joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414341
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
cmp byte [ebp + 8], 0
mov eax, dword [0x44a750]
mov dword [ebp - 4], eax
je 0x41455d
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x41455c
push dword [ebp + 0xc]
call fcn.00429210
cmp eax, edi
pop ecx
mov dword [ebp - 0x510], eax
jle 0x41455c
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
mov byte [ebp - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.00429eb0
cmp eax, edi
pop ecx
pop ecx
je 0x4143c4
mov byte [eax + 1], 0
lea eax, [ebp - 0x108]
push str.wrapperdl.tdat
push eax
call fcn.00429610
pop ecx
pop ecx
push ebx
push esi
push edi
mov esi, 0x80
push esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
jne 0x414422
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 4
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
je 0x41455a
push 0
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x41445f
cmp eax, 0x19000
jbe 0x41445f
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 5
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov edi, eax
jmp 0x414465
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x41455a
push 2
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x10], ebx
mov esi, dword [ebp - 0x510]
je 0x41449e
push dword [ebp + 0x10]
call fcn.00429210
cmp eax, esi
pop ecx
jle 0x41449e
push dword [ebp + 0x10]
call fcn.00429210
pop ecx
mov esi, eax
add esi, 0x64
push esi
call fcn.00426e44
mov ebx, 0x43e4a0
mov esi, eax
push ebx
push esi
call fcn.00429600
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x4144c5
push edi
call fcn.00414309
pop ecx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.0042a413
lea eax, [ebp + 8]
push eax
call fcn.0042b87b
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x508]
push 0x400
push eax
call fcn.0042b860
lea eax, [ebp - 0x508]
push eax
push esi
call fcn.00429600
push edi
call fcn.00414309
push dword [ebp + 0xc]
push esi
call fcn.00429600
push edi
call fcn.00414309
add esp, 0x30
cmp dword [ebp + 0x10], 0
je 0x41453c
push dword [ebp + 0x10]
call fcn.00429210
test eax, eax
pop ecx
jbe 0x41453c
push dword [ebp + 0x10]
push esi
call fcn.00429600
push edi
call fcn.00414309
add esp, 0xc
push ebx
push esi
call fcn.00429600
push edi
call fcn.00414309
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004291cb
pop ecx
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.0042954e
leave
ret
Function at 0x416698
Capabilities:
Delete file

Disassembly:
mov eax, 0x43aebc
call fcn.004291ac
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xa054]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [esi], 0x43e690
mov dword [ebp - 4], ebx
je 0x4166c7
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [esi + 0x1c], ebx
je 0x41670c
mov ecx, esi
call fcn.00415260
mov edi, eax
cmp edi, ebx
je 0x4166f0
mov eax, dword [esi + 0x1c]
push dword [eax + 4]
push 0x442e40
push edi
call fcn.00407a21
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov edi, dword [esi + 0x1c]
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x416700
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi + 0x20], ebx
je 0x416730
push dword [esi + 0x2c]
push 0x442eb0
push dword [esi + 0x28]
call fcn.00407a21
mov eax, dword [esi + 0x20]
mov dword [eax + 8], ebx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x41673d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x41674a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi + 0x30]
cmp dword [ecx], ebx
je 0x416756
call fcn.00414280
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x416764
push eax
call fcn.00429f46
pop ecx
mov eax, dword [esi + 0x38]
cmp eax, ebx
je 0x416772
push eax
call fcn.00429f46
pop ecx
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x416780
push eax
call fcn.00429f46
pop ecx
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x41678e
push eax
call fcn.00429f46
pop ecx
lea eax, [esi + 0x48]
cmp byte [eax], bl
je 0x41679c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x417b85
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 0xc]
mov byte [ebp - 1], bl
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
je 0x417c38
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 2]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
setne al
cmp al, bl
je 0x417c37
cmp dword [ebp - 8], 1
jne 0x417bf8
cmp byte [ebp - 2], bl
je 0x417bf8
inc dword [ebp - 0xc]
push ebx
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 2]
push eax
push dword [ebp + 8]
call esi
test eax, eax
setne al
cmp al, bl
jne 0x417bd1
cmp al, bl
je 0x417c37
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
je 0x417c37
mov edi, dword [ebp - 0xc]
inc edi
push edi
call fcn.00426e44
pop ecx
mov ecx, dword [ebp + 0x10]
push ebx
mov dword [ecx], eax
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x417c34
cmp dword [ebp - 8], edi
mov byte [ebp - 1], 1
je 0x417c37
mov byte [ebp - 1], bl
pop esi
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret

Function at 0x417c91
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x417ce1
push ebx
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417ce1
cmp dword [ebp - 8], 2
jne 0x417ce1
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
shl eax, 8
add eax, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov bl, 1
mov al, bl
pop ebx
leave
ret
Function at 0x41ac9e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
push dword [esi + 0x154]
mov byte [ebp - 1], 0
call fcn.004291cb
xor edi, edi
cmp dword [ebp + 8], edi
pop ecx
mov dword [esi + 0x154], edi
mov dword [esi + 0x150], edi
mov dword [esi + 0x14c], edi
je 0x41ae0a
push ebx
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41ae09
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esi + 4]
mov dword [ebp + 8], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 8]
test al, al
je 0x41ae02
mov edx, dword [esi + 0x68]
sub edx, 0x40
lea ecx, [esi + 0x6c]
mov eax, dword [ecx]
push edx
push ebx
call dword [eax + 4]
test al, al
je 0x41ae02
lea ecx, [esi + 0x80]
mov eax, dword [ecx]
push ebx
call dword [eax + 8]
test al, al
je 0x41ae02
push dword [esi + 0x11c]
lea ecx, [esi + 0x120]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x48]
test al, al
je 0x41ae02
lea eax, [esi + 0x120]
push eax
push dword [esi + 0x94]
lea edi, [esi + 0x134]
mov edx, dword [edi]
push ebx
mov ecx, edi
call dword [edx + 0xc]
test al, al
je 0x41ae02
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x14]
test al, al
je 0x41ae02
mov edi, dword [esi + 0x130]
jmp 0x41ada1
mov eax, dword [edi]
push esi
push ebx
mov ecx, edi
call dword [eax + 4]
test al, al
je 0x41ae13
mov edi, dword [edi + 4]
test edi, edi
jne 0x41ad91
push 1
push edi
push edi
push ebx
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x41ae02
mov ecx, dword [ebp + 8]
sub ecx, eax
mov dword [esi + 0x14c], eax
mov dword [esi + 0x150], ecx
je 0x41adfe
push ecx
call fcn.00426e44
and dword [ebp + 8], edi
pop ecx
push edi
lea ecx, [ebp + 8]
push ecx
push dword [esi + 0x150]
mov dword [esi + 0x154], eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ae13
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x150]
jne 0x41ae13
mov byte [ebp - 1], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret 4
mov byte [ebp - 1], 0
jmp 0x41ae02
Function at 0x41ae19
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [ebp + 8], eax
push edi
mov edi, ecx
mov byte [ebp - 1], al
je 0x41af26
push eax
push 0x80
push 2
push eax
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x41af26
push ebx
push esi
lea esi, [edi + 0x120]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x18]
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
mov dword [eax + 0xc], ebx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
mov dword [eax + 0x10], ebx
mov ebx, dword [ebp + 8]
lea ecx, [edi + 4]
mov eax, dword [ecx]
push ebx
call dword [eax + 0xc]
test al, al
je 0x41af1d
lea ecx, [edi + 0x6c]
mov eax, dword [ecx]
push ebx
call dword [eax + 8]
test al, al
je 0x41af1d
lea ecx, [edi + 0x80]
mov eax, dword [ecx]
push ebx
call dword [eax + 0xc]
test al, al
je 0x41af1d
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x4c]
test al, al
je 0x41af1d
lea esi, [edi + 0x134]
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x10]
test al, al
je 0x41af1d
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x18]
test al, al
je 0x41af1d
mov eax, dword [edi + 0x150]
test eax, eax
jbe 0x41af19
push 0
lea ecx, [ebp + 8]
push ecx
push eax
push dword [edi + 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41af13
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 0x150]
