joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421433
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0x114
mov eax, 0x51ed20
call fcn.004ac5bf
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x118], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], edi
cmp dword [eax + 0x14], 0x10
jb 0x421468
mov eax, dword [eax]
push eax
push 0x54d8f0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x104
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.004e9750
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x421491
mov esi, dword [esi]
push 0x104
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x114]
mov ecx, edi
push eax
call fcn.00403a6c
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x11c], 1
jb 0x4214c9
mov ecx, dword [edi]
jmp 0x4214cb
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp dword [edi + 0x14], 0x10
jb 0x4214e0
mov ecx, dword [edi]
mov dword [ebp - 0x118], ecx
jmp 0x4214e6
mov dword [ebp - 0x118], edi
push eax
call fcn.00408bb0
push dword [ebp - 0x118]
mov esi, eax
call fcn.00408bb0
pop ecx
pop ecx
mov ecx, esi
xor edx, edx
sub ecx, eax
cmp eax, esi
cmova ecx, edx
test ecx, ecx
je 0x421518
cmp byte [eax], 0x2f
jne 0x421512
mov byte [eax], 0x5c
inc eax
inc ebx
cmp ebx, ecx
jne 0x42150a
mov eax, edi
call fcn.004ac569
ret

Function at 0x421520
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x218], 0
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x214], edi
call fcn.00407590
push eax
push str.install_path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e9750
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
push 0x104
push eax
call fcn.00407590
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004075b0
lea eax, [ebp - 0x214]
mov byte [ebp - 0x20d], 0x5c
push eax
mov ecx, edi
mov byte [ebp - 0x20e], 0x2f
call fcn.00413f00
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x21c]
push eax
call fcn.00413f60
lea ecx, [ebp - 0x20d]
push ecx
lea ecx, [ebp - 0x20e]
push ecx
push dword [esi]
push dword [eax]
call fcn.004217d2
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, edi
xor ecx, ebp
pop edi
pop esi
call fcn.004ac267
mov esp, ebp
pop ebp
ret
Function at 0x4215f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.004e9750
add esp, 0xc
test esi, esi
je 0x42163c
push esi
lea eax, [ebp - 0x20c]
push 0x54ae30
push eax
call fcn.00420a98
add esp, 0xc
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push esi
push ebx
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ac267
mov esp, ebp
pop ebp
ret
Function at 0x42271d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004ac2a0
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push edx
lea edx, [ebp - 0x804]
mov dword [ebp - 0x100c], 0x800
push edx
lea edx, [ebp - 0x1008]
inc ebx
push edx
push 0
push eax
push dword [ecx]
mov dword [ebp - 0x1008], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4227d3
cmp dword [ebp - 0x1008], ebx
jne 0x42278e
lea eax, [ebp - 0x804]
push eax
mov ecx, edi
call fcn.00407970
jmp 0x4227d3
cmp dword [ebp - 0x1008], 2
jne 0x4227ce
mov ebx, 0x400
lea eax, [ebp - 0x1004]
push ebx
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x100c], eax
test eax, eax
je 0x4227c7
cmp eax, ebx
ja 0x4227c7
lea eax, [ebp - 0x1004]
jmp 0x422784
mov esi, 0xea
jmp 0x4227d3
mov esi, 0x3f4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ac267
mov esp, ebp
pop ebp
ret 8

Function at 0x4227e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x4227f5
sub edx, esi
sar edx, 1
lea eax, [edx*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 8
Function at 0x42285e
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x3c
mov eax, 0x51efef
call fcn.004ac5bf
mov edi, edx
mov ebx, ecx
push ecx
push dword [ebp + 8]
mov ecx, edi
call fcn.00407590
