joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a770
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4e1330
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, 0x556608
mov eax, dword [eax + 0x90]
push eax
call sub.MFC42.DLL_CString::operator
push 0x5c
mov ecx, 0x556608
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, 0x556608
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, 0x556608
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_CString::operator_1
or ebp, 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], ebp
call fcn.00415612
push ecx
mov edx, esp
mov dword [esp + 0x10], esp
push 0x535ac4
push 0x556608
push edx
call sub.MFC42.DLL_operator_3
mov dword [esp + 0x34], ebp
call fcn.0040a990
mov ecx, eax
call fcn.0040a9a0
call fcn.00430f60
mov edi, eax
test edi, edi
je 0x40a857
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
push edi
lea eax, [esp + 0x10]
push 0x9e
push eax
mov dword [esp + 0x3c], 2
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x18]
add esp, 0xc
push 0
push 0
push ecx
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], ebp
call fcn.00415612
push 2
call fcn.00430ed0
mov edx, dword [esi + 0x20]
add esp, 4
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.EndHotkey
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::CString_1
push str.EndHotkeyMod
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], 3
call sub.MFC42.DLL_CString::CString_1
push str.qmacrone.ini
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 4
call sub.MFC42.DLL_CString::CString_1
push str.HotkeyMode
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 5
call sub.MFC42.DLL_CString::CString_1
push str.Hotkey
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push 0x556608
push ecx
mov byte [esp + 0x3c], 7
call sub.MFC42.DLL_operator_3
mov eax, dword [eax]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x1c]
call fcn.00415612
push 0
push 0
mov ecx, 0x5566e0
call fcn.0042adc0
push 0
push 0
mov dword [0x5369f8], 1
call fcn.0042af50
mov ecx, dword [esi + 0x20]
add esp, 8
push 0
push 0
push 0
push 0
push ecx
push 0x40d970
call sub.MFC42.DLL_AfxBeginThread
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 6
call fcn.00415612
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 5
call fcn.00415612
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.00415612
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 3
call fcn.00415612
lea ecx, [esp + 0x24]
mov dword [esp + 0x30], ebp
call fcn.00415612
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret
Function at 0x40eda0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4e1e53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov eax, dword [edi + 4]
lea esi, [edi + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 1
push ecx
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [eax]
push 0x556570
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
setne bl
call fcn.00415612
test bl, bl
je 0x40ee03
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x54]
push 0
mov ecx, edi
call sub.MFC42.DLL_CString::GetBuffer
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CFile::CFile
mov ecx, edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00415612
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40eee0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4e1f62
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], 0x4f0518
mov dword [esp + 0x20], 9
call fcn.00423660
lea esi, [edi + 0xa4]
mov dword [esp + 0x14], esi
mov dword [esi], 0x4f0504
mov ebp, dword [esi + 4]
xor ebx, ebx
cmp ebp, ebx
mov byte [esp + 0x20], 0xa
je 0x40ef45
lea eax, [ebp + 8]
push 1
push eax
call fcn.0040f0d0
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x40ef33
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
call sub.MFC42.DLL_CPlex::FreeDataChain
lea ecx, [edi + 0xa0]
mov dword [esi + 0x14], ebx
mov dword [esi], 0x4ef2dc
mov byte [esp + 0x20], 7
call fcn.00415612
mov esi, dword [edi + 0x98]
cmp esi, ebx
je 0x40efcf
lea ecx, [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40efc9
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x40efc9
mov ecx, esi
mov byte [esp + 0x20], 0xc
call fcn.0040f100
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 4]
mov byte [esp + 0x20], 0xb
call sub.MFC42.DLL_CFile::CFile
mov ecx, esi
mov byte [esp + 0x20], 6
call fcn.00415612
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [edi + 0x98], ebx
lea esi, [edi + 0x8c]
mov dword [esp + 0x14], esi
lea ecx, [esi + 8]
mov byte [esp + 0x20], 0xd
call fcn.00415612
cmp esi, ebx
je 0x40efef
lea ebp, [esi + 4]
jmp 0x40eff1
xor ebp, ebp
mov esi, dword [ebp]
cmp esi, ebx
je 0x40f048
lea edx, [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40f045
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x40f045
mov ecx, esi
mov byte [esp + 0x20], 0xf
call fcn.0040f100
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 4]
mov byte [esp + 0x20], 0xe
call sub.MFC42.DLL_CFile::CFile
mov ecx, esi
mov byte [esp + 0x20], 5
call fcn.00415612
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp], ebx
lea esi, [edi + 0x48]
mov dword [esp + 0x14], esi
mov dword [esi], 0x4f0494
mov ecx, esi
mov byte [esp + 0x20], 0x11
call fcn.0041f020
lea ecx, [esi + 0x28]
mov byte [esp + 0x20], 0x10
call fcn.00415b16
mov ecx, esi
mov byte [esp + 0x20], 4
call fcn.00415b10
lea ecx, [edi + 0x44]
mov byte [esp + 0x20], 3
call fcn.00415612
lea ecx, [edi + 0x10]
mov byte [esp + 0x20], 2
call fcn.00415612
lea ecx, [edi + 0xc]
mov byte [esp + 0x20], 1
call fcn.00415612
lea ecx, [edi + 8]
mov byte [esp + 0x20], bl
call fcn.00415612
lea ecx, [edi + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.00415612
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x412a20
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4e2757
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov al, byte [0x5567e9]
push ebx
test al, al
push esi
mov dword [esp + 0x10], 0
mov ebx, 1
jne 0x412ae6
mov eax, dword [0x5567a0]
push str.oem.jdyou.com
push eax
mov ecx, 0x556798
call sub.MFC42.DLL_CStringArray::SetAtGrow
mov ecx, dword [0x5567a0]
push str.oem.jdyou.com
push ecx
mov ecx, 0x556798
call sub.MFC42.DLL_CStringArray::SetAtGrow
mov edx, dword [0x5567a0]
push str.oem.jdyou.com
push edx
mov ecx, 0x556798
call sub.MFC42.DLL_CStringArray::SetAtGrow
mov eax, dword [0x556788]
push str.220.162.238.229:8181
push eax
mov ecx, 0x556780
call sub.MFC42.DLL_CStringArray::SetAtGrow
mov ecx, dword [0x556788]
push str.220.162.238.230:8181
push ecx
mov ecx, 0x556780
call sub.MFC42.DLL_CStringArray::SetAtGrow
mov edx, dword [0x556788]
push str.58.22.105.205:8181
push edx
mov ecx, 0x556780
call sub.MFC42.DLL_CStringArray::SetAtGrow
mov eax, dword [0x5567a0]
mov byte [0x5567e9], bl
mov dword [0x5567ec], eax
push edi
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x412af5
mov esi, dword [edi]
test esi, esi
jge 0x412b27
push str.qmacrone.ini
push 0xffffffffffffffff
push str.LoginServer
push str.Login
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
test esi, esi
jge 0x412b21
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv dword [0x5567ec]
mov esi, edx
test edi, edi
je 0x412b27
mov dword [edi], esi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
mov al, byte [esp + 0x30]
mov dword [esp + 0x20], ebx
test al, al
mov eax, esi
pop edi
cdq
jne 0x412b52
idiv dword [0x5567ec]
mov ecx, dword [0x55679c]
lea edx, [ecx + edx*4]
push edx
jmp 0x412b61
idiv dword [0x5567ec]
mov eax, dword [0x556784]
lea ecx, [eax + edx*4]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator_1
push str.http:__SERVERNAME_
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push edx
push str.SERVERNAME
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::Replace
mov esi, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], bl
call fcn.00415612
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call fcn.00415612
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x413170
Capabilities:
Enumerate files on windows
Get file size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x268
lea ecx, [esp + 0x164]
push ebp
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
push str._s.log
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0xc]
xor esi, esi
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x30]
lea ecx, [esp + 0x170]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x41325c
mov edx, dword [esp + 0x12]
mov eax, dword [esp + 0xe]
mov ecx, dword [esp + 0xc]
and edx, 0xffff
push ebx
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x2c]
push str._04d_02d_02d
push edx
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0x14
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x20]
push ecx
lea ecx, [esp + 0x64]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcmp]
add esp, 0xc
test eax, eax
jne 0x41323e
lea edi, [esp + 0x60]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x68]
push edx
mov byte [esp + ecx + 0x60], al
call ebx
add esp, 4
cmp eax, esi
jl 0x41323e
lea esi, [eax + 1]
lea eax, [esp + 0x34]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4131f7
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
pop ebx
mov ecx, dword [esp + 0x12]
mov edx, dword [esp + 0xe]
mov eax, dword [esp + 0xc]
and ecx, 0xffff
push esi
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x280]
and eax, 0xffff
push edx
push eax
push ecx
lea edx, [esp + 0x184]
push str._s_04d_02d_02d_04d.log
push edx
call edi
add esp, 0x1c
lea eax, [esp + 0x170]
push 0
push 0
push 4
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4132c9
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x268
ret 4
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x268
ret 4
Function at 0x4132f0
Capabilities:
Create directory
Encode data using xor
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
mov ecx, dword [esp + 0xc]
push 0x4e27db
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], esp
sub esp, 0xcec
lea edx, [esp + 0x8ec]
push esi
push eax
push ecx
push 0x400
push edx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
mov esi, dword [esp + 0xd10]
add esp, 0x10
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x4133ef
mov al, byte [esi + 0x30]
test al, al
jne 0x4133e4
lea eax, [esp + 0x1c]
push 0
push eax
push 0x104
push str.logs
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4133d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4133d1
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
lea edx, [esp + 0x1c]
lea eax, [esp + 4]
push edx
push 0x535ef4
push eax
mov dword [esp + 0xd04], 0
call sub.MFC42.DLL_CString::Format_1
mov ecx, dword [esp + 0x10]
add esp, 0xc
push 0x10
push 0x535eec
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 4]
mov dword [esp + 0xcf8], 0xffffffff
call fcn.00415612
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
call fcn.00413170
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], 1
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x413490
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x12]
lea ecx, [esp + 0x8f0]
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x14]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x16]
push eax
mov eax, dword [esp + 0x16]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x138]
push str.__02d__02d__02d:_02d:_02d___s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x20
xor ecx, ecx
test eax, eax
jbe 0x41346c
mov dl, byte [esp + ecx + 0x120]
xor dl, 0x59
add dl, 0x25
mov byte [esp + ecx + 0x120], dl
inc ecx
cmp ecx, eax
jb 0x413453
lea ecx, [esp + 0x18]
push 0
push ecx
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0x12c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [esp + 0xcf0]
pop esi
mov dword fs:[0], ecx
add esp, 0xcf8
ret
Function at 0x413500
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
jmp 0x413519
mov esi, dword [ecx + 0x20]
mov ax, word [ecx + 0x20]
sub esi, 0x53a7321b
shr esi, 7
shl ax, 0x19
or esi, eax
xor esi, 0xa32b
cmp si, 0x32
ja 0x4135cb
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
and esi, 0xffff
and edx, 0xfe00
lea eax, [esi + 1]
mov esi, eax
shr esi, 0x10
or edx, esi
mov esi, dword [ebp - 8]
shl eax, 7
shl esi, 0x17
xor edx, 0xc600
or eax, esi
shr edx, 9
xor eax, 0xaa519580
or edx, eax
mov al, byte [ecx + 0x28]
add edx, 0x53a7321b
test al, al
mov dword [ecx + 0x20], edx
je 0x4135bb
rdtsc
mov dword [ebp - 8], eax
push 0x559fc0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 8]
push 0x559fc0
and eax, 0xfffe
mov dword [0x559fb8], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4135cb
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414500
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
jmp 0x41451d
mov eax, dword [esi + 0x18]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x414718
mov ebx, 0x7ffe0014
mov ecx, dword [0x7ffe0018]
mov eax, dword [0x7ffe001c]
cmp ecx, eax
je 0x414557
mov edx, dword [0x7ffe0018]
mov eax, dword [0x7ffe001c]
cmp edx, eax
jne 0x414548
mov eax, dword [0x7ffe0018]
mov ecx, dword [ebx]
push 0
push 0x3e8
push eax
push ecx
call fcn.00415f00
push 0
push 0x3e8
push edx
push eax
call fcn.00415f00
push 0
push 0xa
push edx
push eax
call fcn.00415f00
mov ecx, dword [esi + 0x14]
mov edi, eax
lea edx, [ecx + 0x65]
add ecx, 0xac58cde5
shl edx, 0x19
shr ecx, 7
or edx, ecx
xor edx, 0xc754a32b
sub edi, edx
cmp edi, 5
jae 0x4145ad
mov edi, 5
mov ecx, eax
xor eax, 0xc7ffffff
xor ecx, 0xff54a32b
shl ecx, 7
shr eax, 0x19
or ecx, eax
add ecx, 0x53a7321b
mov dword [esi + 0x14], ecx
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], edx
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor edx, 0xffffc7ff
mov ecx, esi
shr edx, 9
shl eax, 0x17
and edx, 0x7f
xor eax, 0xaa519580
or edx, eax
add edx, 0x53a7321b
mov dword [esi + 0x20], edx
call fcn.00413500
mov eax, dword [esi + 0xc]
mov cx, word [esi + 0xc]
sub eax, 0x53a7321b
shr eax, 7
shl cx, 0x19
or eax, ecx
xor eax, 0xa32b
cmp ax, 0xe10
ja 0x4146ee
mov ecx, eax
and ecx, 0xffff
cmp ecx, edi
jb 0x414687
rdtsc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], edx
rdtsc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
mov edx, ecx
sub edx, edi
and eax, 0xfe00
shr edx, 0x10
or edx, eax
mov eax, edi
shl eax, 0x19
sub eax, edi
xor edx, 0xc600
add eax, ecx
mov ecx, dword [ebp - 0x10]
shl eax, 7
shl ecx, 0x17
or eax, ecx
shr edx, 9
xor eax, 0xaa519580
or edx, eax
add edx, 0x53a7321b
mov dword [esi + 0xc], edx
jmp 0x4146d5
mov ecx, esi
call fcn.00413bb0
mov edx, dword [esi + 8]
mov ax, word [esi + 8]
sub edx, 0x53a7321b
shr edx, 7
shl ax, 0x19
or edx, eax
xor edx, 0xa32b
test dx, dx
jne 0x4146f5
mov eax, dword [esi + 0xc]
mov cx, word [esi + 0xc]
sub eax, 0x53a7321b
shr eax, 7
shl cx, 0x19
or eax, ecx
xor eax, 0xa32b
cmp ax, 0x14
jb 0x4146ee
cmp ax, 0xe10
ja 0x4146ee
mov edx, dword [esi + 0x18]
push 0x1388
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x414539
jmp 0x414718
mov dword [esi + 8], 0xfdf8d57e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push eax
push 0x535fd8
push esi
call fcn.004132f0
mov edi, dword [esi]
add esp, 0xc
mov ecx, esi
call dword [edi + 4]
push eax
mov ecx, esi
call dword [edi + 0x14]
jmp 0x414728
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4147f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov esi, ecx
jmp 0x414806
mov al, byte [esi + 0x31]
test al, al
jne 0x414812
pop edi
xor al, al
pop esi
ret
mov eax, dword [0x5567f0]
test eax, eax
je 0x41486d
mov eax, dword [0x5567f4]
test eax, eax
je 0x41486d
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x5567f0]
cmp eax, 0x493e0
jb 0x414881
mov eax, dword [0x5567f4]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
push ebx
setne bl
call edi
mov dword [0x5567f0], eax
mov ecx, dword [esi + 0x14]
mov dword [0x5567f4], ecx
jmp 0x414867
mov al, bl
pop ebx
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x5567f0], eax
mov edx, dword [esi + 0x14]
mov dword [0x5567f4], edx
pop edi
mov al, 1
pop esi
ret
Function at 0x415469
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4154c1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x556570
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4154b4
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4154c3
xor eax, eax
pop esi
leave
ret 4
Function at 0x418410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e2c48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x24], 0
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov edx, dword [esp + 0x30]
mov ecx, dword [edx - 8]
test ecx, ecx
mov dword [esp + 0xc], ecx
jne 0x418494
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
mov dword [esi], eax
mov dword [esi + 4], ecx
lea ecx, [esp + 0x30]
call fcn.00415612
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov edi, dword [esp + 0x10]
mov eax, edi
cdq
idiv ecx
mov ebx, eax
test ebx, ebx
jne 0x4184d5
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
mov dword [esi], edi
mov dword [esi + 4], edx
call fcn.00415612
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x34]
push ebp
mov ebp, dword [ecx + 8]
mov edx, dword [ecx]
mov esi, ebp
sub esi, edx
mov eax, esi
cdq
idiv ebx
mov dword [esp + 0x38], eax
mov eax, esi
cdq
idiv ebx
mov ebx, dword [esp + 0x38]
test edx, edx
je 0x4184fa
inc ebx
mov eax, dword [esp + 0x3c]
cmp eax, 1
jne 0x418532
cmp dword [esp + 0x10], ebx
jg 0x418530
mov eax, esi
mov esi, dword [ecx]
sub eax, edi
cdq
sub eax, edx
mov edx, 0
sar eax, 1
sets dl
dec edx
and eax, edx
add esi, eax
mov eax, esi
mov dword [ecx], esi
add eax, edi
cmp eax, ebp
jle 0x41852d
mov eax, ebp
mov dword [ecx + 8], eax
xor eax, eax
cmp dword [esp + 0x10], ebx
jl 0x41853f
or eax, 0x40000
jmp 0x418573
test eax, eax
jne 0x41855a
mov edx, dword [ecx]
mov esi, dword [ecx + 8]
add edx, edi
cmp edx, esi
jge 0x418553
mov dword [ecx + 8], edx
jmp 0x418573
mov eax, 0x40000
jmp 0x418573
cmp eax, 2
jne 0x418573
mov edx, dword [ecx + 8]
sub edx, edi
mov dword [ecx], edx
jns 0x418573
mov dword [ecx], 0
mov eax, 0x40002
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
push eax
push ecx
mov edx, dword [ebx - 8]
mov ebp, dword [esi]
push edx
push ebx
mov ecx, esi
call dword [ebp + 0x70]
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
mov dword [esi], edi
mov dword [esi + 4], eax
call fcn.00415612
mov ecx, dword [esp + 0x1c]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret