joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5cdc
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
xor edx, edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a5ec5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x98], 4
jne 0x4a5dc2
cmp dword [ebp - 0x94], 0xa
jne 0x4a5dc2
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00404c54
push 0x104
mov eax, dword [ebp - 8]
call fcn.00404ac8
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [ebp - 8]
call fcn.00404ac8
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404800
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [ebp - 8]
call fcn.004048c8
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00404b28
mov eax, dword [ebp - 0xa0]
mov edx, 0x4a5edc
call fcn.00404a14
je 0x4a5da6
lea eax, [ebp - 8]
mov edx, 0x4a5edc
call fcn.004048d0
lea eax, [ebp - 8]
mov edx, 0x4a5ee8
call fcn.004048d0
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040465c
jmp 0x4a5e9f
mov eax, dword [ebp - 0x98]
cmp eax, 6
jae 0x4a5dfe
cmp eax, 5
je 0x4a5dfe
cmp dword [ebp - 0x98], 4
jne 0x4a5de4
cmp dword [ebp - 0x94], 0x5a
je 0x4a5dfe
cmp dword [ebp - 0x98], 4
jne 0x4a5e9f
cmp dword [ebp - 0x94], 0
jne 0x4a5e9f
lea eax, [ebp - 4]
push eax
push 0x23
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00418dec
test al, al
je 0x4a5e9f
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00404c54
mov eax, dword [ebp - 8]
call fcn.00404ac8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 8]
call fcn.00404ac8
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404800
lea eax, [ebp - 0xa4]
push eax
mov eax, dword [ebp - 8]
call fcn.004048c8
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00404b28
mov eax, dword [ebp - 0xa4]
mov edx, 0x4a5edc
call fcn.00404a14
jne 0x4a5e88
lea eax, [ebp - 8]
mov edx, 0x4a5f30
call fcn.004048d0
jmp 0x4a5e95
lea eax, [ebp - 8]
mov edx, 0x4a5f5c
call fcn.004048d0
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040465c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5ecc
lea eax, [ebp - 0xa4]
mov edx, 2
call fcn.0040462c
lea eax, [ebp - 8]
call fcn.00404608
ret
Function at 0x4af158
Capabilities:
Create process on windows
Pause service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4af303
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4af220
lea edx, [ebp - 0x34]
mov eax, dword [0x4bc338]
mov eax, dword [eax]
call fcn.00478e2c
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x14]
call fcn.004092a4
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004048c8
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 0x14]
call fcn.00404b28
mov eax, dword [ebp - 0x38]
mov edx, 0x4af31c
call fcn.00404a14
je 0x4af1e3
lea eax, [ebp - 0x14]
mov edx, 0x4af31c
call fcn.004048d0
push 6
push 0x4af328
push dword [ebp - 0x14]
push 0x4af334
push 0x4af354
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00404988
mov eax, dword [ebp - 0x3c]
call fcn.00404ac8
push eax
call sub.kernel32.dll_WinExec
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4af2e0
xor eax, eax
push ebp
push 0x4af2d9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x30
push 0x4af368
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4af25b
call fcn.004040d0
jmp 0x4af2e0
xor eax, eax
push ebp
push 0x4af2bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
test eax, eax
jne 0x4af288
call fcn.004040d0
call fcn.004040d0
jmp 0x4af2e0
lea eax, [ebp - 0x30]
push eax
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
test byte [ebp - 0x2c], 2
jne 0x4af288
push 0x64
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af2c2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af30a
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.0040462c
lea eax, [ebp - 0x14]
call fcn.00404608
ret
Function at 0x4af380
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4af459
xor eax, eax
push ebp
push 0x4af452
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x30
push 0x4af460
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4af3cf
call fcn.004040d0
jmp 0x4af459
xor eax, eax
push ebp
push 0x4af434
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
je 0x4af41d
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x4af40c
