joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404bd0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 8], edi
je 0x404d25
push esi
mov esi, dword [ebp + 8]
push 0x12
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x404cfd
push str.Will_attempt_to_set_service_recovery_actions_n
call fcn.0040c2f0
mov edi, dword [ebp + 0x10]
lea eax, [edi*8 + 8]
push eax
call fcn.0042e047
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x404cd0
xor eax, eax
cmp edi, ebx
jbe 0x404c62
mov ecx, dword [ebp + 0x14]
imul ecx, ecx, 0x3e8
jmp 0x404c50
mov dword [esi + eax*8], 1
mov dword [esi + eax*8 + 4], ecx
add eax, 1
cmp eax, edi
jb 0x404c50
mov eax, dword [ebp + 0xc]
cmp eax, ebx
mov dword [esi + edi*8], ebx
mov dword [esi + edi*8 + 4], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
jne 0x404c7e
mov dword [ebp - 0x10], ebx
jmp 0x404c84
add edi, 1
mov dword [ebp - 0x10], edi
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
push ecx
push 2
push edx
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x404cb4
push str.Call_to_ChangeServiceConfig2_to_set_service_recovery_actions_was_successful_n
call fcn.0040c2f0
add esp, 4
push esi
mov byte [ebp - 1], 1
call fcn.0042df6a
jmp 0x404cda
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Call_to_ChangeServiceConfig2_to_set_service_recovery_actions_failed__d_n
call fcn.0040c2f0
add esp, 8
push esi
call fcn.0042df6a
jmp 0x404cda
push str.Failed_to_allocate_memory_for_service_recovery_actions_array_n
call fcn.0040c2f0
mov eax, dword [ebp + 8]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 1]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_open_service__S_to_change_config__u_n
call fcn.0040c2f0
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 1]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404d30
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov esi, eax
test esi, esi
je 0x404d78
push esi
push edi
push str.Unable_to_open_safe_boot_key__S:__u_n
call fcn.0040c2f0
push esi
push edi
push str.Unable_to_open_safe_boot_key__S:__u_n
call fcn.0042e111
add esp, 0x18
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push edi
push edx
call ebx
mov esi, eax
test esi, esi
je 0x404dc1
cmp esi, 2
je 0x404dac
push esi
push edi
push str.Unable_to_open_driver_key__S:__u_n
call fcn.0040c2f0
push esi
push edi
push str.Unable_to_open_driver_key__S:__u_n
call fcn.0042e111
add esp, 0x18
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00401000
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
test esi, esi
je 0x404ded
cmp esi, 0xffffffff
je 0x404ded
push 0
lea ecx, [ebp + 0xc]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call ebx
mov edx, dword [ebp - 4]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x404e0b
push eax
push str.Unable_to_delete_driver_value:__u_n
call fcn.0040c2f0
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x404e25
cmp esi, 0xffffffff
je 0x404e25
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00401000
mov esi, eax
test esi, esi
je 0x404e4b
cmp esi, 0xffffffff
je 0x404e4b
push 0
lea ecx, [ebp + 0xc]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call ebx
mov edx, dword [ebp + 8]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x404e68
push eax
push str.Unable_to_delete_driver_key:__u_n
call fcn.0040c2f0
add esp, 8
test esi, esi
je 0x404e78
cmp esi, 0xffffffff
je 0x404e78
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x404e90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
je 0x404ed6
push esi
push edi
push str.Unable_to_open_safe_boot_key__S:__u_n
call fcn.0040c2f0
push esi
push edi
push str.Unable_to_open_safe_boot_key__S:__u_n
call fcn.0042e111
add esp, 0x18
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.00401000
mov esi, eax
test esi, esi
je 0x404f00
cmp esi, 0xffffffff
je 0x404f00
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test edi, edi
je 0x404f40
push edi
push ebx
push str.Unable_to_create_safe_boot_key__S:__u_n
call fcn.0040c2f0
push edi
push ebx
push str.Unable_to_create_safe_boot_key__S:__u_n
call fcn.0042e111
mov ecx, dword [ebp + 8]
add esp, 0x18
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404f94
push str.Driver
call fcn.00420840
mov edx, dword [ebp - 4]
add esp, 4
add eax, eax
push eax
push str.Driver
push 1
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov edi, eax