mov edx, eax
mov ecx, ebx
call fcn.00422823
pop ecx
pop ecx
test eax, eax
jne 0x42288f
xor eax, eax
jmp 0x4229ac
lea eax, [ebp - 0x48]
xor esi, esi
push eax
mov eax, dword [ebp + 8]
mov ecx, edi
or eax, 8
mov dword [ebp - 0x48], esi
push eax
push esi
call fcn.00407590
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x422888
test eax, eax
jne 0x4229ac
push edi
lea ecx, [ebp - 0x2c]
call fcn.00407610
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00408f20
cmp dword [eax], esi
je 0x422904
mov ecx, edi
call fcn.00408f20
lea ecx, [ebp - 0x2c]
mov esi, dword [eax]
call fcn.00409360
lea eax, [eax + esi*2]
cmp word [eax - 2], 0x5c
je 0x422904
mov esi, 0x54c964
push esi
call fcn.00408db0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.004126e0
lea ecx, [ebp - 0x2c]
call fcn.00408f20
lea ecx, [ebp - 0x44]
mov esi, dword [eax]
call fcn.004075e0
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x14], 0x104
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x44]
call fcn.00422446
push eax
push 0
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x422979
push dword [ebp - 0x14]
lea ecx, [ebp - 0x44]
call fcn.004092c0
push esi
lea ecx, [ebp - 0x2c]
call fcn.004092c0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00412b30
push dword [ebp + 8]
lea edx, [ebp - 0x2c]
mov ecx, ebx
call fcn.0042285e
pop ecx
test eax, eax
je 0x42291a
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
push dword [ebp + 8]
mov ecx, edi
call fcn.00407590
mov edx, eax
mov ecx, ebx
call fcn.00422823
pop ecx
pop ecx
lea ecx, [ebp - 0x44]
mov esi, eax
call fcn.00409ad0
lea ecx, [ebp - 0x2c]
call fcn.00409ad0
mov eax, esi
call fcn.004ac569
ret
Function at 0x427458
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x260
mov eax, 0x51f3bb
call fcn.004ac5bf
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push 0x208
xor edi, edi
push edi
push eax
call fcn.004e9750
add esp, 0xc
cmp dword [ebp + 8], 0xffffffff
je 0x427499
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, esi
lea ecx, [ebp - 0x248]
call fcn.00414c41
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00407590
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00409ad0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004075b0
push 0x549dd0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 1
call fcn.004075b0
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x230]
lea ecx, [ebp - 0x260]
call fcn.00421520
pop ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00413fc0
lea ecx, [ebp - 0x260]
call fcn.00409ad0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
call fcn.00409ad0
lea eax, [ebp - 0x268]
mov byte [ebp - 0x261], 0x5c
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 0x262], 0x2f
call fcn.00413f00
mov esi, eax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x26c]
push eax
call fcn.00413f60
lea ecx, [ebp - 0x261]
push ecx
lea ecx, [ebp - 0x262]
push ecx
push dword [esi]
push dword [eax]
call fcn.004217d2
add esp, 0x10
lea ecx, [ebp - 0x230]
call fcn.00407590
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp - 0x230]
setne bl
call fcn.00409ad0
mov al, bl
call fcn.004ac569
ret 8

Function at 0x42ffcd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.004ac2a0
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1010], 0
lea eax, [ebp - 0x1008]
push esi
push edi
mov edi, 0x1000
mov dword [ebp - 0x100c], ecx
mov esi, edx
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x1014], edi
mov edx, edi
lea ecx, [ebp - 0x1018]
call fcn.0042586c
push esi
push edi
push 1
push eax
call fcn.004f17f5
add dword [ebp - 0x1010], eax
add esp, 0x10
cmp eax, edi
je 0x43000c
lea ecx, [ebp - 0x1018]
call fcn.0042590e
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ac267
mov esp, ebp
pop ebp
