joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415e3a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x5fa498]
push ebx
push esi
push edi
xor ebx, ebx
mov word [ebp - 0x210], ax
push 0x206
lea eax, [ebp - 0x20e]
mov dword [ebp - 0x214], ebx
push ebx
push eax
mov edi, ecx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x218], ebx
call fcn.00586790
xorps xmm0, xmm0
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
movlpd qword [ebp - 0x228], xmm0
call fcn.0059771b
add esp, 0x10
mov esi, eax
add esi, esi
mov ecx, esi
neg ecx
push 2
push ebx
push ecx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x214]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
push dword [edi + 8]
call ebx
cmp esi, dword [ebp - 0x214]
jne 0x416028
lea eax, [ebp - 0x210]
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push eax
call fcn.00599314
pop ecx
pop ecx
test eax, eax
jne 0x416028
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push eax
push 0xfffffffffffffffc
pop eax
sub eax, dword [ebp - 0x214]
push eax
push dword [edi + 8]
call esi
push 0
lea eax, [ebp - 0x214]
push eax
push 4
lea eax, [ebp - 0x22c]
push eax
push dword [edi + 8]
call ebx
mov eax, dword [ebp - 0x22c]
add eax, dword [ebp - 0x214]
push 1
push 0
neg eax
push eax
push dword [edi + 8]
call esi
push 0
lea eax, [ebp - 0x214]
push eax
push 4
lea eax, [ebp - 0x218]
push eax
push dword [edi + 8]
call ebx
and dword [ebp - 0x230], 0
cmp dword [ebp - 0x218], 0
mov ebx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x228]
jbe 0x415ffb
lea esi, [edi + 0x5cfb8]
mov dword [ebp - 0x21c], eax
push 0
lea eax, [ebp - 0x214]
push eax
push 0x20
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0x18]
xor edx, edx
add dword [esi + 8], eax
mov eax, dword [esi + 0x1c]
adc dword [esi + 0xc], eax
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
sbb eax, dword [esi + 0xc]
add ecx, 1
mov dword [esi], edx
adc eax, edx
mov dword [esi + 4], edx
add dword [ebp - 0x21c], ecx
lea ecx, [edi + 0x26e4]
mov dword [esi + 0x18], edx
adc ebx, eax
mov dword [esi + 0x1c], edx
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], esi
push eax
call fcn.0040b59b
mov eax, dword [ebp - 0x230]
add esi, 0x20
inc eax
mov dword [ebp - 0x230], eax
cmp eax, dword [ebp - 0x218]
jb 0x415f7e
mov eax, dword [ebp - 0x21c]
mov edx, dword [edi + 0x5d100]
mov ecx, dword [edi + 0x5d104]
sub edx, eax
mov dword [edi + 0x5d118], edx
sbb ecx, ebx
mov dword [edi + 0x5d110], edx
xor eax, eax
mov dword [edi + 0x5d11c], ecx
mov dword [edi + 0x5d114], ecx
inc eax
jmp 0x41602a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056e987
leave
ret
Function at 0x416039
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edi + 0x20]
mov ebx, dword [edi + 0x805c]
cmp dword [eax + 4], 1
jne 0x416057
mov ebx, dword [edi]
xor eax, eax
cmp dword [esi + 0x26f0], eax
je 0x4160f7
call fcn.00415c64
mov edx, dword [edi + 0x8040]
push 0
mov dword [ebp - 8], edx
mov ecx, dword [edx + 8]
add ecx, dword [edx + 0x18]
mov eax, dword [edx + 0xc]
adc eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4160a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x416130
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
push ebx
lea eax, [edi + 0x40]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416130
mov ecx, dword [ebp + 8]
cmp ecx, ebx
jne 0x416130
mov eax, dword [ebp - 8]
add dword [eax + 0x18], ecx
adc dword [eax + 0x1c], 0
mov ecx, dword [ebp + 8]
add dword [esi + 0x5d110], ecx
push ecx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push edi
call fcn.00416139
mov ecx, esi
call fcn.00415d63
xor eax, eax
inc eax
jmp 0x416132
push eax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [edi + 0x40]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416130
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x416130
add dword [esi + 0x5d110], eax
mov ecx, esi
push eax
adc dword [esi + 0x5d114], 0
push edi
call fcn.00416139
jmp 0x4160f2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x418acd
Capabilities:
Read file on windows

