joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b70
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory
Set file attributes

Disassembly:
sub esp, 0x25c
push ebp
mov ebp, dword [esp + 0x264]
push esi
push edi
push ebp
lea ecx, [esp + 0x10]
call fcn.00415ee0
push 0x422c00
lea ecx, [esp + 0x10]
call fcn.00415f90
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x404c93
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea esp, [esp]
push ebp
lea ecx, [esp + 0x10]
call fcn.00415f20
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jne 0x404be1
lea ecx, [esp + 0xc]
call fcn.004158c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, 0x5c
mov word [ecx + eax*2], dx
inc eax
xor edx, edx
mov word [ecx + eax*2], dx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x10]
call fcn.00415f90
test byte [esp + 0x18], 0x10
je 0x404c58
push 0x422bfc
lea ecx, [esp + 0x48]
push ecx
call edi
test eax, eax
je 0x404c78
push 0x422bf4
lea edx, [esp + 0x48]
push edx
call edi
test eax, eax
je 0x404c78
mov eax, dword [esp + 0xc]
push eax
call fcn.00404b70
add esp, 4
test eax, eax
jne 0x404c78
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0041a71a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x25c
ret
mov ecx, dword [esp + 0xc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404cd3
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x404cd3
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404bc0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x42927c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404cd3
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x404cd3
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0041a71a
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x25c
ret
mov edx, dword [esp + 0xc]
push edx
call fcn.0041a71a
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x25c
ret