ret

Function at 0x43004b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004ac2a0
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x1014], 0
lea eax, [ebp - 0x100c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
mov dword [ebp - 0x1010], ecx
mov edx, esi
mov dword [ebp - 0x101c], eax
lea ecx, [ebp - 0x101c]
mov dword [ebp - 0x1018], 0x1000
call fcn.0042586c
push edi
push esi
push 1
push eax
call fcn.004f17f5
add esp, 0x10
lea ecx, [ebp - 0x101c]
mov esi, eax
add dword [ebp - 0x1014], esi
call fcn.0042590e
mov ecx, dword [ebp - 8]
xor eax, eax
cmp eax, esi
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.004ac267
mov esp, ebp
pop ebp
ret
Function at 0x4303a6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ecx + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ecx + 0xc]
sub esi, dword [eax]
sub esi, 0x10
mov dword [esp + 0xc], edx
push edi
sar esi, 4
mov dword [esp + 0xc], ecx
push 1
pop edi
sub esi, ebx
jne 0x4303e0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov edx, ebx
dec esi
call fcn.00423dfb
mov ecx, dword [esp + 0xc]
mov edx, ebx
cmp eax, 3
jne 0x430453
call fcn.00423b80
mov ecx, dword [esp + 0xc]
mov edx, ebx
push 0
cmp dword [eax + 8], 0x13
jne 0x430415
call fcn.00423f0e
pop ecx
push edx
push eax
push str._lld
jmp 0x430425
call fcn.00423ecf
push ecx
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x1c]
call fcn.00424df4
add esp, 0x10
test edi, edi
je 0x430439
test eax, eax
jg 0x43047b
xor edi, edi
inc ebx
test esi, esi
jne 0x4303dc
test edi, edi
jne 0x4303d2
mov ecx, dword [esp + 0xc]
xor edx, edx
push edi
call fcn.004253a9
pop ecx
jmp 0x4303d5
lea eax, [esp + 0x14]
push eax
call fcn.00425675
pop ecx
test edi, edi
je 0x430439
push dword [esp + 0x10]
push dword [esp + 0x18]
push 1
push eax
call fcn.004f23b6
add esp, 0x10
cmp eax, dword [esp + 0x14]
jne 0x430439
xor edi, edi
inc edi
jmp 0x43043b
Function at 0x432c3d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 8], ecx
cmp edi, 0x3fffffff
jae 0x432d37
lea eax, [edi + 2]
push 3
cdq
pop ebx
idiv ebx
lea eax, [eax*4 + 1]
cmp esi, eax
jl 0x432d37
mov esi, ecx
cmp edi, ebx
jle 0x432ce4
lea eax, [edi - 4]
xor edx, edx
div ebx
mov ebx, dword [ebp + 8]
inc eax
imul ecx, eax, 3
sub edi, ecx
mov dword [ebp + 0xc], edi
mov edi, eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, eax
add ebx, 3
mov ecx, edx
shr ecx, 0x1a
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, edx
shr ecx, 0x14
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
mov eax, edx
shr eax, 0xe
and eax, 0x3f
shr edx, 8
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], al
add esi, 4
sub edi, 1
jne 0x432c8c
mov edi, dword [ebp + 0xc]
jmp 0x432ce7
mov ebx, dword [ebp + 8]
xor edx, edx
test edi, edi
je 0x432d1e
mov ecx, edi
shl ecx, 3
movzx eax, byte [ebx]
shl edx, 8
add edx, eax
inc ebx
sub edi, 1
jne 0x432cf2
test ecx, ecx
jle 0x432d1e
shl edx, 6
mov eax, edx
shr eax, cl
sub ecx, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
test ecx, ecx
jg 0x432d07
mov ecx, dword [ebp - 8]
mov eax, esi
sub eax, ecx
jmp 0x432d2c
mov byte [esi], 0x3d
inc esi
inc eax
test al, 3
jne 0x432d27
mov byte [esi], 0
mov eax, ecx
jmp 0x432d39
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43933b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
mov dword [ebp - 0x18], edx
push edi
mov dword [ebp - 8], esi
call fcn.004f9b8d
xor edi, edi
xorps xmm1, xmm1
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
movzx eax, byte [esi]
test byte [eax + 0x54c541], 8
je 0x439395
inc esi
movzx eax, byte [esi]
test byte [eax + 0x54c541], 8
jne 0x439385
mov dword [ebp - 8], esi
lea ecx, [ebp - 8]
call fcn.00439320
mov edx, dword [ebp - 8]
mov dword [ebp - 0x24], eax
cmp byte [edx], 0x30
jne 0x4394bd
mov cl, byte [edx + 1]