Disassembly:
push 0x46c
mov eax, 0x5b4d87
call fcn.0056fee5
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x474], esi
test edi, edi
jne 0x418afe
push 0x5f3886
call fcn.00403a6b
mov eax, esi
jmp 0x418b73
and dword [ebp - 4], 0
lea ecx, [ebp - 0x470]
call fcn.00419286
mov byte [ebp - 4], 1
mov ebx, 0x400
jmp 0x418b2b
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x470]
call fcn.00419402
push edi
push ebx
lea eax, [ebp - 0x414]
push 1
push eax
call fcn.00598609
add esp, 0x10
test eax, eax
jg 0x418b18
push edi
call fcn.0059740b
pop ecx
push esi
lea ecx, [ebp - 0x470]
call fcn.00419307
jmp 0x418afa
call fcn.0056fe32
ret

Function at 0x419286
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], vtable.CMD5Checksum.0
push eax
call fcn.00586790
and dword [esi + 0x48], 0
add esp, 0xc
and dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret

Function at 0x41958b
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
mov eax, dword [0x649ffc]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
push 0x208
mov esi, ecx
lea eax, [esp + 0x2c]
push 0
mov dword [esp + 0x14], esi
push eax
mov dword [esp + 0x18], esi
call fcn.00586790
add esp, 0xc
lea eax, [esp + 0x28]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.360base.dll
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esp + 0x28]
push eax
call edi
test eax, eax
jne 0x419658
lea ecx, [esp + 0x10]
call fcn.004194f8
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call edi
test eax, eax
je 0x41963d
cmp dword [esp + 0x24], 8
lea ecx, [esp + 0x28]
push 0
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x10]
call fcn.00409db5
lea eax, [esp + 0x28]
push eax
call edi
test eax, eax
jne 0x419658
push 0x5fa498
jmp 0x41965d
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.00409872
mov ecx, dword [esp + 0x234]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0056e987
mov esp, ebp
pop ebp
ret
Function at 0x419cdf
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d10
call fcn.0056f680
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x2d10], eax
test eax, eax
je 0x419e1d
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0041a794
add esp, 0x10
lea eax, [ebp - 0x204]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419e0c
and dword [ebp - 0x2d0c], 0
lea eax, [ebp - 0x2d08]
push 0xc
push 0
push eax
call fcn.00586790
xor eax, eax
push 0x2710
push eax
mov dword [ebp - 0x2d08], eax
mov dword [ebp - 0x2d04], eax
lea eax, [ebp - 0x2cfc]
push eax
call fcn.00586790
add esp, 0x18
lea eax, [ebp - 0x2d0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d08]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x419e01
push 0x3e8
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.00586790
mov edx, dword [ebp - 0x2ce4]
lea eax, [ebp - 0x5ec]
add esp, 0xc
push eax
push ecx
lea ecx, [ebp - 0x2cfc]
call fcn.004123ce
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2d10]
lea eax, [ebp - 0x5ec]
push eax
push 0x64
pop edx
call fcn.0041a768
xor ecx, ecx
inc ecx
test eax, eax
cmove edi, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x419e16
inc esi
cmp esi, 0x10
jl 0x419d0d
mov eax, edi
pop edi
pop esi
pop ebx
jmp 0x419e1f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e987
leave
ret
Function at 0x41a07c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x4f4], esi
test esi, esi
je 0x41a241
push edi
push 0x64
xor edi, edi
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x4e0]
push eax
push 8
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a221
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x4e8]
mov dword [ebp - 0x4e4], edi
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x4e8], 0x104
push eax
push edi
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41a219
mov esi, dword [ebp - 0x4e4]
lea eax, [ebp - 0x4e4]
push eax
push 1
push 0
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a1df
lea eax, [ebp - 0x4ec]
mov dword [ebp - 0x4f0], 1
push eax
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0x4ec], 0x208
push eax
lea eax, [ebp - 0x4f0]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x4e4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a1d7
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00586790
pop ecx
pop ecx
lea edx, [ebp - 0xcc]
lea ecx, [ebp - 0x4dc]
call fcn.00419f81
pop ecx
test eax, eax
je 0x41a1d7
cmp byte [ebp - 0x68], 0
je 0x41a1bf
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x41a1d7
push accept
lea eax, [ebp - 0xcc]
push eax
push ecx
push 0x64
pop edx
lea ecx, [ebp - 0x68]
call fcn.0041a72a
push dword [ebp - 0x4e4]
call edi
xor eax, eax
mov dword [ebp - 0x4e8], 0x104
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x4e8]
inc esi
push eax
lea eax, [ebp - 0x2d4]
push eax
push esi
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x41a117
mov esi, dword [ebp - 0x4f4]
push dword [ebp - 0x4e0]
call edi
cmp byte [ebp - 0x68], 0
pop edi
je 0x41a241
lea eax, [ebp - 0x68]
mov ecx, esi
push eax
push 0x64
pop edx
call fcn.0041a768
xor ecx, ecx
test eax, eax
setns cl
mov eax, ecx
jmp 0x41a243
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0056e987
leave
ret
Function at 0x41a41d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x41a537
mov eax, 0x400
mov dword [ebp - 0x510], 1
push eax
mov dword [ebp - 0x50c], eax
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x510]
push eax
push 0x5fcc4c
push str.Software360SafeLiveup
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41a537
lea eax, [ebp - 0x508]
push eax
call fcn.0058acf0
pop ecx
cmp eax, 0x40
jne 0x41a537
push 0x20
lea eax, [ebp - 0x508]
mov ebx, 0x80
push eax
push ecx
mov edx, ebx
lea ecx, [ebp - 0x88]
call fcn.0041a72a
lea eax, [ebp - 0x4e8]
mov edx, ebx
push eax
lea ecx, [ebp - 0x108]
call fcn.0041a768
mov ebx, 0x400
lea eax, [ebp - 0x508]
push ebx
push 0
push eax
call fcn.00586790
add esp, 0xc
lea edx, [ebp - 0x508]
lea ecx, [ebp - 0x88]
push ebx
call fcn.00419837
pop ecx
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41a537
lea eax, [ebp - 0x88]
mov edx, edi
push eax
mov ecx, esi
call fcn.0041a768
neg eax
sbb eax, eax
inc eax
jmp 0x41a539
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056e987
leave
ret

Function at 0x41a87e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5fcc78
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41a900
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x41a900
push str.GetDpiForMonitor
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x60
pop eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], eax
test esi, esi
je 0x41a92c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push edi
call esi
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0056e987
leave
ret
Function at 0x41bca7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x5fa498]
push esi
push 0x206
mov esi, ecx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
mov dword [ebp - 0x210], esi
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00409872
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0056e987
leave
ret

Function at 0x41bd1b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
mov esi, ecx
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x210], esi
push eax
mov dword [ebp - 0x210], esi
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00409872
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0056e987
leave
ret

Function at 0x41be57
Capabilities:
Create directory

Disassembly:
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x41be79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41be79
xor eax, eax
inc eax
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x41be7d
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push 0x26c
mov eax, 0x5b5025
call fcn.0056fe77
mov esi, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41bea1
xor eax, eax
inc eax
jmp 0x41bf8d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41be99
push esi
lea ecx, [ebp - 0x248]
call fcn.00409872
xor edi, edi
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x278]
mov dword [ebp - 4], edi
call fcn.0041bd83
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.00409db5
push esi
lea ecx, [ebp - 0x260]
call fcn.00409872
lea edx, [ebp - 0x260]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x230]
call fcn.0041be0f
lea ecx, [ebp - 0x260]
call fcn.00409db5
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
lea eax, [ebp - 0x218]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
call esi
test eax, eax
je 0x41bf75
push 4
push edi
lea eax, [ebp - 0x218]
push eax
call esi
inc edi
lea ecx, [ebp - 0x230]
call fcn.00409db5
lea ecx, [ebp - 0x278]
call fcn.00409db5
mov eax, edi
call fcn.0056fe21
ret
Function at 0x41c166
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa5c
mov eax, dword [0x649ffc]
xor eax, esp
mov dword [esp + 0xa58], eax
push ebx
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x41c3a9
xor eax, eax
cmp ax, word [ecx]
je 0x41c3a9
test esi, esi
je 0x41c3a9
cmp ax, word [esi]
je 0x41c3a9
push eax
push ecx
call fcn.00423324
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41c3a9
mov cx, word [0x5fa498]
lea eax, [esp + 0x652]
push 0x40e
push 0
push eax
mov word [esp + 0x65c], cx
call fcn.00586790
add esp, 0xc
lea eax, [esp + 0x650]
mov ebx, 0x207
push esi
push 0x5fbfd8
push ebx
push eax
call fcn.00411979
lea eax, [esp + 0x660]
push eax
call fcn.0059771b
add esp, 0x14
test eax, eax
je 0x41c3a9
lea eax, [esp + 0x650]
push eax
call fcn.0059771b
pop ecx
cmp word [esp + eax*2 + 0x64e], 0x5c
je 0x41c242
push ebx
lea eax, [esp + 0x654]
push 0x5fbab0
push eax
call fcn.0059a068
add esp, 0xc
lea ecx, [esp + 0x650]
call fcn.0041bf93
test eax, eax
je 0x41c3a9
lea eax, [esp + 0x10]
or edx, 0xffffffff
push eax
mov ecx, edi
call fcn.00423351
mov ebx, dword [esp + 0x14]
xor esi, esi
pop ecx
test ebx, ebx
jle 0x41c39d
lea eax, [esp + 0x10]
mov edx, esi
push eax
mov ecx, edi
call fcn.00423351
pop ecx
test eax, eax
jne 0x41c394
mov ax, word [0x5fa498]
push 0x40e
mov word [esp + 0x244], ax
lea eax, [esp + 0x246]
push 0
push eax
call fcn.00586790
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x654]
push eax
push 0x5fc740
lea eax, [esp + 0x24c]
push 0x207
push eax
call fcn.00411979
add esp, 0x14
lea eax, [esp + 0x14]
push 0x5fc9e0
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x41c394
test byte [esp + 0x21c], 0x10
je 0x41c30a
lea ecx, [esp + 0x240]
call fcn.0041bf93
jmp 0x41c394
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c34f
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c34f
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x240]
mov edx, esi
push eax
mov ecx, edi
call fcn.004233fb
pop ecx
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c394
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc esi
cmp esi, ebx
jl 0x41c274
push edi
call fcn.0042342c
xor eax, eax
pop ecx
inc eax
jmp 0x41c3ab
xor eax, eax
mov ecx, dword [esp + 0xa64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0056e987
mov esp, ebp
pop ebp
ret
Function at 0x41c680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41c738
mov eax, dword [ebp - 4]
test eax, eax
je 0x41c738
xor ecx, ecx
lea eax, [eax*2 + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0056f127
mov esi, eax
pop ecx
test esi, esi
je 0x41c738
mov eax, dword [ebp - 4]
lea eax, [eax*4 + 2]
push eax
push 0
push esi
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41c72e
push esi
call fcn.0059771b
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push esi
call fcn.00409cd1
push 2
push esi
call fcn.0056e998
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x41c73a
push 2
push esi
call fcn.0056e998
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41c73f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x41c750
mov ecx, dword [ecx]
add eax, eax
push eax
push ecx
push 1
push dword [ebp + 8]
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret

Function at 0x41c854
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
test esi, esi
je 0x41c8cd
push ebx
push esi
call fcn.0059a0ad
pop ecx
pop ecx
test eax, eax
jne 0x41c8cd
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 0x5fbf64
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00597315
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41c8ad
push edi
push 2
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.00598609
push edi
call fcn.0059740b
add esp, 0x14
push 0x5fcd64
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x41c8c9
mov ecx, esi
call fcn.0041eac2
mov ebx, eax
mov eax, ebx
jmp 0x41c8cf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056e987
leave
ret
Function at 0x41cb7a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 9
pop esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00586790
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x210]
add esp, 0xc
mov dword [ebp - 0x210], 0x103
xor ebx, ebx
inc ebx
mov dword [ebp - 0x214], ebx
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x41cccc
cmp ax, word [ebp - 0x20c]
je 0x41cccc
push 3
pop edi
push edi
lea eax, [ebp - 0x20c]
push 0x5fcdc4
push eax
call fcn.005993dc
add esp, 0xc
test eax, eax
jne 0x41cc20
push 2
jmp 0x41ccb2
push edi
lea eax, [ebp - 0x20c]
push 0x5fcdcc
push eax
call fcn.005993dc
add esp, 0xc
test eax, eax
jne 0x41cc3d
push 5
jmp 0x41ccb2
push edi
lea eax, [ebp - 0x20c]
push 0x5fcdd4
push eax
call fcn.005993dc
add esp, 0xc
test eax, eax
jne 0x41cc5d
mov esi, edi
jmp 0x41cd00
push edi
lea eax, [ebp - 0x20c]
push 0x5fcddc
push eax
call fcn.005993dc
add esp, 0xc
test eax, eax
jne 0x41cc7a
push 6
jmp 0x41ccb2
push edi
lea eax, [ebp - 0x20c]
push 0x5fcde4
push eax
call fcn.005993dc
add esp, 0xc
test eax, eax
jne 0x41cc97
push 7
jmp 0x41ccb2
push edi
lea eax, [ebp - 0x20c]
push 0x5fcdec
push eax
call fcn.005993dc
add esp, 0xc
test eax, eax
jne 0x41ccb5
push 8
pop esi
jmp 0x41cd00
push edi
lea eax, [ebp - 0x20c]
push 0x5fcdf4
push eax
call fcn.005993dc
add esp, 0xc
jmp 0x41cd00
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.VersionNumber
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x41cd00
cmp ax, word [ebp - 0x20c]
cmovne esi, ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056e987
leave
ret