cmp dword [ebp - 0x24], 3
jne 0x4af41d
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4af3fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af43b
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b7f74
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ab8
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4b80e2
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00479fb0
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00479fd0
jmp 0x4b80ae
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404878
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004092d8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408888
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408888
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404a14
je 0x4b808e
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404878
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408888
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408888
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404a14
jne 0x4b80a5
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.00479ff0
test eax, eax
jne 0x4b7fef
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b80e9
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040462c
lea eax, [ebp - 4]
call fcn.00404608
ret
Function at 0x401760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401779
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40178d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4017ae
cmp esi, eax
jae 0x401787
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4017a0
cmp esi, eax
jae 0x401787
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4076c0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x443798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov ecx, dword [0x45569c]
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x4556a8]
mov edx, eax
shl edx, 4
add edx, eax
mov esi, edx
sub esi, ecx
mov ecx, dword [0x455690]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x455694]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x66666667
imul ecx
mov eax, dword [0x56bd14]
sar edx, 2
mov ecx, edx
add esi, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x34
shr ecx, 0x1f
add ecx, esi
add ecx, edx
mov dword [str._r_____r____], ecx
mov ecx, 0x56bd14
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov eax, dword [0x455688]
lea ecx, [eax + eax*8]
mov eax, dword [0x4556a8]
lea edx, [eax + eax*2]
shl edx, 4
lea esi, [edx + ecx*4]
mov ecx, dword [0x45569c]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x455690]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x94f2095
imul ecx
mov eax, dword [0x4556a0]
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
sub esi, eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
sub esi, 0x39
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [0x455690], esi
call fcn.00407430
mov ecx, dword [0x455694]
mov eax, 0x2aaaaaab
imul ecx
mov esi, ecx
imul esi, esi, 0x39
sar edx, 3
mov ecx, dword [0x45568c]
mov eax, dword [0x455690]
add esi, edx
imul eax, eax, 0x31
mov edi, edx
mov edx, ecx
imul edx, edx, 0x61
shr edi, 0x1f
add edi, esi
mov esi, dword [esp + 8]
add edi, edx
add edi, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
push esi
mov dword [0x45569c], edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
pop edi
pop esi
jg 0x407847
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40cec0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
mov ecx, dword [0x45569c]
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x4556a8]
mov edx, eax
shl edx, 4
add edx, eax
mov esi, edx
sub esi, ecx
mov ecx, dword [0x455690]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x455694]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
add esi, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x34
mov edi, dword [esp + 0x1c]
shr ecx, 0x1f
lea eax, [esp + 0x10]
add ecx, esi
push eax
add ecx, edx
xor ebp, ebp
push edi
mov dword [esp + 0x18], ebp
mov dword [str._r_____r____], ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebp
je 0x40d0ec
mov eax, dword [0x4556a8]
push ebx
mov ebx, dword [0x4556a0]
mov ecx, eax
