joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e27d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x482778]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41e2c0
cmp word [esi], dx
jne 0x41e2c0
or byte [edi + eax + 0x28], 4
jmp 0x41e2c5
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41e418
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41e3f8
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41e307
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41e33d
cmp eax, edx
jae 0x41e349
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41e2df
jmp 0x41e418
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41e3f4
cmp dword [ebp - 0x14], 0
je 0x41e3f4
mov eax, dword [ebx*4 + 0x482778]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41e3cc
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41e395
mov word [esi], cx
jmp 0x41e3c8
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x482778]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x482778]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x482778]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41e418
pop ebx
cmp word [ebp - 4], bx
jne 0x41e3dd
cmp esi, dword [ebp + 0xc]
jne 0x41e3dd
mov word [esi], bx
jmp 0x41e415
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041ecb1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41e418
push 0xd
jmp 0x41e411
mov ecx, dword [ebx*4 + 0x482778]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41e40f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41e418
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4200b3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x420150
push ebx
push esi
call fcn.0042007c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041ee5d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4200fd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42014f
push edi
push eax
call fcn.00419df6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42011d
call fcn.004198c6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42014e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041ee5d
add esp, 0x20
test eax, eax
jne 0x42013c
push edi
call fcn.004198c6
jmp 0x420144
push ebx
call fcn.004198c6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x427480
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4274ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4274ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x429562
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
sub eax, dword [esp + 0x10]
sar eax, 2
push edi
mov edi, dword [esp + 0x20]
test eax, eax
je 0x42963a
push ebx
xor ebx, ebx
push esi
mov esi, ebx
cmp dword [esp + 0x2c], ebx
jbe 0x429638
push ebp
mov dword [esp + 0x10], ebx
mov ebp, 0x481dd8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
push str.Own_head
push ebp
mov byte [edi + esi], al
call fcn.0040146b
push eax
call fcn.00402624
mov al, byte [edi + esi]
add al, 0x4e
xor al, 0xdc
push str.Earth
push ebp
mov byte [edi + esi], al
call fcn.0040146b
push eax
call fcn.00402624
mov al, byte [edi + esi]
xor al, 0xac
sub al, 0x65
xor al, 0x22
sub al, 0x73
push 0x42a594
mov byte [edi + esi], al
call fcn.004108fe
add esp, 0x1c
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push ebx
call fcn.00401ab6
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
xor byte [edi + esi], al
mov eax, dword [esp + 0x18]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.00401996
inc esi
mov dword [esp + 0x18], ebx
pop ecx
pop ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp esi, dword [esp + 0x30]
jb 0x42959f
pop ebp
pop esi
pop ebx
lea ecx, [esp + 0x14]
call fcn.00405685
pop edi
add esp, 0xc
ret 0x14

Function at 0x42964a
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x429666
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x401190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov byte [ebp - 5], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401254
mov dword [ebp - 0x14], 0x19000
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00422360
add esp, 4
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00523530
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
xor ecx, ecx
cmp dword [ebp - 0x10], 0
sete cl
mov byte [ebp - 5], cl
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.004020f0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0042236b
add esp, 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4012a4
xor al, al
jmp 0x4012eb
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4012df
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4012eb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x404cc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a070
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x599690]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x818], 0
mov dword [ebp - 4], 1
push 0x800
push 0
lea eax, [ebp - 0x814]
push eax
call fcn.00523530
add esp, 0xc
mov ecx, dword [ebp - 0x81c]
add ecx, 4
call fcn.004019c0
push eax
push 0x7ff
lea ecx, [ebp - 0x814]
push ecx
push 0x574eaf
lea ecx, [ebp + 0x28]
call fcn.004019c0
push eax
lea ecx, [ebp + 0xc]
call fcn.004019c0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x814]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401980
mov eax, dword [ebp - 0x818]
or eax, 1
mov dword [ebp - 0x818], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00402110
