004174b0
lea eax, [esp + 0x130]
lea edx, [esp + 0xc]
call fcn.00417710
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x41b2a4
mov eax, dword [esp + 0x14]
add eax, 4
lea edx, [edi + 0x130]
call fcn.00417710
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x41b2d9
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x41b2d9
push eax
call fcn.004ed7b6
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x33c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.004ecddb
add esp, 0x33c
ret
Function at 0x41bb50
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x4d4]
call fcn.00417710
cmp byte [esi + 0x5f0], 0
lea eax, [esi + 0x4e0]
jne 0x41bb7e
mov eax, dword [esi + 0x4dc]
add esi, 0x5f8
add eax, 4
mov edx, esi
call fcn.00417710
mov eax, esi
call fcn.00418450
pop edi
mov al, 1
pop esi
ret

Function at 0x41c880
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [esp + 0x430]
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x1e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x24], ax
call fcn.004f2770
add esp, 0xc
push 0x104
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x41c8e7
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004ecddb
add esp, 0x424
ret
push esi
push 0x206
lea ecx, [esp + 0x22a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x230], ax
call fcn.004f2770
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x41c947
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004ecddb
add esp, 0x424
ret
push edi
push esi
call fcn.004ed893
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x41c95e
xor al, al
jmp 0x41ca09
mov ecx, dword [esp + 0x1c]
push edi
push esi
push ecx
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41c9fe
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41c9fe
cmp dword [esp + 0x10], 4
jb 0x41c9fe
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
lea ecx, [esp + 0x230]
push str.StringFileInfo_04x_04xCompanyName
push ecx
call fcn.00411b10
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x230]
push ecx
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41c9fe
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jbe 0x41c9fe
mov eax, dword [esp + 0x18]
cmp word [eax + ecx*2 - 2], bx
jne 0x41c9f2
mov edx, ebp
call fcn.00417710
jmp 0x41c9fc
push eax
mov eax, ecx
mov ebx, ebp
call fcn.00417770
mov bl, 1
push edi
call fcn.004ed7b6
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ecddb
add esp, 0x424
ret
Function at 0x41e930
Capabilities:
Timestomp file