Function at 0x404cf0
Capabilities:
Delete file
Set file attributes

Disassembly:
sub esp, 0x250
cmp dword [0x429398], 0
je 0x404d0b
mov eax, 1
add esp, 0x250
ret
push esi
mov esi, dword [esp + 0x258]
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x404d31
mov eax, 1
pop esi
add esp, 0x250
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [esp + 4], 0x10
jne 0x404d65
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404d5b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
add esp, 0x250
ret
xor eax, eax
pop esi
add esp, 0x250
ret
push esi
call fcn.00404b70
add esp, 4
pop esi
add esp, 0x250
ret
Function at 0x4052f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 4]
push edi
mov ecx, esi
mov dword [esp + 0xc], ebx
mov dword [ebx], 0x422bf0
call fcn.004159a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test edi, edi
je 0x405362
push ebp
push esi
lea ecx, [esp + 0x18]
call fcn.004159d0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
cmp edi, dword [esi + 8]
jbe 0x40533c
push edi
mov ecx, esi
call fcn.00415820
mov eax, dword [esi]
push ebx
push ebp
push eax
call fcn.0041b424
mov ecx, dword [esp + 0x20]
mov ebx, dword [esi]
push ecx
call fcn.0041a71a
add esp, 0x10
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, dword [esp + 0x10]
pop ebp
mov ecx, dword [esi]
xor eax, eax
cmp word [ecx], ax
je 0x405378
jmp 0x405370
inc eax
cmp word [ecx + eax*2], 0
jne 0x405370
mov dword [esi + 4], eax
pop edi
xor edx, edx
mov word [ecx + eax*2], dx
pop esi
mov eax, ebx
pop ebx
add esp, 0x10
ret 4
Function at 0x4053b0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov ecx, esi
call fcn.004159a0
push esi
lea ecx, [esp + 0x14]
call fcn.004159d0
cmp dword [esi + 8], 2
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
jae 0x4053e3
push 2
mov ecx, esi
call fcn.00415820
mov eax, dword [esi]
push edi
push ebx
push eax
call fcn.0041b424
mov eax, dword [esp + 0x1c]
mov edi, dword [esi]
push eax
call fcn.0041a71a
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
add esp, 0x10
push edi
push 1
call ebp
mov ecx, dword [esi]
xor edx, edx
mov dword [esi + 4], 0
mov word [ecx], dx
test eax, eax
je 0x405481
push esi
lea ecx, [esp + 0x14]
lea edi, [eax + 1]
call fcn.004159d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
cmp edi, dword [esi + 8]
jbe 0x40543f
push edi
mov ecx, esi
call fcn.00415820
mov ecx, dword [esp + 0x20]
mov eax, dword [esi]
push ebx
push ecx
push eax
call fcn.0041b424
mov edx, dword [esp + 0x1c]
mov ebx, dword [esi]
push edx
call fcn.0041a71a
add esp, 0x10
push ebx
push edi
call ebp
mov ecx, dword [esi]
xor eax, eax
cmp word [ecx], ax
je 0x405478
lea esp, [esp]
inc eax
cmp word [ecx + eax*2], 0
jne 0x405470
xor edx, edx
mov dword [esi + 4], eax
mov word [ecx + eax*2], dx
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
xor ebp, ebp
lea ebx, [ebx]
push esi
lea ecx, [esp + 0x14]
call fcn.004159d0
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add eax, 0xf
cmp eax, dword [esi + 8]
jbe 0x4054b6
push eax
mov ecx, esi
call fcn.00415820
mov eax, dword [esi]
push edi
push ebx
push eax
call fcn.0041b424
mov ecx, dword [esp + 0x1c]
mov edi, dword [esi]
push ecx
call fcn.0041a71a
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push ebp
push edx
lea ecx, [edi + eax*2]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esi]
xor eax, eax
add esp, 0x1c
cmp word [ecx], ax
je 0x4054f8
lea esp, [esp]
inc eax
cmp word [ecx + eax*2], 0
jne 0x4054f0
mov dword [esi + 4], eax
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40551c
inc ebp
cmp ebp, 0xfff
jl 0x405490
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x405720
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.004159a0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
call fcn.004159d0
cmp dword [esp + 0x18], 1
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
jae 0x405758
push 1
lea ecx, [esp + 0x14]
call fcn.00415820
mov ecx, dword [esp + 0x10]
push esi
push edi
push ecx
call fcn.0041b424
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
push edx
call fcn.0041a71a
mov ebp, dword [esp + 0x3c]
mov eax, dword [ebp]
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add esp, 0x10
push 1
push esi
push eax
call ebx
test eax, eax
jne 0x4057a1
mov eax, dword [esp + 0x10]
push eax
call fcn.0041a71a
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x20]
lea edi, [eax + 1]
call fcn.004159d0
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x2c], edx
cmp edi, dword [esp + 0x18]
jbe 0x4057ce
push edi
lea ecx, [esp + 0x14]
call fcn.00415820
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
push esi
push eax
push ecx
call fcn.0041b424
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
push edx
call fcn.0041a71a
mov eax, dword [ebp]
add esp, 0x10
push edi
push esi
push eax
call ebx
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp word [ecx], ax
je 0x40580a
inc eax
cmp word [ecx + eax*2], 0
jne 0x405802
mov dword [esp + 0x14], eax
xor edx, edx
mov word [ecx + eax*2], dx
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.00415a00
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041a71a
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x405ac0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [esp + 0x1c]
mov ebp, eax
call fcn.00415ee0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.004159d0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call fcn.0041b424
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
push ecx
call fcn.0041a71a
movzx eax, word [ebx + ebp*2 - 2]
add esp, 0x10
cmp eax, 0x5c
je 0x405b20
cmp eax, 0x2f
jne 0x405b28
xor edx, edx
mov word [edi + ebp*2 - 2], dx
dec ebp
push edi
mov esi, ebp
call fcn.00403a30
add esp, 4
test eax, eax
jne 0x405b6e
test esi, esi
jle 0x405b55
jmp 0x405b40
movzx eax, word [edi + esi*2]
cmp eax, 0x2f
je 0x405b53
cmp eax, 0x5c
je 0x405b53
dec esi
test esi, esi
jg 0x405b40
test esi, esi
je 0x405c5a
xor eax, eax
push edi
mov word [edi + esi*2], ax
call fcn.00403a30
add esp, 4
test eax, eax
je 0x405b37
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x405bad
lea edx, [esp + 0x10]
push edx
push edi
call fcn.00405690
add esp, 8
test eax, eax
je 0x405bad
mov eax, dword [esp + 0x18]
push eax
call fcn.0041a71a
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
push edi
call fcn.00403a30
add esp, 4
test eax, eax
jne 0x405bdb
push edi
push 0xc
push 1
call fcn.0040bda0
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0041a71a
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
cmp esi, ebp
jge 0x405c3d
nop
mov eax, dword [esp + 0x34]
mov edx, ebp
sub edx, esi
inc edx
push edx
lea ecx, [eax + esi*2]
push ecx
lea ebx, [edi + esi*2]
push ebx
call fcn.0041ad60
add esp, 0xc
cmp word [ebx], 0
je 0x405c01
inc esi
cmp word [edi + esi*2], 0
je 0x405c26
jmp 0x405c10
movzx eax, word [edi + esi*2]
cmp eax, 0x5c
je 0x405c26
cmp eax, 0x2f
je 0x405c26
inc esi
cmp word [edi + esi*2], 0
jne 0x405c10
xor edx, edx
push edi
mov word [edi + esi*2], dx
call fcn.00403a30
add esp, 4
test eax, eax
je 0x405c57
cmp esi, ebp
jl 0x405be0
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0041a71a
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret
push edi
jmp 0x405c92
cmp ebp, 2
jne 0x405c91
mov ax, word [ebx]
or ax, 0x20
cmp ax, 0x61
jb 0x405c91
cmp ax, 0x7a
ja 0x405c91
cmp word [ebx + 2], 0x3a
jne 0x405c91
mov edx, dword [esp + 0x18]
push edx
call fcn.0041a71a
add esp, 4
pop edi
pop esi
lea eax, [ebp - 1]
pop ebp
pop ebx
add esp, 0x20
ret
push ebx
push 0xc
push 1
call fcn.0040bda0
mov eax, dword [esp + 0x24]
push eax
call fcn.0041a71a
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x406100
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
push edi
mov ecx, esi
call fcn.004159a0
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jle 0x406180
push ebx
push ebp
push esi
lea ecx, [esp + 0x14]
lea ebx, [edi + 1]
call fcn.004159d0
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
cmp ebx, dword [esi + 8]
jbe 0x406149
push ebx
mov ecx, esi
call fcn.00415820
mov edx, dword [esp + 0x20]
mov eax, dword [esi]
push ebp
push edx
push eax
call fcn.0041b424
mov eax, dword [esp + 0x1c]
mov ebp, dword [esi]
push eax
call fcn.0041a71a
mov ecx, dword [esp + 0x34]
add esp, 0x10
push ebx
push ebp
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [esi]
xor eax, eax
pop ebp
mov dword [esi + 4], edi
mov word [edx + edi*2], ax
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x4063c0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push 1
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [esp + 0x24]
mov ecx, esi
mov ebx, eax
call fcn.004159a0
push esi
lea ecx, [esp + 0x18]
lea edi, [ebx + 2]
call fcn.004159d0
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x24], edx
cmp edi, dword [esi + 8]
jbe 0x40640c
push edi
mov ecx, esi
call fcn.00415820
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
push ebp
push ecx
push eax
call fcn.0041b424
mov edx, dword [esp + 0x20]
push edx
call fcn.0041a71a
add esp, 0x10
push esi
lea ecx, [esp + 0x18]
call fcn.004159d0
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x24], eax
cmp edi, dword [esi + 8]
jbe 0x40644a
push edi
mov ecx, esi
call fcn.00415820
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
push ebp
push ecx
push eax
call fcn.0041b424
mov edx, dword [esp + 0x20]
mov edi, dword [esi]
push edx
call fcn.0041a71a
mov eax, dword [esp + 0x38]
add esp, 0x10
inc ebx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [esi]
xor eax, eax
cmp word [ecx], ax
je 0x406488
mov edi, edi
inc eax
cmp word [ecx + eax*2], 0
jne 0x406480
mov dword [esi + 4], eax
xor edx, edx
pop edi
mov word [ecx + eax*2], dx
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x406d80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x268
push ebx
push esi
push edi
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x429218], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.0040c330
call fcn.004044d0
push 3
call fcn.00404530
push 0x28
mov dword [0x429240], eax
call fcn.00404530
push 2
mov dword [0x42923c], eax
call fcn.00404530
push 5
mov dword [0x429238], eax
call fcn.00404530
push 0x15
mov dword [0x429234], eax
call fcn.00404530
push 0x16
mov dword [0x429230], eax
call fcn.00404530
push 0x17
mov dword [0x42922c], eax
call fcn.00404530
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
mov dword [0x429228], eax
mov dword [0x429220], 0
mov dword [0x429224], 0
xor edi, edi
lea esp, [esp]
push 0
push edi
lea eax, [esp + 0x70]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x406e7d
push edi
lea ecx, [esp + 0x10]
push 0x423938
push ecx
call ebx
push 1
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.004064a0
add esp, 0x18
xor esi, esi
cmp dword [esi + 0x4283c4], edi
jne 0x406e75
mov edx, dword [esi + 0x4283c8]
push 0
lea ecx, [esp + 0x6c]
push ecx
push edx
call fcn.004064a0
add esp, 0xc
add esi, 8
cmp esi, 0x28
jb 0x406e57
inc edi
cmp edi, 0x40
jl 0x406e20
pop edi
pop esi
pop ebx
add esp, 0x268
ret

Function at 0x4074b0
Capabilities:
Set environment variable

Disassembly:
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x429360], esi
jle 0x407511
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [0x42935c]
mov ecx, dword [eax + esi*4]
add ecx, 0xc
push ecx
lea ecx, [esp + 0xc]
call fcn.004159d0
lea edx, [esp + 8]
push edx
call fcn.00406ed0
mov eax, dword [esp + 0xc]
mov ecx, dword [0x42935c]
mov edx, dword [ecx + esi*4]
add esp, 4
push eax
mov eax, dword [edx]
push eax
call edi
mov ecx, dword [esp + 8]
push ecx
call fcn.0041a71a
inc esi
add esp, 4
cmp esi, dword [0x429360]
jl 0x4074c5
pop edi
pop esi
add esp, 0xc
ret
Function at 0x408ed0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.0041b69c
mov ecx, dword [esp + 0x20]
push eax
mov dword [ecx], eax
call fcn.00408e80
add esp, 0x20
ret

Function at 0x409000
Capabilities:
Set current directory

Disassembly:
mov eax, dword [0x42927c]
push esi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [esi + 8], 0
je 0x40906b
mov ecx, dword [esi + 8]
cmp ecx, dword [0x429280]
jne 0x40905f
mov ecx, dword [0x42927c]
mov eax, dword [esi + 4]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409056
test dx, dx
je 0x409052
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409056
add eax, 4
add ecx, 4
test dx, dx
jne 0x409030
xor eax, eax
jmp 0x40905b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40906b
mov edx, dword [esi + 4]
push edx
call fcn.00404cf0
add esp, 4
mov eax, dword [esi + 4]
mov dword [esi + 8], 0
xor ecx, ecx
mov word [eax], cx
mov al, 1
pop esi
ret

Function at 0x40adf0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x40ae05
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40ae1b
push 0
push 0
push esi
push 0x40adc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret
mov eax, dword [0x429238]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, esi
call fcn.00409870
push 0x2d
call fcn.00404530
mov edx, dword [esi + 4]
add esp, 4
push eax
push 0x4b2
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov ecx, esi
call fcn.00409870
pop esi
ret
Function at 0x40b3b0
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4d0
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x4b6
mov esi, ecx
call fcn.00409890
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0xc]
push 1
add ecx, 2
mov dword [esi + 0x58], ecx
push 0x4b6
mov ecx, esi
call fcn.004098b0
push 1
push 0x4b7
mov ecx, esi
call fcn.004098b0
push 0x2b0
lea edx, [esp + 0x20]
push 0
push edx
mov dword [esp + 0x24], 0
call fcn.0041a970
add esp, 0xc
push 0x104
lea eax, [esp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
push 0x2b4
lea ecx, [esp + 0x20]
push ecx
push 0
lea edx, [esp + 0x2dc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x18]
push 0x4b7
push ecx
mov dword [esi + 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x409fc0
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
mov dword [esi + 0x54], eax
call fcn.0040afd0
mov ecx, esi
mov edi, eax
call fcn.0040a7a0
mov eax, edi
pop edi
pop esi
add esp, 0x4d0
ret

Function at 0x40c330
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x42c300], ecx
inc edx
cmp edx, 0x100
jb 0x40c332
cmp edx, 0x800
jae 0x40c409
lea esp, [esp]
mov eax, dword [edx*4 + 0x42bf00]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x42c300]
inc edx
mov dword [edx*4 + 0x42c2fc], eax
cmp edx, 0x800
jb 0x40c3e0
mov eax, 0x421450
mov dword [0x42c2ec], eax
mov dword [0x42e300], eax
mov dword [0x42c2e8], 0x421370
call fcn.00413bb0
test eax, eax
jne 0x40c435
mov dword [0x42e300], 0x421370
ret
Function at 0x413c70
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x413c93
add esp, 0x114
ret
cmp dword [esp + 4], 5
sbb eax, eax
inc eax
add esp, 0x114
ret

Function at 0x413ef0
Capabilities:
Get file size

Disassembly:
push ecx
mov ecx, dword [ecx]
push esi
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413f18
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413f18
xor al, al
pop esi
pop ecx
ret 4
mov ecx, dword [esp + 4]
xor eax, eax
xor edx, edx
add edx, esi
adc ecx, eax
mov eax, dword [esp + 0xc]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov al, 1
pop esi
pop ecx
ret 4

Function at 0x4140c0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp]
test eax, eax
mov dword [edx], ecx
setne al
pop ecx
ret 0xc
mov eax, dword [esp + 8]
mov edx, dword [0x428624]
cmp eax, edx
jbe 0x4140d0
mov eax, edx
mov dword [esp + 8], eax
jmp 0x414080

Function at 0x4141a0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [0x428624]
cmp eax, edx
jbe 0x4141b0
mov eax, edx
mov ecx, dword [ecx]
push 0
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
test eax, eax
mov dword [edx], ecx
setne al
ret 0xc
Function at 0x417010
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
lea ebp, [ebx + 0x1c]
shr ebx, 2
mov eax, ebx
shr eax, 1
push esi
add eax, 3
xor esi, esi
mov dword [esp + 0xc], ebp
mov dword [ecx], eax
test ebx, ebx
je 0x41703f
mov eax, dword [edx]
mov dword [ecx + esi*4 + 0x10], eax
inc esi
add edx, 4
cmp esi, ebx
jb 0x417031
cmp esi, ebp
jae 0x417130
mov edx, esi
sub edx, ebx
lea eax, [ecx + edx*4 + 0x10]
mov dword [esp + 0x14], eax
push edi
xor edx, edx
mov eax, esi
div ebx
mov edi, dword [ecx + esi*4 + 0xc]
test edx, edx
jne 0x4170bd
movzx eax, byte [eax + 0x424248]
mov edx, edi
and edx, 0xff
movzx edx, byte [edx + str.cw]
mov ebp, edi
shr ebp, 0x18
movzx ebp, byte [ebp + str.cw]
shl edx, 8
or edx, ebp
mov ebp, edi
shr ebp, 0x10
shr edi, 8
and ebp, 0xff
movzx ebp, byte [ebp + str.cw]
and edi, 0xff
movzx edi, byte [edi + str.cw]
shl edx, 8
or edx, ebp
mov ebp, dword [esp + 0x10]
shl edx, 8
xor edi, eax
or edi, edx
jmp 0x417113
cmp ebx, 6
jbe 0x417113
cmp edx, 4
jne 0x417113
mov edx, edi
shr edx, 0x10
and edx, 0xff
movzx eax, byte [edx + str.cw]
mov edx, edi
shr edx, 0x18
movzx edx, byte [edx + str.cw]
shl edx, 8
or eax, edx
mov edx, edi
shr edx, 8
and edx, 0xff
movzx edx, byte [edx + str.cw]
shl eax, 8
and edi, 0xff
movzx edi, byte [edi + str.cw]
or eax, edx
shl eax, 8
or edi, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor edx, edi
mov dword [ecx + esi*4 + 0x10], edx
inc esi
add eax, 4
mov dword [esp + 0x18], eax
cmp esi, ebp
jb 0x417054
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4