je 0x41af19
mov byte [ebp - 1], 0
jmp 0x41af1d
mov byte [ebp - 1], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, byte [ebp - 1]
pop edi
leave
ret 4

Function at 0x41b1ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ecx + 4], 0
jne 0x41b1f1
push 0x449250
lea ecx, [ebp - 0xc]
call fcn.0042ba51
push 0x446c7c
lea eax, [ebp - 0xc]
push eax
call fcn.004295be
push esi
xor esi, esi
cmp dword [ecx + 0x3cc], esi
jle 0x41b213
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dl, byte [edi]
xor byte [eax], dl
inc edi
inc eax
inc esi
cmp esi, dword [ecx + 0x3cc]
jl 0x41b203
pop edi
pop esi
leave
ret 8
Function at 0x41bfbf
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x44a750]
push esi
push edi
mov edi, dword [ebp + 0x90]
test edi, edi
mov dword [ebp + 0x84], eax
je 0x41c036
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x41c036
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41c006
and al, 0x10
sub al, 0x10
neg al
sbb eax, eax
inc eax
jmp 0x41c038
push edi
call fcn.0042bd47
mov esi, eax
push 0x5c
push esi
call fcn.00429eb0
add esp, 0xc
test eax, eax
je 0x41c0a6
push esi
mov byte [eax], 0
call fcn.0041bfbf
test al, al
pop ecx
push esi
jne 0x41c04d
call fcn.00428a54
pop ecx
xor al, al
mov ecx, dword [ebp + 0x84]
pop edi
pop esi
call fcn.0042954e
add ebp, 0x88
leave
ret
call fcn.00428a54
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.00429600
lea eax, [ebp - 0x80]
lea esi, [ebp - 0x80]
push eax
dec esi
call fcn.00429210
add esp, 0x10
jmp 0x41c083
push eax
call fcn.00429210
mov byte [eax + esi], 0
lea eax, [ebp - 0x80]
push eax
call fcn.00429210
pop ecx
pop ecx
cmp byte [eax + esi], 0x5c
lea eax, [ebp - 0x80]
je 0x41c06e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41c0a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41c036
mov al, 1
jmp 0x41c038

Function at 0x41c0df
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
jne 0x41c108
xor al, al
jmp 0x41c183
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
je 0x41c179
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
je 0x41c179
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
je 0x41c179
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
leave
ret
Function at 0x41c242
Capabilities:
Delete file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd48
mov eax, dword [0x44a750]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0xd48], esi
jne 0x41c26b
xor al, al
jmp 0x41c457
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
jne 0x41c276
lea edi, [esi + 0xc]
push edi
call fcn.0041bfbf
test al, al
pop ecx
jne 0x41c288
xor al, al
jmp 0x41c456
lea eax, [ebp - 0x440]
push eax
mov ecx, esi
call fcn.0041becf
cmp byte [ebp - 0x210], bl
je 0x41c2db
push ebx
lea eax, [ebp - 0x440]
push eax
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0042bb6f
mov esi, dword [esi + 4]
add esp, 0x14
cmp esi, ebx
je 0x41c2c9
push 1
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0041bfbf
pop ecx
jmp 0x41c456
cmp byte [ebp + 0xc], bl
je 0x41c31b
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x208]
push eax
push ebx
lea eax, [ebp - 0x440]
push ebx
push eax
call fcn.0042bbff
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x208]
push eax
push ebx
lea eax, [ebp - 0x440]
push ebx
push eax
call fcn.0042bb6f
add esp, 0x28
push ebx
lea eax, [ebp - 0x440]
push eax
push edi
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.0042bb6f
lea eax, [ebp - 0x108]
push eax
call fcn.0041c0aa
add esp, 0x18
test al, al
je 0x41c281
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
mov esi, 0x80
push esi
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0xd44], eax
jne 0x41c3a7
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push esi
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call edi
mov dword [ebp - 0xd44], eax
mov esi, dword [ebp - 0xd48]
push dword [esi + 8]
call fcn.004242c0
test eax, eax
jne 0x41c281
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x41c3ce
push ebx
lea ecx, [ebp - 0x108]
push ecx
call eax
push 0x800
lea eax, [ebp - 0xd40]
push eax
push dword [esi + 8]
call fcn.00423c30
mov edi, eax
cmp edi, ebx
jle 0x41c410
push ebx
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 0xd40]
push eax
push dword [ebp - 0xd44]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41c40d