Disassembly:
push 0xffffffffffffffff
push 0x50e2f6
mov eax, dword fs:[0]
push eax
sub esp, 0x164
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x174]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x184]
mov edi, ecx
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x41e974
mov eax, dword [edi + 8]
push 0
push 0x80
push 3
push 0
push 7
push 0x100
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41e9b7
mov ecx, ebp
call fcn.00416430
push 0x54abe4
push 0x549858
mov edx, eax
call fcn.00417ed0
add esp, 8
jmp 0x41ea8d
xor eax, eax
lea ecx, [esp + 0x188]
push ecx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x18], ax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov word [esp + 0x26], ax
call fcn.004f0725
mov eax, dword [esp + 0x44]
movzx edx, word [esp + 0x3c]
mov ecx, dword [esp + 0x40]
add eax, 0x76c
inc ecx
mov word [esp + 0x18], ax
movzx eax, word [esp + 0x48]
mov word [esp + 0x1a], cx
mov cx, word [esp + 0x38]
mov word [esp + 0x1e], dx
movzx edx, word [esp + 0x34]
add esp, 8
mov word [esp + 0x18], cx
mov word [esp + 0x14], ax
movzx eax, word [esp + 0x28]
lea ecx, [esp + 0x20]
mov word [esp + 0x1a], dx
push ecx
lea edx, [esp + 0x14]
push edx
mov word [esp + 0x24], ax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
test eax, eax
jne 0x41eb1c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [edi + 0x11c], 0
lea esi, [edi + 0xc]
jne 0x41ea9c
mov esi, dword [edi + 8]
lea ecx, [esp + 0x4c]
call fcn.004174b0
lea eax, [esi + 4]
lea edx, [esp + 0x4c]
call fcn.00417710
mov dword [esp + 0x17c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebp
mov edi, eax
call fcn.00416430
mov esi, eax
call fcn.004170f0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebp
call fcn.00416430
mov esi, eax
push 0x54abf4
lea eax, [esp + 0x50]
call fcn.004172c0
cmp byte [esp + 0x168], 0
mov dword [esp + 0x4c], vtable.t_str.0
jne 0x41eb18
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x58]
cmp eax, ecx
je 0x41eb18
push eax
call fcn.004ed7b6
add esp, 4
xor al, al
jmp 0x41eb24
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [esp + 0x174]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x170
ret 0xc
Function at 0x41f2b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50f817
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x254], eax
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41f303
mov eax, dword [esi + 8]
push 2
add eax, 4
push 0x54ac80
push eax
call fcn.004ed174
add esp, 0xc
test eax, eax
je 0x41f480
mov ecx, esi
call fcn.0041e510
test al, al
je 0x41f3ad
cmp byte [ebp + 0xc], 0
je 0x41f480
cmp byte [esi + 0x11c], 0
je 0x41f345
add esi, 0xc
jmp 0x41f348
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.004174b0
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.00417710
push 0x54ac88
mov ecx, edi
mov dword [esp + 0x274], 1
call fcn.00416430
mov esi, eax
lea eax, [esp + 0x14]
call fcn.004172c0
cmp byte [esp + 0x12c], 0
mov dword [esp + 0x10], vtable.t_str.0
jne 0x41f3a6
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x41f3a6
push eax
call fcn.004ed7b6
add esp, 4
xor al, al
jmp 0x41f482
lea ecx, [esp + 0x134]
call fcn.0041dc00
lea edx, [esp + 0x134]
push edx
mov ecx, esi
mov dword [esp + 0x274], 2
call fcn.0041fbf0
test al, al
je 0x41f3ea
push 0
push edi
lea ecx, [esp + 0x13c]
call fcn.0041f2b0
test al, al
je 0x41f456
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41f3f9
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41f466
cmp byte [esi + 0x11c], al
je 0x41f416
add esi, 0xc
jmp 0x41f419
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.004174b0
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.00417710
push 0x54aca4
mov ecx, edi
mov byte [esp + 0x274], 4
call fcn.004170c0
mov esi, eax
lea eax, [esp + 0x14]
call fcn.004172c0
lea ecx, [esp + 0x10]
call fcn.00417650
lea ecx, [esp + 0x134]
call fcn.00417650
xor al, al
jmp 0x41f482
mov eax, esi
call fcn.004209a0
mov eax, esi
call fcn.00420950
lea ecx, [esp + 0x134]
call fcn.00417650
mov al, 1
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.004ecddb
mov esp, ebp
pop ebp
ret 8
Function at 0x420e10
Capabilities:
Create thread

Disassembly:
call fcn.0041d570
cmp byte [eax + 0x96a], 0
je 0x420e6a
cmp byte [0x571bc5], 0
jne 0x420e6a
mov ecx, esi
call fcn.0041e510
test al, al
jne 0x420e3d
mov ecx, esi
call fcn.0041e4d0
test al, al
je 0x420e6a
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x420e4c
mov eax, dword [esi + 8]
mov ecx, dword [esp + 4]
push ecx
add eax, 4
push eax
call fcn.004207c0
push eax
push 0
push 0x4208f0
call fcn.004f0e46
add esp, 0x14
ret 4

Function at 0x420f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x10], ebx
cmp ax, word [edi]
je 0x42100b
jmp 0x420fa0
lea eax, [ebx + 1]
cmp eax, 0x201
jge 0x42101b
xor edx, edx
xor esi, esi
mov edi, edi
movzx ecx, word [edi]
xor eax, eax
cmp ax, cx
je 0x42101b
cmp cx, 0x61
jb 0x420fce
cmp cx, 0x7a
ja 0x420fce
movzx ecx, cx
sub ecx, 0x61
jmp 0x420fe0
cmp cx, 0x30
jb 0x42101b
cmp cx, 0x39
ja 0x42101b
movzx ecx, cx
sub ecx, 0x16
mov eax, ebx
and eax, 0x1f
shl edx, 5
xor eax, ecx
add eax, edx
inc esi
add edi, 2
cmp esi, 4
movzx edx, ax
jl 0x420fb0
inc dword [esp + 0x10]
mov word [ebp], dx
xor ecx, ecx
inc ebx
add ebp, 2
cmp cx, word [edi]
jne 0x420fa0
mov eax, dword [esp + 0x10]
pop edi
xor edx, edx
pop esi
mov word [ebp], dx
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x4213f0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x804
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x576a40
push esi
call fcn.004eea16
add esp, 8
test eax, eax
je 0x421436
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ecddb
add esp, 0x804
ret
mov eax, 0x4000
test word [0x576a46], ax
je 0x421556
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.00411b30
add esp, 8
push 0x5767f0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x421555
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ecx]
mov ecx, 0x546720
mov eax, 0x57681c
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4214b6
test dx, dx
je 0x4214b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4214b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x421490
xor eax, eax
jmp 0x4214bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42153d
mov ecx, 0x546724
mov eax, 0x57681c
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4214f6
test dx, dx
je 0x4214f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4214f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4214d0
xor eax, eax
jmp 0x4214fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42153d
push 0x57681c
push esi
push 0x54672c
lea edx, [esp + 0x18]
call fcn.00411b30
add esp, 0xc
test byte [0x5767f0], 0x10
je 0x42152e
lea edx, [esp + 0xc]
push edx
call fcn.004213f0
add esp, 4
jmp 0x42153d
push 4
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x5767f0
push edi
call ebp
test eax, eax
jne 0x421480
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004ecddb
add esp, 0x804
ret
Function at 0x421590
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x804
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x5767c0
push esi
call fcn.004eea16
add esp, 8
test eax, eax
je 0x4215d6
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ecddb
add esp, 0x804
ret
mov eax, 0x4000
test word [0x5767c6], ax
je 0x4216f8
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.00411b30
add esp, 8
push 0x576570
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4216da
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ecx]
mov ecx, 0x546720
mov eax, 0x57659c
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421656
test dx, dx
je 0x421652
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421656
add eax, 4
add ecx, 4
test dx, dx
jne 0x421630
xor eax, eax
jmp 0x42165b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4216c2
mov ecx, 0x546724
mov eax, 0x57659c
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421696
test dx, dx
je 0x421692
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421696
add eax, 4
add ecx, 4
test dx, dx
jne 0x421670
xor eax, eax
jmp 0x42169b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4216c2
push 0x57659c
push esi
push 0x54672c
lea edx, [esp + 0x18]
call fcn.00411b30
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00421590
add esp, 0x14
push 0x576570
push edi
call ebx
test eax, eax
jne 0x421620
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ecddb
add esp, 0x804
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004ecddb
add esp, 0x804
ret
Function at 0x4221b0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
push edi
xor bl, bl
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 8], eax
test eax, eax
jne 0x4221ee
pop edi
xor al, al
pop ebx
add esp, 0xc
ret
push esi
push eax
call fcn.004ed893
mov ecx, dword [esp + 0x10]
add esp, 4
mov esi, eax
push esi
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42224e
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x5463d8
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42224e
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 0xa]
mov ecx, dword [esp + 0x20]
mov word [ecx], dx
movzx edx, word [eax + 8]
mov word [ecx + 2], dx
movzx edx, word [eax + 0xe]
mov word [ecx + 4], dx
mov ax, word [eax + 0xc]
mov word [ecx + 6], ax
mov bl, 1
test esi, esi
je 0x42225b
push esi
call fcn.004ed7b6
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret

Function at 0x422270
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004f2770
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4222c9
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004ecddb
add esp, 0x214
ret
push 0x54b594
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004eef2d
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004221b0
add esp, 0x14
test al, al
je 0x4222b2
movzx eax, word [esp]
movzx ecx, word [esp + 2]
movzx edx, word [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x210]
xor eax, eax
mov word [esi + 0x14], ax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 2
mov al, 1
call fcn.004ecddb
add esp, 0x214
ret