cmp cl, 0x78
je 0x4393bd
cmp cl, 0x58
jne 0x4394bd
mov al, byte [ebp - 1]
add edx, 2
mov esi, edi
mov cl, byte [edx]
cmp cl, al
jne 0x4393d2
test esi, esi
jne 0x439422
inc esi
jmp 0x43941f
movzx eax, cl
test byte [eax + 0x54c541], 0x10
je 0x439422
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4393ef
cmp cl, 0x30
jne 0x4393ef
inc dword [ebp - 0x14]
jmp 0x439417
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1e
jg 0x439416
movsx ecx, cl
call fcn.0043930c
mulsd xmm1, qword [0x54fde0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
jmp 0x439417
inc edi
mov al, byte [ebp - 1]
test esi, esi
je 0x43941f
dec edi
inc edx
jmp 0x4393c5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edi
push 0
pop edi
add eax, ecx
je 0x4394bd
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov esi, eax
mov al, byte [edx]
shl esi, 2
cmp al, 0x70
je 0x43944d
cmp al, 0x50
jne 0x439496
inc edx
lea ecx, [ebp - 8]
mov dword [ebp - 8], edx
call fcn.00439320
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov al, byte [edx]
movzx ecx, al
test byte [ecx + 0x54c541], 2
je 0x4394bd
imul ecx, edi, 0xa
movsx edi, al
add edi, 0xffffffd0
add edi, ecx
inc edx
movzx eax, byte [edx]
test byte [eax + 0x54c541], 2
mov al, byte [edx]
jne 0x43946d
cmp dword [ebp - 0x1c], 0
je 0x43948f
neg edi
mov eax, dword [ebp - 0x18]
add esi, edi
mov dword [eax], edx
cmp dword [ebp - 0x24], 0
je 0x4394a3
xorps xmm1, xmmword [0x54fe50]
push esi
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.004fcb4f
fstp qword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x28]
add esp, 0xc
jmp 0x4394c0
xorps xmm0, xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x43c4e5
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
xor ecx, ecx
mov dword [ebp - 0x10], eax
push edi
push ecx
mov dword [ebx], ecx
push str.kernel32.dll
mov dword [eax], ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x43c567
push esi
push edi
call fcn.004ac30e
pop ecx
mov esi, eax
xor eax, eax
push esi
push edi
push eax
push str.kernel32.dll
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43c55f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x54c964
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43c55f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
push esi
call fcn.004ac317
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004ac267
mov esp, ebp
pop ebp
ret
Function at 0x443ab2
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x443ad2
push 0x208
lea eax, [ebp - 0x20c]
sub esi, ecx
push ebx
push eax
sar esi, 1
call fcn.004e9750
push edi
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004ede73
mov edi, ebx
add esp, 0x18
xor ebx, ebx
inc ebx
test esi, esi
js 0x443b6b
movzx eax, word [ebp + edi*2 - 0x20c]
cmp eax, 0x5c
jne 0x443b66
mov dword [ebp - 0x210], eax
cmp edi, 0x104
jae 0x443b82
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x443b58
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x443b7e
mov eax, dword [ebp - 0x210]
mov word [ebp + edi*2 - 0x20c], ax
inc edi
cmp edi, esi
jle 0x443b10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ac267
mov esp, ebp
pop ebp
ret
xor ebx, ebx
jmp 0x443b6b
call fcn.004ac18b
int3

Function at 0x4456b5
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push str..del
push esi
call fcn.004e8f46
pop ecx
pop ecx
test eax, eax
je 0x4456ed
push 5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x44577c
push edi
xor edi, edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e9750
add esp, 0xc
lea eax, [ebp - 0x20c]
test edi, edi
jne 0x445721
push esi
push str._s.del
push eax
call fcn.00420a98
add esp, 0xc
jmp 0x445731
push edi
push esi
push str._s.del_d
push eax
call fcn.00420a98
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44575b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44575b
cmp edi, 0xa
jge 0x44577b
inc edi
jmp 0x4456f0
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.004edee7
pop ecx
pop ecx
push 5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004ac267
mov esp, ebp
pop ebp
ret

Function at 0x4479e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x4479ec
mov dword [edx*4 + 0x56bfe0], ecx
inc edx
cmp edx, 0x100
jb 0x4479e7
mov esi, 0x800
jmp 0x447a35
mov ecx, dword [edx*4 + 0x56bbe0]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x56bfe0]
mov dword [edx*4 + 0x56bfe0], ecx
inc edx
cmp edx, esi
jb 0x447a19
mov dword [0x56dfe0], 0x443a10
call fcn.00447de8
mov ecx, dword [0x56dfe0]
test eax, eax
mov edx, 0x443aa9
cmove ecx, edx
mov dword [0x56dfe0], ecx
pop esi
ret
Function at 0x447e8a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
jne 0x447e9c
xor eax, eax
jmp 0x447ec3
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
push esi
push 1
push dword [ebp + 0xc]
call fcn.004f17f5
add esp, 0x10
mov dword [edi], eax
cmp eax, esi
jne 0x447eba
xor eax, eax
jmp 0x447ec2
push dword [ebx]
call fcn.004f1438
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x447f16
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
jne 0x447f28
xor eax, eax
jmp 0x447f4f
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
push esi
push 1
push dword [ebp + 0xc]
call fcn.004f23b6
add esp, 0x10
mov dword [edi], eax
cmp eax, esi
jne 0x447f46
xor eax, eax
jmp 0x447f4e
push dword [ebx]
call fcn.004f1438
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x448b78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x448b99
xor eax, eax
jmp 0x448cee
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
mov edx, dword [ebp + 8]
push ebx
or ebx, 0xffffffff
add ecx, edx
mov dword [ebp - 8], ecx
add edx, edi
mov dword [ebp - 4], edx
cmp edx, ecx
jae 0x448bc5
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x448bc2
inc edx
cmp edx, ecx
jb 0x448bb5
mov dword [ebp - 4], edx
mov edi, edx
sub edi, dword [ebp + 8]
cmp edx, ecx
jae 0x448cd2
mov ecx, edi
sub ecx, ebx
cmp ecx, 3
jbe 0x448bfd
xor esi, esi
mov al, byte [edx + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test al, al
je 0x448c3a
cmp al, 0xff
je 0x448c3a
and esi, 3
xor eax, eax
add esi, esi
or esi, 1
inc eax
jmp 0x448ccb
dec ecx
shl esi, cl
and esi, 7
je 0x448bdd
movzx eax, byte [esi + 0x526988]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x526980], 0
mov al, byte [ecx + 4]
je 0x448c24
test al, al
je 0x448c24
cmp al, 0xff
jne 0x448bdd
and esi, 3
mov ebx, edi
add esi, esi
or esi, 1
inc edi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
jmp 0x448bac
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
mov edx, dword [ebp + 0x10]
shl ebx, 8
or ebx, eax
cmp dword [ebp + 0x18], 0
je 0x448c67
add ebx, edi
add ebx, edx
jmp 0x448c6b
sub ebx, edi
sub ebx, edx
mov dword [ebp + 0xc], ebx
test esi, esi
je 0x448ca1
movzx eax, byte [esi + 0x526988]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x448c90
cmp al, 0xff
jne 0x448ca1
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [ebp - 0xc]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [ebp + 0xc]
jmp 0x448c5b
mov edx, dword [ebp - 4]
mov eax, ebx
shr eax, 0x18
and al, 1
dec al
not al
mov byte [edx + 1], bl
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x10]
shr eax, 8
push 5
mov byte [edx + 2], al
pop eax
add edi, eax
jmp 0x448c2f
mov edx, edi
xor eax, eax
sub edx, ebx
pop ebx
lea ecx, [edx - 1]
shl esi, cl
and esi, 7
cmp edx, 3
cmova esi, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x449369
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x449bc1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
mov eax, esi
setne dl
mov dword [esi + 4], edx
pop esi
pop ebp
ret 4