imul ebx, ebx, 0x34
shl ecx, 4
add ecx, eax
sub ebx, ecx
mov ecx, dword [0x45568c]
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x455690]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [0x455694]
add eax, ebx
sub eax, edx
add eax, 0x37
push esi
mov dword [0x45568c], eax
call fcn.0043ab82
add esp, 4
mov ebx, eax
push ebx
push esi
push ebp
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40d0e2
mov eax, dword [0x455698]
lea ecx, [eax + eax*8]
shl ecx, 2
mov esi, ecx
mov ecx, dword [0x45569c]
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x45568c]
sar edx, 3
imul ecx, ecx, 0x34
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add ecx, dword [0x4556a4]
mov eax, dword [str._r_____r____]
lea edx, [eax + eax*4]
add ecx, esi
lea eax, [ecx + edx*2 - 0x39]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x4461ec
push ebx
mov dword [0x455694], eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
mov esi, dword [0x45568c]
je 0x40d09a
mov ecx, dword [0x4556a4]
mov edi, dword [0x455688]
mov eax, 0x2aaaaaab
imul edi, edi, 0x2a
imul ecx
mov ecx, dword [0x45569c]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5397829d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x66666667
imul esi
sar edx, 2
lea ecx, [ecx + ecx*4]
mov eax, edx
shr eax, 0x1f
lea ecx, [edi + ecx*2]
add eax, edx
sub ecx, eax
mov dword [0x4556a4], ecx
mov ecx, dword [esp + 0x10]
mov bp, word [ecx + 0x14]
mov ecx, dword [0x455694]
mov edi, ecx
mov eax, 0x2aaaaaab
imul edi, edi, 0x39
imul ecx
mov eax, dword [0x455690]
sar edx, 3
imul eax, eax, 0x31
add edi, edx
mov ecx, edx
mov edx, esi
imul edx, edx, 0x61
shr ecx, 0x1f
add ecx, edi
add ecx, edx
add ecx, eax
mov eax, 0x38e38e39
imul esi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x45569c], ecx
push ebx
call fcn.0043ab87
add esp, 4
pop ebx
pop edi
pop esi
mov ax, bp
pop ebp
add esp, 0xc
ret
Function at 0x40e8e0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [0x45569c]
mov eax, 0x5397829d
imul ebp
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push esi
mov esi, eax
push edi
mov edi, dword [0x455690]
mov eax, 0xd5555555
imul edi
mov ebx, dword [0x4556a8]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
mov esi, dword [0x45568c]
mov dword [esp + 0x10], eax
imul esi, esi, 0x34
mov eax, 0x66666667
imul dword [0x455694]
sar edx, 2
mov eax, edx
shr eax, 0x1f
mov ecx, ebx
add eax, edx
mov edx, dword [esp + 0x10]
shl ecx, 4
add ecx, ebx
add eax, ecx
add eax, edx
add esi, eax
mov eax, dword [section.5445rt54]
test eax, eax
mov dword [str._r_____r____], esi
jne 0x40e9bd
mov eax, dword [0x5694cc]
test eax, eax
jne 0x40e9bd
mov ecx, dword [0x4556a4]
imul edi, edi, 0x39
mov ebx, dword [0x4556a0]
mov eax, 0x38e38e39
imul ebx, ebx, 0xffffffcf
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x151d07eb
imul ebp
sar edx, 3
sub ebx, ecx
mov ecx, dword [0x455688]
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, edi
pop edi
add eax, esi
pop esi
add ecx, eax
pop ebp
mov dword [0x455688], ecx
mov eax, 1
pop ebx
pop ecx
ret
mov esi, dword [0x4556a0]
mov eax, 0x30c30c31
imul esi, esi, 0x34
imul dword [0x45568c]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [0x455694]
add eax, esi
sub eax, ecx
sub eax, edx
add eax, 0x37
mov dword [0x45568c], eax
mov eax, dword [0x455688]
lea ecx, [eax + eax*8]
lea edx, [ebx + ebx*2]
shl edx, 4
lea ecx, [edx + ecx*4]
mov eax, 0x2aaaaaab
imul ebp
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x94f2095
imul edi
mov edi, dword [0x4556a0]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, edi
sub ecx, 0x39
mov dword [0x455690], ecx
mov ecx, dword [section.5445rt54]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov esi, dword [0x455698]
mov ecx, eax
xor edi, edi
cmp ecx, edi
je 0x40eab6
lea edx, [esi + esi*8]
shl edx, 2
mov ebx, edx
mov edx, dword [0x45569c]
mov eax, 0x30c30c31
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45568c]
imul edx, edx, 0x34
sub ebx, eax
add edx, dword [0x4556a4]
mov eax, dword [str._r_____r____]
lea eax, [eax + eax*4]
add edx, ebx
lea edx, [edx + eax*2 - 0x39]
mov dword [0x455694], edx
mov dword [section.5445rt54], edi
mov dword [0x5694cc], edi
mov eax, 0x78787879