test edi, edi
je 0x404faf
push edi
push str.Unable_to_set_safe_boot_value:__u_n
call fcn.0040c2f0
push edi
push str.Unable_to_set_safe_boot_value:__u_n
call fcn.0042e111
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
push eax
call edi
mov ecx, dword [ebp - 4]
push ecx
call edi
test esi, esi
je 0x404fa4
cmp esi, 0xffffffff
je 0x404fa4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
mov eax, dword [ebp - 4]
push eax
call edi
test esi, esi
je 0x404fd1
cmp esi, 0xffffffff
je 0x404fd1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x406e60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
push str.GetDriverDest__S_n
call fcn.0040c2f0
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add esp, 8
test esi, esi
je 0x406e99
test edi, edi
je 0x406e99
push edi
push esi
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov word [esi + edi*2 - 2], 0
push 0x43fcec
push edi
push esi
call fcn.00421b60
push ebx
push edi
push esi
call fcn.00421b60
add esp, 0x18
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406ec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push esi
push edi
mov eax, ebx
jne 0x406ed4
mov eax, 0x43f77c
push eax
push str.GetSystemDest__S_n
call fcn.0040c2f0
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add esp, 8
test esi, esi
je 0x406f04
test edi, edi
je 0x406f04
push edi
push esi
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov word [esi + edi*2 - 2], 0
push 0x43fd14
push edi
push esi
call fcn.00421b60
push ebx
push edi
push esi
call fcn.00421b60
add esp, 0x18
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x406f30
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test bl, bl
setne al
push esi
push 1
push 0
lea eax, [eax*4 + 0x26]
push eax
push 0
call edi
test eax, eax
je 0x406f94
test bl, bl
je 0x406f7e
push str.Failed_to_get_x86_program_files_location_n
call fcn.0040c2f0
add esp, 4
push esi
push 1
push 0
push 0x26
push 0
call edi
test eax, eax
je 0x406f94
push str.Failed_to_get_program_files_location_n
call fcn.0040c2f0
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x10
mov edi, dword [ebp + 0x14]
push 0x43fd14
push edi
push esi
call fcn.00421b60
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push esi
call fcn.00421b60
add esp, 0x18
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x10

Function at 0x406fc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test bl, bl
setne al
push esi
push 1
push 0
add eax, 0x2b
push eax
push 0
call edi
test eax, eax
je 0x407020
test bl, bl
je 0x40700a
push str.Failed_to_get_x86_common_program_files_location_n
call fcn.0040c2f0
add esp, 4
push esi
push 1
push 0
push 0x2b
push 0
call edi
test eax, eax
je 0x407020
push str.Failed_to_get_common_program_files_location_n
call fcn.0040c2f0
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0x10
mov edi, dword [ebp + 0x14]
push 0x43fd14
push edi
push esi
call fcn.00421b60
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push esi
call fcn.00421b60
add esp, 0x18
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0x10
Function at 0x407180
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push str.RemoveSystemCoreDest_here_n
call fcn.0040c2f0
push str.SoftwareMcAfee
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00422cc0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4071f8
push esi
call fcn.00401000
mov esi, eax
test esi, esi
je 0x4071d2
cmp esi, 0xffffffff
je 0x4071d2
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push str.SystemCore
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
call fcn.00422c60
add esp, 4
test esi, esi
je 0x4071f7
cmp esi, 0xffffffff
je 0x4071f7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x409190
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x451430]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push ebx
push str.SYSTEMCurrentControlSetServicesEventLogSystem_s
lea eax, [ebp - 0x25c]
push 0x12c
push eax
call fcn.00422b20
add esp, 0x10
push esi
lea ecx, [ebp - 0x25c]
push ecx
call fcn.00408d20
push 1
lea edx, [ebp - 0x25c]
push edx
call fcn.00407200
test eax, eax
jne 0x409283
push ebx
push str.RemoveServiceEventSource___removing_event_source_for__S_n
call fcn.0040c2f0
add esp, 8
call fcn.00401000
mov esi, eax
test esi, esi
je 0x409223
cmp esi, 0xffffffff
je 0x409223
push 0
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