cmp dword [ebp + 0xc], edi
je 0x41c3ce
or edi, 0xffffffff
push dword [ebp - 0xd44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 8]
call fcn.00423e30
cmp edi, ebx
jne 0x41c44f
push dword [ebp - 0x228]
lea eax, [ebp - 0x108]
push eax
call fcn.0041c0df
pop ecx
pop ecx
push dword [ebp - 0x214]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
cmp edi, ebx
sete al
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0042954e
leave
ret 8
Function at 0x41c5f1
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x43af9c
call fcn.004291ac
sub esp, 0x17c
mov eax, dword [0x44a750]
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x12c], ebx
call fcn.0041f44b
push str.SoftwareMicrosoftInternet_ExplorerInternetRegistryREGISTRYUSER
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 1
mov dword [ebp - 0x128], 0x104
mov dword [ebp - 0x118], ebx
call fcn.0041f491
lea eax, [ebp - 0x118]
push eax
push 0x20019
push ebx
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 2
call fcn.0041fbc7
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41c7bd
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x160]
push eax
push ebx
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x41c7bd
mov eax, dword [ebp - 0x11c]
inc eax
push eax
mov dword [ebp - 0x120], eax
call fcn.00426e44
pop ecx
lea ecx, [ebp - 0x174]
mov esi, eax
call fcn.00413260
add eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x124]
lea eax, [eax + ecx + 0xa]
push eax
call fcn.00426e44
mov edi, eax
mov eax, dword [ebp - 0x11c]
pop ecx
inc eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x17c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x120]
push eax
push esi
push ebx
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, ebx
jne 0x41c7af
sub esp, 0x14
lea eax, [ebp - 0x174]
mov ecx, esp
mov dword [ebp - 0x184], esp
push eax
call fcn.0041f54c
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x140]
call fcn.0041f5d5
lea ecx, [ebp - 0x154]
call fcn.0041f5a7
push 0x43c9e4
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x140]
call fcn.0041f6b3
lea ecx, [ebp - 0x154]
call fcn.0041f5a7
push esi
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x140]
call fcn.0041f6b3
lea ecx, [ebp - 0x154]
call fcn.0041f5a7
push esi
call fcn.004291cb
push edi
call fcn.004291cb
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x140]
push eax
call fcn.0041f54c
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x12c], 1
mov byte [ebp - 4], 1
call fcn.0041f5a7
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], bl
call fcn.0041f5a7
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0042954e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41cae3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41cb02
push esi
call fcn.00429210
pop ecx
xor ecx, ecx
test eax, eax
jbe 0x41cb02
xor byte [ecx + esi], 8
inc ecx
cmp ecx, eax
jb 0x41caf9
pop esi
ret
Function at 0x424430
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x42443f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x4492b4]
test eax, eax
je 0x42444d
call fcn.004242e0
mov edx, dword [esp + 0x10]
cmp edx, 8
mov eax, dword [esp + 8]
not eax
jb 0x424541
push ebx
push edi
mov edi, edx
shr edi, 3
xor ecx, ecx
mov cl, byte [esi]
mov ebx, eax
shr ebx, 8
sub edx, 8
xor ecx, eax
and ecx, 0xff
mov eax, dword [ecx*4 + 0x546360]
xor eax, ebx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x546360]
shr eax, 8
xor ecx, eax
xor eax, eax
mov al, byte [esi + 1]
inc esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x546360]
shr ecx, 8
xor eax, ecx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x546360]
shr eax, 8
xor ecx, eax
xor eax, eax
mov al, byte [esi + 1]
inc esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x546360]
shr ecx, 8
xor eax, ecx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x546360]
shr eax, 8
xor ecx, eax
xor eax, eax
mov al, byte [esi + 1]
inc esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x546360]
shr ecx, 8
xor eax, ecx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x546360]
shr eax, 8
xor eax, ecx
inc esi
dec edi
jne 0x424467
pop edi
pop ebx
test edx, edx
je 0x424561
xor ecx, ecx
mov cl, byte [esi]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x546360]
shr eax, 8
xor eax, ecx
inc esi
dec edx
jne 0x424545
not eax
pop esi
ret 0xc