joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c120
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x4d4]
call fcn.00411710
cmp byte [esi + 0x5f0], 0
lea eax, [esi + 0x4e0]
jne 0x40c14e
mov eax, dword [esi + 0x4dc]
add esi, 0x5f8
add eax, 4
mov edx, esi
call fcn.00411710
mov eax, esi
call fcn.00412400
pop edi
mov al, 1
pop esi
ret

Function at 0x40ce50
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [esp + 0x430]
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x1e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x24], ax
call fcn.004ff6c0
add esp, 0xc
push 0x104
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40ceb7
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004fa259
add esp, 0x424
ret
push esi
push 0x206
lea ecx, [esp + 0x22a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x230], ax
call fcn.004ff6c0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x40cf17
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004fa259
add esp, 0x424
ret
push edi
push esi
call fcn.004faba2
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x40cf2e
xor al, al
jmp 0x40cfd8
mov ecx, dword [esp + 0x1c]
push edi
push esi
push ecx
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40cfcd
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40cfcd
cmp dword [esp + 0x10], 4
jb 0x40cfcd
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
push str.StringFileInfo_04x_04xCompanyName
lea edx, [esp + 0x234]
call fcn.0040dc80
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x230]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40cfcd
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jbe 0x40cfcd
mov eax, dword [esp + 0x18]
cmp word [eax + ecx*2 - 2], bx
jne 0x40cfc1
mov edx, ebp
call fcn.00411710
jmp 0x40cfcb
push eax
mov eax, ecx
mov ebx, ebp
call fcn.00411770
mov bl, 1
push edi
call fcn.004faac5
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fa259
add esp, 0x424
ret
Function at 0x40f690
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x523e57
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push esi
mov eax, dword [0x581500]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x40f6e3
mov eax, dword [esi + 8]
push 2
add eax, 4
push 0x55d418
push eax
call fcn.004fb74d
add esp, 0xc
test eax, eax
je 0x40f85e
mov ecx, esi
call fcn.0040eb00
test al, al
je 0x40f78d
cmp byte [ebp + 0xc], 0
je 0x40f85e
cmp byte [esi + 0x11c], 0
je 0x40f725
add esi, 0xc
jmp 0x40f728
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.004114e0
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.00411710
push 0x55d420
mov ecx, ebx
mov dword [esp + 0x274], 1
call fcn.00409990
mov esi, eax
lea eax, [esp + 0x14]
call fcn.0040a800
cmp byte [esp + 0x12c], 0
mov dword [esp + 0x10], vtable.t_str.0
jne 0x40f786
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x40f786
push eax
call fcn.004faac5
add esp, 4
xor al, al
jmp 0x40f860
lea ecx, [esp + 0x134]
call fcn.0040e1f0
lea edx, [esp + 0x134]
push edx
mov ecx, esi
mov dword [esp + 0x274], 2
call fcn.0040ffd0
test al, al
je 0x40f7ca
push 0
push ebx
lea ecx, [esp + 0x13c]
call fcn.0040f690
test al, al
je 0x40f834
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x40f7d9
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40f844
cmp byte [esi + 0x11c], al
je 0x40f7f6
add esi, 0xc
jmp 0x40f7f9
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.004114e0
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.00411710
push 0x55d43c
mov byte [esp + 0x274], 4
call fcn.0040a620
mov esi, eax
lea eax, [esp + 0x14]
call fcn.0040a800
lea ecx, [esp + 0x10]
call fcn.00411680
lea ecx, [esp + 0x134]
call fcn.00411680
xor al, al
jmp 0x40f860
mov eax, esi
call fcn.00411000
mov eax, esi
call fcn.00410fb0
lea ecx, [esp + 0x134]
call fcn.00411680
mov al, 1
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.004fa259
mov esp, ebp
pop ebp
ret 8
Function at 0x410f60
Capabilities:
Create thread

Disassembly:
call fcn.0040db40
cmp byte [eax + 0x96a], 0
je 0x410fa9
cmp byte [0x58e9a4], 0
jne 0x410fa9
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x410f86
mov eax, dword [esi + 8]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ecx
push edx
add eax, 4
push eax
call fcn.00410ce0
push eax
push 0
push 0x410dc0
call fcn.004fbdaa
add esp, 0x18
ret 8

Function at 0x410f9a
Capabilities:
Create thread

Disassembly:
call fcn.0040db40
cmp byte [eax + 0x96a], 0
je 0x410fa9
cmp byte [0x58e9a4], 0
jne 0x410fa9
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x410f86
mov eax, dword [esi + 8]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ecx
push edx
add eax, 4
push eax
call fcn.00410ce0
push eax
push 0
push 0x410dc0
call fcn.004fbdaa
add esp, 0x18
ret 8