push str.SYSTEMCurrentControlSetServicesEventLogSystem
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00422c80
mov edi, eax
add esp, 8
test edi, edi
je 0x409260
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x409255
push str.RemoveServiceEventSource:_RegDeleteKey_failed_n
call fcn.0040c2f0
add esp, 4
push edi
call fcn.00422c60
add esp, 4
jmp 0x409272
push str.SYSTEMCurrentControlSetServicesEventLogSystem
push str.Failed_to_open__S_n
call fcn.0040c2f0
add esp, 8
test esi, esi
pop edi
je 0x409283
cmp esi, 0xffffffff
je 0x409283
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0042d845
mov esp, ebp
pop ebp
ret 8
Function at 0x4171d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 1
push edi
mov dword [ebp - 4], ebx
call fcn.00402d40
mov esi, eax
test esi, esi
jne 0x417234
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x41722b
test byte [eax + 0x3c], bl
je 0x41722b
cmp byte [eax + 0x39], 2
jb 0x41722b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x44b008]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push edi
push 0x443bf4
push 0xa
push ecx
push edx
call fcn.00428340
mov eax, dword [0x44b008]
mov dword [ebp - 4], 0
jmp 0x4172a4
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push str.LockDownEnabled
push esi
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x417296
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x41728f
test byte [eax + 0x3c], bl
je 0x41728f
cmp byte [eax + 0x39], 2
jb 0x41728f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x44b008]
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push edi
push 0x443bf4
push 0xb
push edx
push eax
call fcn.00428340
mov dword [ebp - 4], 0
push esi
call fcn.00422c60
mov eax, dword [0x44b008]
add esp, 4
cmp eax, 0x44b008
je 0x4172cf
test byte [eax + 0x3c], bl
je 0x4172cf
cmp byte [eax + 0x39], 5
jb 0x4172cf
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push ecx
push edi
push 0x443bf4
push 0xc
push edx
push eax
call fcn.00428340
xor eax, eax
cmp dword [ebp - 4], eax
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4177f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call fcn.0040c210
mov esi, eax
test esi, esi
je 0x41782f
cmp esi, 0xffffffff
je 0x41782f
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
lea ecx, [ebp - 4]
push ecx
call fcn.00417160
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or eax, 3
push eax
push 0
push str.SOFTWAREMcAfeeSystemCoreVSCORE
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x4178a9
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.LockdownEnabled
push ecx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 8]
je 0x41789f
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.LockdownEnabled
push ecx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4178b9
cmp esi, 0xffffffff
je 0x4178b9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040c210
mov esi, eax
test esi, esi
je 0x4178e6
cmp esi, 0xffffffff
je 0x4178e6
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x4a
push 0x443ba8
push 0x9edba510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea ecx, [ebp - 4]
push ecx
call fcn.00417160
or eax, 3
push eax
push 0
push str.SOFTWAREMcAfeeVSCORE
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x417954
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.LockdownEnabled
mov edi, 4
push ecx
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 8]
je 0x41794a
mov ecx, dword [ebp - 4]
push edi
lea eax, [ebp + 8]
push eax
push edi
push 0
push str.LockdownEnabled
push ecx
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop edi
je 0x417965
cmp esi, 0xffffffff
je 0x417965
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418970
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 1
mov dword [ebx], edi
push ecx
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4189c3
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x4189cd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jmp 0x418a4b
push eax
call fcn.0042e047
add esp, 4
cmp eax, edi
mov dword [ebx], eax
jne 0x4189f1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0x80090300
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 8]
push edi
lea ecx, [ebp + 0xc]
push ecx
push edx
push eax
push esi
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
je 0x418a2d