imul esi
mov eax, dword [0x4556a0]
imul eax, eax, 0x2a
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x4556a8]
add esi, eax
mov eax, edx
imul eax, eax, 0x39
sub esi, eax
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x66666667
imul dword [0x455694]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
pop edi
mov dword [0x455698], esi
pop esi
pop ebp
mov eax, ecx
pop ebx
pop ecx
ret
Function at 0x416730
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x457000]
mov edx, dword [esp + 0x11c]
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x128], eax
mov eax, dword [ebp]
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x416852
lea ecx, [esp + 8]
call fcn.00416610
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x416856
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x416800
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.00416730
mov edi, eax
test edi, edi
jne 0x41687a
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x4167c2
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x416819
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x128]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x416838
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.00428ee1
add esp, 0x118
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x416861
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.00428ee1
add esp, 0x118
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x416889
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
pop ebp
call fcn.00428ee1
add esp, 0x118
ret 4
Function at 0x416d60
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x416d72
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x41a510
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
mov ebp, dword [0x45569c]
mov eax, 0x5397829d
imul ebp
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0xd5555555
imul dword [0x455690]
mov ebx, dword [0x4556a8]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
push esi
push edi
mov edi, eax
mov eax, 0x66666667
imul dword [0x455694]
sub edi, ecx
mov ecx, dword [0x45568c]
sar edx, 2
imul ecx, ecx, 0x34
mov esi, ebx
mov eax, edx
shr eax, 0x1f
shl esi, 4
add eax, edx
add esi, ebx
add eax, esi
add eax, edi
add ecx, eax
cmp dword [esp + 0x14], 0x132b600
mov dword [str._r_____r____], ecx
je 0x41a5a3
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x41a592
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [0x4556a4]
mov edi, dword [0x4556a0]
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0xffffffcf
sub edx, eax
mov dword [esp + 0x14], edx
mov eax, 0x151d07eb
imul ebp
mov ebp, dword [esp + 0x14]
sar edx, 3
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, dword [0x455690]
mov edx, ebp
imul edx, edx, 0x39
sub eax, edx
add eax, ecx
mov ecx, eax
mov eax, dword [0x455688]
add eax, ecx
mov ecx, dword [0x5697d0]
mov edx, ecx
inc ecx
test edx, edx
mov dword [0x455688], eax
mov dword [0x5697d0], ecx
jle 0x41a65b
mov eax, 0x30c30c31
imul edi, edi, 0x34
imul dword [0x45568c]
sar edx, 3
add edi, edx
mov ecx, edx
mov eax, 0x66666667
imul ebp
sar edx, 2
shr ecx, 0x1f
add ecx, edi
mov eax, edx
shr eax, 0x1f
add ecx, edx
mov edx, dword [0x455694]
add eax, ecx
sub eax, esi
pop edi
sub eax, edx
pop esi
add eax, 0x37
pop ebp
mov dword [0x45568c], eax
mov eax, 1
pop ebx
ret
lea ecx, [eax + eax*8]
lea edx, [ebx + ebx*2]
shl edx, 4
lea ecx, [edx + ecx*4]
mov eax, 0x2aaaaaab
imul dword [0x45569c]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x94f2095
imul ebp
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, edi
sub ecx, 0x39
mov dword [0x455690], ecx
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x41a050
push 0
push 0
mov dword [0x5694f4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x455698]
mov ecx, dword [0x45569c]
lea edx, [eax + eax*8]
shl edx, 2
mov esi, edx
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [0x45568c]
sar edx, 3
imul ecx, ecx, 0x34
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4556a4]
sub esi, eax
mov eax, dword [str._r_____r____]
add ecx, edx
pop edi
lea edx, [eax + eax*4]
add ecx, esi
pop esi
lea eax, [ecx + edx*2 - 0x39]
pop ebp
mov dword [0x455694], eax
mov eax, 1
pop ebx
ret