Function at 0x411470
Capabilities:
Create thread

Disassembly:
call fcn.0040db40
cmp byte [eax + 0x96a], 0
je 0x4114d4
cmp byte [0x58e9a4], 0
jne 0x4114d4
mov ecx, esi
call fcn.0040eb00
test al, al
jne 0x41149d
mov ecx, esi
call fcn.0040eac0
test al, al
je 0x4114d4
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4114ac
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push ecx
add eax, 4
push eax
call fcn.00410bb0
push eax
push 0
push 0x410f00
call fcn.004fbdaa
add esp, 0x1c
ret 0xc
Function at 0x412cc0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x525c6b
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x581500]
xor eax, esp
push eax
lea eax, [esp + 0x378]
mov dword fs:[0], eax
mov eax, dword [esp + 0x388]
mov ebp, dword [esp + 0x38c]
mov ebx, ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
xor edi, edi
cmp eax, edi
je 0x412d2a
push eax
call fcn.004faac5
add esp, 4
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
lea esi, [esp + 0x1c]
call fcn.00417b60
mov esi, vtable.t_fileRead.0
mov dword [esp + 0x1c], esi
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x36c], edi
mov dword [esp + 0x370], edi
mov ecx, dword [esp + 0x14]
push ebp
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x388], edi
call fcn.00418390
test al, al
jne 0x412d99
mov dword [esp + 0x380], 0xffffffff
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x1c]
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00417bd0
xor al, al
jmp 0x412f03
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x412dc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x412dc0
xor esi, esi
lea ecx, [esi + 4]
push ecx
call fcn.004faba2
mov edi, eax
add esp, 4
test edi, edi
jne 0x412e29
cmp byte [ebp + 0x11c], al
je 0x412ddf
add ebp, 0xc
jmp 0x412de2
mov ebp, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
call fcn.00409990
push 0x55de30
mov esi, eax
push 0x55d15c
mov edx, esi
call fcn.00411e80
add ebp, 4
push ebp
push 0x55d15c
mov edx, esi
call fcn.00411e80
mov dword [esp + 0x390], 0xffffffff
add esp, 0x10
mov dword [esp + 0x1c], vtable.t_fileRead.0
jmp 0x412d7e
mov edx, dword [esp + 0x14]
push esi
push edi
push edx
lea ecx, [esp + 0x374]
call fcn.004183f0
test al, al
jne 0x412e6e
cmp byte [ebp + 0x11c], al
je 0x412e5b
mov ecx, dword [esp + 0x14]
add ebp, 0xc
call fcn.00409990
push 0x55de5c
jmp 0x412df0
mov ecx, dword [esp + 0x14]
mov ebp, dword [ebp + 8]
call fcn.00409990
push 0x55de5c
jmp 0x412df0
lea ecx, [esp + 0x1c]
call fcn.00417eb0
push 0x3a8
xor eax, eax
xor ecx, ecx
push esi
mov word [edi + esi + 2], ax
mov word [edi + esi], cx
mov esi, dword [esp + 0x1c]
push esi
push ebx
mov ebx, edi
call fcn.00413090
test al, al
jne 0x412eda
cmp byte [ebp + 0x11c], al
je 0x412ea8
add ebp, 0xc
jmp 0x412eab
mov ebp, dword [ebp + 8]
add ebp, 4
push ebp
push 0x55de5c
mov ecx, esi
call fcn.00402ea0
mov ecx, eax
call fcn.00411ca0
mov dword [esp + 0x380], 0xffffffff
mov dword [esp + 0x1c], vtable.t_fileRead.0
jmp 0x412d7e
mov dword [esp + 0x380], 0xffffffff
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00417bd0
mov al, 1
mov ecx, dword [esp + 0x378]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x360]
xor ecx, esp
call fcn.004fa259
add esp, 0x370
ret 8
Function at 0x4139a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x523cd3
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x581500]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fld dword [0x56ca28]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0x11
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
fstp dword [esi + 0xc]
fld dword [0x56ca24]
mov ecx, esi
fstp dword [esi + 0x10]
fld dword [0x56ca20]
fstp dword [esi + 0x14]
call fcn.00409370
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x415010
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.00419730

Function at 0x415110
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 4]
push ebx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004151c0
mov byte [esp + 0xb], al
mov eax, dword [esp + 0x70]
add esp, 4
lea ebx, [esp + 8]
call fcn.00418f80
mov al, byte [esp + 7]
pop ebx
add esp, 0x64
ret

Function at 0x415170
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0x415f10
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x804
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x593358
push esi
call fcn.004fc6e4
add esp, 8
test eax, eax
je 0x415f56
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004fa259
add esp, 0x804
ret
mov eax, 0x4000
test word [0x59335e], ax
je 0x416076
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.00417500
add esp, 8
push 0x593108
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x416075
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ecx]
mov ecx, 0x559500
mov eax, 0x593134
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415fd6
test dx, dx
je 0x415fd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415fd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x415fb0
xor eax, eax
jmp 0x415fdb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41605d
mov ecx, 0x55db1c
mov eax, 0x593134
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416016
test dx, dx
je 0x416012
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416016
add eax, 4
add ecx, 4
test dx, dx
jne 0x415ff0
xor eax, eax
jmp 0x41601b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41605d
push 0x593134
push esi
push 0x55e26c
lea edx, [esp + 0x18]
call fcn.00417500
add esp, 0xc
test byte [0x593108], 0x10
je 0x41604e
lea edx, [esp + 0xc]
push edx
call fcn.00415f10
add esp, 4
jmp 0x41605d
push 4
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x593108
push edi
call ebp
test eax, eax
jne 0x415fa0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004fa259
add esp, 0x804
ret
Function at 0x4160b0
Capabilities:
Delete file

Disassembly:
sub esp, 0x804
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x5930d8
push esi
call fcn.004fc6e4
add esp, 8
test eax, eax
je 0x4160f6
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004fa259
add esp, 0x804
ret
mov eax, 0x4000
test word [0x5930de], ax
je 0x416218
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.00417500
add esp, 8
push 0x592e88
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4161fa
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ecx]
mov ecx, 0x559500
mov eax, 0x592eb4
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416176
test dx, dx
je 0x416172
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416176
add eax, 4
add ecx, 4
test dx, dx
jne 0x416150
xor eax, eax
jmp 0x41617b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4161e2
mov ecx, 0x55db1c
mov eax, 0x592eb4
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4161b6
test dx, dx
je 0x4161b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4161b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x416190
xor eax, eax
jmp 0x4161bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4161e2
push 0x592eb4
push esi
push 0x55e26c
lea edx, [esp + 0x18]
call fcn.00417500
lea edx, [esp + 0x18]
push 1
push edx
call fcn.004160b0
add esp, 0x14
push 0x592e88
push edi
call ebx
test eax, eax
jne 0x416140
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004fa259
add esp, 0x804
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004fa259
add esp, 0x804
ret
Function at 0x416c30
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
push edi
xor bl, bl
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 8], eax
test eax, eax
jne 0x416c6e
pop edi
xor al, al
pop ebx
add esp, 0xc
ret
push esi
push eax
call fcn.004faba2
mov ecx, dword [esp + 0x10]
add esp, 4
mov esi, eax
push esi
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x416cce
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x55d368
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x416cce
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 0xa]
mov ecx, dword [esp + 0x20]
mov word [ecx], dx
movzx edx, word [eax + 8]
mov word [ecx + 2], dx
movzx edx, word [eax + 0xe]
mov word [ecx + 4], dx
mov ax, word [eax + 0xc]
mov word [ecx + 6], ax
mov bl, 1
test esi, esi
je 0x416cdb
push esi
call fcn.004faac5
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret

Function at 0x416cf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004ff6c0
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x416d49
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004fa259
add esp, 0x214
ret
push 0x55e3c4
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004fb6d0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00416c30
add esp, 0x14
test al, al
je 0x416d32
movzx eax, word [esp]
movzx ecx, word [esp + 2]
movzx edx, word [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x210]
xor eax, eax
mov word [esi + 0x14], ax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 2
mov al, 1
call fcn.004fa259
add esp, 0x214
ret
Function at 0x417860
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x24]
push ecx
push 0
push ebp
push edx
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x417983
test ebp, ebp
je 0x417930
cmp word [ebp], 0
je 0x417930
cmp byte [esi + 0x128], 0
je 0x4178c3
add esi, 0x18
mov dword [esp + 0x18], esi
jmp 0x4178ca
mov eax, dword [esi + 0x14]
mov dword [esp + 0x18], eax
mov ecx, ebx
call fcn.00409990
mov esi, eax
call fcn.0040a650
mov ecx, ebx
call fcn.00409990
mov esi, eax
push 0x55e550
push 0x55d15c
mov edx, esi
call fcn.00411e80
mov ecx, dword [esp + 0x20]
add ecx, 4
push ecx
push 0x55d15c
mov edx, esi
call fcn.00411e80
push 0x55d368
push 0x55d15c
mov edx, esi
call fcn.00411e80
push ebp
push 0x55d15c
mov edx, esi
call fcn.00411e80
add esp, 0x20
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
cmp byte [esi + 0x128], 0
lea ebp, [esi + 0x18]
jne 0x41793f
mov ebp, dword [esi + 0x14]
mov ecx, ebx
call fcn.00409990
mov esi, eax
call fcn.0040a650
mov ecx, ebx
call fcn.00409990
mov esi, eax
push 0x55e550
push 0x55d15c
mov edx, esi
call fcn.00411e80
add ebp, 4
push ebp
push 0x55d15c
mov edx, esi
call fcn.00411e80
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
mov eax, 1
cmp dword [esp + 0x1c], eax
je 0x417a64
test ebp, ebp
je 0x417a1d
cmp word [ebp], 0
je 0x417a1d
cmp byte [esi + 0x128], 0
je 0x4179b3
add esi, 0x18
mov dword [esp + 0x18], esi
jmp 0x4179ba
mov edx, dword [esi + 0x14]
mov dword [esp + 0x18], edx
mov ecx, ebx
call fcn.00409990
xor edi, edi
mov esi, eax
call fcn.0040a650
mov ecx, ebx
call fcn.00409990
mov esi, eax
push 0x55e560
push 0x55d15c
mov edx, esi
call fcn.00411e80
mov eax, dword [esp + 0x20]
add esp, 8
add eax, 4
push eax
mov ecx, esi
call fcn.00411ca0
mov esi, eax
push 0x55d368
push 0x55d15c
mov edx, esi
call fcn.00411e80
add esp, 8
push ebp
mov ecx, esi
call fcn.00411ca0
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
cmp byte [esi + 0x128], 0
je 0x417a2b
add esi, 0x18
jmp 0x417a2e
mov esi, dword [esi + 0x14]
mov ecx, ebx
call fcn.00409990
mov edi, eax
push 0x55e560
push 0x55d15c
mov edx, edi
call fcn.00411e80
add esi, 4
push esi
push 0x55d15c
mov edx, edi
call fcn.00411e80
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
pop edi
pop esi
mov dword [edx], ecx
pop ebp
pop ecx
ret 0xc
Function at 0x417c90
Capabilities:
Set file attributes

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov esi, eax
mov eax, dword [edi + 0x130]
mov edx, dword [eax + 0x18]
lea ebx, [edi + 0x130]
push esi
push ebp
mov ecx, ebx
call edx
test al, al
jne 0x417cdf
mov ecx, ebp
call fcn.00409990
push 0x55d390
push 0x55d15c
mov edx, eax
call fcn.00411e80
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
push ebx
push ebp
lea ecx, [edi + 0x344]
call fcn.00412830
test al, al
je 0x417cb8
mov ebx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ebp
mov dword [edi + 8], ebx
call fcn.00417ab0
add esp, 0xc
test al, al
jne 0x417d6b
cmp byte [esi + 0x11c], al
je 0x417d2f
add esi, 0xc
jmp 0x417d32
mov esi, dword [esi + 8]
mov ecx, ebp
call fcn.00409990
mov edi, eax
push 0x55de5c
push 0x55d15c
mov edx, edi
call fcn.00411e80
add esi, 4
push esi
push 0x55d15c
mov edx, edi
call fcn.00411e80
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0x80
push ebp
push 0
push eax
push ecx
mov ecx, esi
call fcn.00411da0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 4], eax
mov ebx, 1
cmp eax, 0xffffffff
jne 0x417e0e
mov edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
cmp eax, 0x20
jne 0x417dc2
cmp ebx, 3
jge 0x417e5c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417de3
cmp eax, 5
jne 0x417e23
cmp ebx, 3
jge 0x417e5c
push 0x80
mov ecx, esi
call fcn.00411da0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0x80
push ebp
push 0
push edx
push eax
mov ecx, esi
call fcn.00411da0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
inc ebx
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x417da0
push esi
lea ecx, [edi + 0xc]
call fcn.0040e940
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 8
test eax, eax
jne 0x417e5c
cmp byte [esi + 0x11c], al
je 0x417e34
add esi, 0xc
jmp 0x417e37
mov esi, dword [esi + 8]
mov ecx, dword [esp + 0x20]
add esi, 4
push esi
push 0x55e594
call fcn.00402ea0
mov ecx, eax
call fcn.00411ca0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
cmp byte [esi + 0x11c], 0
lea ebx, [esi + 0xc]
jne 0x417e6b
mov ebx, dword [esi + 8]
mov ebp, dword [esp + 0x20]
mov ecx, ebp
call fcn.00409990
mov edi, dword [esp + 0x24]
mov esi, eax
call fcn.0040a650
mov ecx, ebp
call fcn.00409990
add ebx, 4
push ebx
push 0x55de5c
mov ecx, eax
call fcn.00411ca0
mov ecx, eax
call fcn.00411ca0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8