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jne 0x418a2d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [edx], ecx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx]
push eax
call fcn.0042df6a
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x418a60
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x418a57
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x26
and eax, 0xffff
pop esi
or eax, 0x80070000
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x418a80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x451430]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x418ad2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x418aea
and eax, 0xffff
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d845
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x210]
push ecx
push str._sinf
call fcn.00422c00
add esp, 8
mov dword [esi], eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042d845
mov esp, ebp
pop ebp
ret 4
Function at 0x419dd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x451430]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
call fcn.004207d0
mov dword [0x452588], eax
xor esi, esi
lea eax, [ebp - 0x306]
push str.mfehidin
push eax
mov dword [ebp - 0x328], 0xfffffff
mov dword [ebp - 0x324], 0xdbba0
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], esi
mov dword [ebp - 0x318], esi
mov dword [ebp - 0x314], 1
mov dword [ebp - 0x310], esi
mov word [ebp - 0x308], 0x3778
call fcn.00420ba0
mov ecx, dword [0x452588]
push ecx
lea edx, [ebp - 0x206]
push edx
call fcn.00420ba0
add esp, 0x14
lea eax, [ebp - 0x106]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x106]
push 0x4445f0
push ecx
call fcn.00420c20
push esi
lea edx, [ebp - 0x328]
push edx
push 0x419d00
push 0x419b50
push 0x419b20
push 0x419ad0
push 0x419aa0
push 0x419a70
push 0x419a00
push 0x4199f0
push fcn.004199e0
push 0x419bd0
push 0x45257c
call fcn.0041a23b
add esp, 0x3c
cmp eax, esi
mov dword [0x452590], eax
je 0x419f0c
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x419ef9
test byte [eax + 0x3c], 2
je 0x419ef9
cmp byte [eax + 0x39], 5
jb 0x419ef9
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x4445dc
push 0x13
push ecx
push edx
call fcn.004170b0
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d845
mov esp, ebp
pop ebp
ret 4
cmp dword [0x452584], esi
je 0x419f4e
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x419f4e
test byte [eax + 0x3c], 2
je 0x419f4e
cmp byte [eax + 0x39], 5
jb 0x419f4e
mov ecx, dword [0x452580]
mov edx, dword [0x45257c]
push ecx
mov ecx, dword [eax + 0x34]
push edx
mov edx, dword [eax + 0x30]
push 0x4445dc
push 0x14
push ecx
push edx
call fcn.0042c090
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.0042d845
mov esp, ebp
pop ebp
ret 4

Function at 0x41c2b9
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x41c2f4
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x41c2d1
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x41c310
dec esi
je 0x41c309
dec esi
jne 0x41c315
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x41d6b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebx + 4], eax
xor eax, eax
cmp byte [ebp + 0x24], al
mov dword [ebx + 0x10], ecx
mov ecx, dword [ebp + 0x10]
push edi
mov word [ebx + 0xc], ax
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], eax
jne 0x41d6fd
mov ecx, 0x2000
lea edi, [esi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov word [ebx + 0x2c], ax
mov dword [ebx + 0x30], eax
call fcn.0041d133
mov eax, dword [ebx + 0x14]
and dword [ebx + 0x20], 0
mov ecx, 0x8000
push 2
mov word [ebx + 0x3c], cx
mov dword [ebx + 0x34], ecx
add eax, ecx
pop edx
movzx edi, byte [eax]
mov esi, dword [ebx + 0x20]
shl esi, 5
xor esi, edi
and esi, 0x7fff
inc eax
dec edx
mov dword [ebx + 0x20], esi
jne 0x41d721
cmp byte [ebp + 0x24], 0
je 0x41d748
mov edi, ebx
call fcn.0041cf95
jmp 0x41d757
xor eax, eax
mov edx, dword [ebx + 0x18]
and word [eax + edx], 0
inc eax
inc eax
dec ecx
jne 0x41d74a
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.0041c419
push 0x4b
pop edx
call fcn.0041c419
call fcn.0041d458
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
je 0x41d791
mov edi, dword [ebx + 0x14]
mov ecx, 0x2000
lea esi, [edi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x28]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24