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x28]
call fcn.00402110
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00520c7a
mov esp, ebp
pop ebp
ret 0x40

Function at 0x405330
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x40], 0
jne 0x405344
jmp 0x4053be
mov ecx, dword [ebp - 8]
mov byte [ecx + 5], 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x12c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405382
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
add ecx, 0x24
call fcn.00405780
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x40], 0
mov esp, ebp
pop ebp
ret
Function at 0x405420
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x599690]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
movzx ecx, byte [eax + 5]
test ecx, ecx
jne 0x405558
push 0xffffffffffffffff
mov edx, dword [ebp - 0x40]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
movzx edx, byte [ecx + 0x48]
test edx, edx
je 0x405553
mov eax, dword [ebp - 0x40]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x40]
add ecx, 0x24
call fcn.004056a0
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp - 0x40]
add ecx, 0x24
call fcn.004056d0
push eax
lea ecx, [ebp - 0xc]
call fcn.00405840
movzx eax, al
test eax, eax
je 0x405546
lea ecx, [ebp - 0xc]
call fcn.00405820
push eax
lea ecx, [ebp - 0x2c]
call fcn.004051d0
mov ecx, dword [ebp - 0x40]
add ecx, 0x24
call fcn.00405700
lea ecx, [ebp - 0x2c]
call fcn.004019c0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 2
push 0
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx + 0x44]
push edx
call fcn.005217a4
add esp, 0xc
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x44]
push ecx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401a20
push eax
lea ecx, [ebp - 0x2c]
call fcn.004019c0
push eax
call fcn.0052198b
add esp, 0x10
mov edx, dword [ebp - 0x40]
mov eax, dword [edx + 0x44]
push eax
push 1
push 2
push 0x5762b8
call fcn.0052198b
add esp, 0x10
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x40]
add ecx, 0x24
call fcn.004056a0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x2c]
call fcn.00402110
jmp 0x405483
mov ecx, dword [ebp - 0x40]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x405433
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00520c7a
mov esp, ebp
pop ebp
ret

Function at 0x4055a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 4]
push eax
push 4
mov ecx, dword [ebp - 0xc]
push ecx
push 0x405570
push 0
push 0
call fcn.00521b0e
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4055d9
cmp dword [ebp - 8], 0xffffffff
je 0x4055d9
cmp dword [ebp - 8], 1
jne 0x4055dd
xor al, al
jmp 0x4055f5
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x40dcd0
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x40], 0xffffffff
jne 0x40dd00
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], 0xffffffff
xor eax, eax
jmp 0x40dd05
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x411f50
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549970
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x599690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x411fad
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x14], eax
xor eax, eax
jmp 0x411fc8
jmp 0x411fbc
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418ed0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x599690]
xor eax, ebp
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
shl eax, 3
mov dword [ebp - 0x48], eax
mov dword [0x5a0fb8], 0x67452301
mov dword [0x5a0fbc], 0xefcdab89
mov dword [0x5a0fc0], 0x98badcfe
mov dword [0x5a0fc4], 0x10325476
cmp dword [ebp + 0x10], 0x40
jle 0x418f4a
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00418e10
add esp, 8
lea eax, [ebp - 0x40]
push eax
call fcn.00418250
add esp, 4
mov ecx, dword [ebp + 0xc]
add ecx, 0x40
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 0x40
mov dword [ebp + 0x10], edx
jmp 0x418f14
mov dword [ebp - 0x44], 0
jmp 0x418f5c
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x80
jge 0x418f72
mov ecx, dword [ebp - 0x44]
mov byte [ebp + ecx - 0xd0], 0
jmp 0x418f53
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xd0]
push ecx
call fcn.005281c0
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov byte [ebp + edx - 0xd0], 0x80
cmp dword [ebp + 0x10], 0x37
jg 0x418fce
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x98]
push ecx
call fcn.00418e80
add esp, 8
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.00418e10
add esp, 8
lea ecx, [ebp - 0x40]
push ecx
call fcn.00418250
add esp, 4
jmp 0x41901c
mov edx, dword [ebp - 0x48]
push edx
lea eax, [ebp - 0x58]
push eax
call fcn.00418e80
add esp, 8
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00418e10
add esp, 8
lea eax, [ebp - 0x40]
push eax
call fcn.00418250
add esp, 4
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00418e10
add esp, 8
lea eax, [ebp - 0x40]
push eax
call fcn.00418250
add esp, 4
mov dword [ebp - 0x44], 0
jmp 0x41902e
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 0x80
jge 0x419044
mov edx, dword [ebp - 0x44]
mov byte [ebp + edx - 0xd0], 0
jmp 0x419025
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.00418e10
add esp, 8
mov edx, dword [0x5a0fb8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00418e80
add esp, 8
mov ecx, dword [0x5a0fbc]
push ecx
mov edx, dword [ebp + 8]
add edx, 4
push edx
call fcn.00418e80
add esp, 8
mov eax, dword [0x5a0fc0]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call fcn.00418e80
add esp, 8
mov edx, dword [0x5a0fc4]
push edx
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
call fcn.00418e80
add esp, 8
mov dword [0x5a0fc4], 0
mov ecx, dword [0x5a0fc4]
mov dword [0x5a0fc0], ecx
mov edx, dword [0x5a0fc0]
mov dword [0x5a0fbc], edx
mov eax, dword [0x5a0fbc]
mov dword [0x5a0fb8], eax
mov ecx, dword [ebp - 0x4c]
xor ecx, ebp
call fcn.00520c7a
mov esp, ebp
pop ebp
ret
Function at 0x41a870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ad18
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x599690]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x14]
push eax
push 1
push 0
lea ecx, [ebp + 0xc]
call fcn.004019c0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x41a98b
push 0x574dbf
lea ecx, [ebp - 0x40]
call fcn.00401980
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 0x4e20
mov edx, dword [ebp - 0x20]
push edx
call fcn.00422360
add esp, 4
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x44]
push edx
lea eax, [ebp - 0x24]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a929
mov edx, dword [ebp - 0x44]
push edx
lea ecx, [ebp - 0x40]
call fcn.004020f0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.0042236b
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.004019c0
push eax
lea ecx, [ebp - 0x48]
call fcn.00404510
mov byte [ebp - 4], 2
lea edx, [ebp - 0x48]
push edx
call fcn.00420d40
add esp, 4
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004049f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402110
mov cl, byte [ebp - 0x15]
mov byte [ebp - 0x51], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00402110
mov al, byte [ebp - 0x51]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00520c7a
mov esp, ebp
pop ebp
ret
Function at 0x41bc20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54acd8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x599690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0041fff0
lea ecx, [ebp + 0xc]
call fcn.0041fff0
push 0
lea ecx, [ebp + 0xc]
call fcn.004065e0
push eax
lea ecx, [ebp + 8]
call fcn.00403d90
cmp eax, 0xffffffff
jne 0x41bda8
lea eax, [ebp - 0x10]
push eax
call fcn.00420940
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 2
push 0x574df4
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.00409d80
add esp, 0xc
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 3
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00409730
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.004065e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x18]
call fcn.004049f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004049f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004049f0
lea edx, [ebp - 0x1c]
push edx
call fcn.00420940
add esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 4
push 0x574e10
mov ecx, dword [ebp - 0x44]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.00409d80
add esp, 0xc
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 5
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00409730
add esp, 0xc
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x54], ecx
mov byte [ebp - 4], 6
push 0x574e08
mov edx, dword [ebp - 0x54]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00409d80
add esp, 0xc
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
call fcn.004065e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x28]
call fcn.004049f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x24]
call fcn.004049f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.004049f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004049f0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004049f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004049f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41d950
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b7c0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x599690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xa8], 5
lea ecx, [ebp - 0x10]
call fcn.0040a300
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0xac], 1
jne 0x41d9b8
call fcn.00420d90
mov dword [ebp - 0x14], eax
jmp 0x41d9eb
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0xac], 2
jne 0x41d9cd
mov dword [ebp - 0x14], 1
jmp 0x41d9eb
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0xac], 3
jne 0x41d9e3
call fcn.00420d90
mov dword [ebp - 0x14], eax
jmp 0x41d9eb
call fcn.00420d90
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41d9fa
mov dword [ebp - 0x28], 0x575098
jmp 0x41da01
mov dword [ebp - 0x28], str.false
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x148]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x14c]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xac]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x114]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x144
call fcn.004065e0
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00409f90
add esp, 0x20
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.onoff.tmp
call fcn.00404510
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x10]
push eax
call fcn.0040a2e0
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
call fcn.0041c660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004049f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret