joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40537d
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ebp, [ebx + 0xc20]
push ebp
call fcn.00404eff
push 0x44e5d4
push ebp
call fcn.004337e1
push ebp
call fcn.00435c1f
add esp, 0xc
mov edi, 0x44c95c
mov esi, 0x46afb0
test eax, eax
jne 0x4053c1
push ebp
push str.CExtractManager::SetDirectory:_set_TEMP___s_
push edi
push esi
call fcn.00401ac3
add esp, 0x10
push str.image_
push ebp
call fcn.004337e1
push ebp
call fcn.00435c1f
add esp, 0xc
test eax, eax
jne 0x4053e9
push ebp
push str.CExtractManager::SetDirectory:_set_TEMP_image___s_
push edi
push esi
call fcn.00401ac3
add esp, 0x10
push 0x208
push 0
push ebp
call fcn.00432ab0
add esp, 0xc
push ebp
mov ecx, ebx
call fcn.00404eff
push ebp
push str.CExtractManager::SetDirectory:_TEMP___s_
push edi
push esi
call fcn.00401ac3
lea ebp, [ebx + 0x810]
push 0x104
push ebp
call fcn.0040383b
push 0x44e5d4
push ebp
call fcn.004337e1
push ebp
call fcn.00435c1f
add esp, 0x24
test eax, eax
jne 0x405447
push ebp
push str.CExtractManager::SetDirectory:_set_WIN___s_
push edi
push esi
call fcn.00401ac3
add esp, 0x10
push ebp
push str.CExtractManager::SetDirectory:_WIN___s_
push edi
push esi
call fcn.00401ac3
add esp, 0x10
push 0x104
lea ebp, [ebx + 0xa18]
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x44e5d4
push ebp
call fcn.004337e1
push ebp
call fcn.00435c1f
add esp, 0xc
test eax, eax
jne 0x405491
push ebp
push str.CExtractManager::SetDirectory:_set_SYS32___s_
push edi
push esi
call fcn.00401ac3
add esp, 0x10
push ebp
push str.CExtractManager::SetDirectory:_SYS32___s_
push edi
push esi
call fcn.00401ac3
lea ebp, [ebx + 0xe28]
push 0x104
push ebp
call fcn.0040383b
push str.Softcamp
push ebp
call fcn.004337e1
push ebp
call fcn.00435c1f
add esp, 0x24
test eax, eax
jne 0x4054d7
push ebp
push str.CExtractManager::SetDirectory:_set_SDS___s_
push edi
push esi
call fcn.00401ac3
add esp, 0x10
push str._sds_
push ebp
call fcn.004337e1
push ebp
call fcn.00435c1f
add esp, 0xc
test eax, eax
jne 0x4054ff
push ebp
push str.CExtractManager::SetDirectory:_set_SDS___s_
push edi
push esi
call fcn.00401ac3
add esp, 0x10
push ebp
push str.CExtractManager::SetDirectory:_SDS___s_
push edi
push esi
call fcn.00401ac3
add esp, 0x10
lea ebp, [ebx + 0x1030]
push ebp
mov ecx, ebx
call fcn.004045d0
push ebp
push str.CExtractManager::SetDirectory:_CUR___s_
push edi
push esi
call fcn.00401ac3
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4063ce
Capabilities:
Check if file exists
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, 0x80
cmp eax, 1
jne 0x4063fb
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push esi
push 2
push ebx
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40643c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateSomFile:_CreateError__FileName:__s___x_
push 0x44c95c
push 0x46b010
call fcn.00401ac3
add esp, 0x14
xor eax, eax
jmp 0x406552
mov edi, dword [ebp + 0x14]
lea eax, [edi + 0x10]
push eax
call fcn.00414758
mov esi, eax
lea eax, [edi + 0x10]
push eax
push ebx
push esi
mov dword [ebp + 0x14], esi
call fcn.00432ab0
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004356f9
add esp, 0x1c
test eax, eax
je 0x406476
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406435
push dword [ebp + 8]
push edi
push 1
push esi
call fcn.00435a1e
add esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push 0xa
push str.SCDSSS02
push dword [ebp - 4]
mov byte [esi + edi], bl
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
test eax, eax
jne 0x4064bf
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_HEADER_FileName:__s_
push 0x44c95c
push 0x46b010
call fcn.00401ac3
add esp, 0x10
jmp 0x40646b
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
push dword [ebp + 0x18]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4064dc
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_HEADER_SIZE_FileName:__s_
jmp 0x4064ab
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
push dword [ebp + 0x1c]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4064f9
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_Key_FileName:__s_
jmp 0x4064ab
push ebx
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x406515
push dword [ebp + 0xc]
push str.CreateSomFile:_WriteError_Data_FileName:__s_
jmp 0x4064ab
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x14]
call fcn.0041474d
mov eax, dword [ebp - 0xc]
push dword [ebp + 0xc]
add eax, 4
push eax
call fcn.0043380f
push dword [ebp + 0xc]
push str.CreateSomFile:_Success__FileName:__s_
push 0x44c95c
push 0x46b010
call fcn.00401ac3
xor eax, eax
add esp, 0x1c
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x407ce6
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x208
lea eax, [esi + 0x210]
push 0
push eax
mov dword [ebp - 0x430], eax
call fcn.00432ab0
mov edi, dword [esi]
add esp, 0xc
test edi, edi
je 0x407dbd
and dword [ebp - 0x42c], 0
push 0x424
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.00432ab0
add esp, 0xc
push edi
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x407dbd
lea eax, [ebp - 0x42c]
push eax
push edi
mov dword [ebp - 0x42c], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x407db6
add esi, 8
lea eax, [ebp - 0x40c]
push eax
push esi
call fcn.004334a7
pop ecx
pop ecx
test eax, eax
je 0x407d94
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x407d6e
jmp 0x407db6
lea eax, [ebp - 0x20c]
push eax
call fcn.00432e80
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x430]
call fcn.00435f9d
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00432994
leave
ret 4

Function at 0x4080ad
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
push esi
push edi
mov edi, ecx
call fcn.00407e16
xor esi, esi
push 0x228
lea eax, [ebp - 0x78]
push esi
push eax
mov dword [ebp - 0x7c], esi
call fcn.00432ab0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
jne 0x4080fc
xor eax, eax
jmp 0x408171
lea ecx, [ebp - 0x7c]
push ecx
push eax
mov dword [ebp - 0x7c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x408166
push ebx
lea ebx, [edi + 4]
push 0x418
call fcn.0041471e
pop ecx
mov esi, eax
push esi
mov ecx, ebx
call fcn.00408006
mov eax, dword [ebp - 0x74]
mov dword [esi], eax
mov eax, dword [ebp - 0x68]
mov dword [esi + 4], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [esi + 8]
push 0x44fa34
push eax
call fcn.0043370a
add esp, 0xc
push esi
mov ecx, edi
call fcn.00407ce6
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x408115
xor esi, esi
inc esi
pop ebx
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp + 0x1b0]
pop edi
xor ecx, ebp
pop esi
call fcn.00432994
add ebp, 0x1b4
leave
ret
Function at 0x409924
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 4], esi
mov edi, 0x20019
call fcn.004098eb
cmp eax, 1
jne 0x409943
mov edi, 0x20219
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409981
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], esi
je 0x40997c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x409991
cmp dword [ebp - 4], esi
je 0x40998f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40cc09
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x2a4
mov eax, 0x44946b
call fcn.00432a0c
xor esi, esi
push esi
mov ebx, ecx
call fcn.0041defb
push 1
mov ecx, ebx
call fcn.0041a0b5
push 0x43
push esi
push esi
push esi
push esi
push 0x46d238
mov ecx, ebx
call fcn.0041e186
mov ecx, ebx
call fcn.0040c825
cmp eax, 0xffffffc3
je 0x40cd9d
cmp eax, 0xffffffcc
je 0x40cd91
push 0x46a6a0
lea ecx, [ebp - 0x2c]
call fcn.004069b4
push str.DSSomOath.ini
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.0040caf1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40cc7f
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, 0x44c95c
mov esi, 0x46b550
test eax, eax
je 0x40cd02
push 0
mov ecx, ebx
call fcn.0041defb
push str.SOMAuth::ExcuteSOM_DSSomOath.ini_exist
push edi
push esi
call fcn.00401ac3
add esp, 0xc
push 0
lea ecx, [ebp - 0x2b0]
call fcn.0040e542
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 1
jae 0x40ccc9
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0040e51d
lea ecx, [ebp - 0x2b0]
call fcn.00417d0b
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40ccec
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0
call fcn.004175c8
call fcn.00420d5e
mov ecx, dword [eax + 4]
call fcn.0040b793
push str.CSOMAuthorizeDlg::OnAuthOk_PreExcuteSOM
push edi
push esi
call fcn.00401ac3
mov ecx, dword [ebx + 0xc0]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0xc]
test eax, eax
je 0x40cd7c
push str.CSOMAuthorizeDlg::OnAuthOk_ExcuteSOM
push edi
push esi
call fcn.00401ac3
mov ecx, dword [ebx + 0xc0]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0x10]
test eax, eax
jne 0x40cd63
mov ecx, ebx
call fcn.004176bf
push str.SOMAuth::ExcuteSOM_Error____
push edi
push esi
call fcn.00401ac3
add esp, 0xc
jmp 0x40cd83
mov ecx, 0x46b070
call fcn.004090f5
push 0x4524c0
push edi
push esi
call fcn.00401ac3
add esp, 0xc
mov ecx, ebx
call fcn.004176bf
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401bc6
jmp 0x40cd9d
call fcn.0040e7bf
mov ecx, ebx
call fcn.004176bf
call fcn.00432a8f
ret
Function at 0x40d648
Capabilities:
Create process on windows

Disassembly:
push 0x54
mov eax, 0x449573
call fcn.004329a3
mov edi, ecx
push 0x44
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00432ab0
push 0x10
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00432ab0
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x60], 0x44
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40d6e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess:_CreateProcess_Error____Code:_d_
push 0x44c95c
push 0x46b610
call fcn.00401ac3
add esp, 0x10
push str.SOMER011
lea eax, [ebp + 8]
push eax
mov ecx, 0x46b8a0
call fcn.004108e0
push eax
lea ecx, [edi + 0x804]
mov dword [ebp - 4], esi
call fcn.0040317b
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004026b1
xor eax, eax
jmp 0x40d6e8
xor eax, eax
inc eax
call fcn.00432a7b
ret 4

Function at 0x40e7bf
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x81c
lea ebp, [esp - 4]
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp + 0x81c], eax
push 0x54
mov eax, 0x449742
call fcn.004329a3
push 0x44
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00432ab0
push 0x10
lea eax, [ebp - 0x1c]
push esi
push eax
mov dword [ebp - 0x60], 0x44
call fcn.00432ab0
add esp, 0x18
push 0x104
lea eax, [ebp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x46a6a0
lea ecx, [ebp]
call fcn.004069b4
push str.SomDeletor.exe
lea ecx, [ebp]
mov dword [ebp - 4], esi
call fcn.0040caf1
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.0040caf1
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x40e84c
lea eax, [ebp + 4]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40e86d
push str.SOMUtil::SelfDeleteByProcess___CreateProcess_Error___
jmp 0x40e872
push str.SOMUtil::SelfDeleteByProcess___CreateProcess_Success___
push 0x44d1c8
push 0x46b6d0
call fcn.00403970
add esp, 0xc
push esi
push 1
lea ecx, [ebp]
call fcn.00401bc6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x81c]
xor ecx, ebp
call fcn.00432994
add ebp, 0x820
leave
ret
Function at 0x40e8c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
push edi
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x40e8e8
pop edi
pop esi
add esp, 0xc
ret
push ebx
push esi
call fcn.00414758
mov ecx, dword [esp + 0x10]
add esp, 4
mov ebx, eax
push ebx
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40e937
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x44e5d4
push ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call sub.VERSION.dll_VerQueryValueW
push ebx
test eax, eax
jne 0x40e940
call fcn.0041474d
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x24]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
call fcn.0041474d
add esp, 4
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x40f160
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov dword [esp + 4], 0
mov esi, 0x20019
call fcn.0040f120
cmp eax, 1
jne 0x40f17e
mov esi, 0x20219
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push esi
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x40f1ce
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 4]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
test eax, eax
je 0x40f1c7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret
mov eax, dword [esp]
test eax, eax
je 0x40f1dc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
Function at 0x40fe80
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x40ff89
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SFC_SKEY_SecretKey_New
push eax
call edi
mov ecx, dword [esi]
push str.SFC_SKEY_SecretKey_Free
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi]
push str.SFC_SKEY_SecretKey_FromBinary
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi]
push str.SFC_CIPHER_CTX_New
push eax
call edi
mov ecx, dword [esi]
push str.SFC_CIPHER_CTX_Free
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi]
push str.SFC_Cipher_Encrypt_Init
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi]
push str.SFC_Cipher_Encrypt_Update
push eax
call edi
mov ecx, dword [esi]
push str.SFC_Cipher_Encrypt_Final
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi]
push str.SFC_Cipher_Decrypt_Init
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi]
push str.SFC_Cipher_Decrypt_Update
push eax
call edi
mov ecx, dword [esi]
push str.SFC_Cipher_Decrypt_Final
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi]
push str.SFC_GetRandom
push edx
mov dword [esi + 0x2c], eax
call edi
cmp dword [esi + 4], 0
mov dword [esi + 0x30], eax
pop edi
je 0x40ff89
cmp dword [esi + 8], 0
je 0x40ff89
cmp dword [esi + 0xc], 0
je 0x40ff89
cmp dword [esi + 0x10], 0
je 0x40ff89
cmp dword [esi + 0x14], 0
je 0x40ff89
cmp dword [esi + 0x18], 0
je 0x40ff89
cmp dword [esi + 0x1c], 0
je 0x40ff89
cmp dword [esi + 0x20], 0
je 0x40ff89
cmp dword [esi + 0x24], 0
je 0x40ff89
cmp dword [esi + 0x28], 0
je 0x40ff89
cmp dword [esi + 0x2c], 0
je 0x40ff89
test eax, eax
je 0x40ff89
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x4117a0
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, edi
mov esi, ecx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4117b0
mov ecx, dword [esi + 0x10]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x10]
push edi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, edi
mov dword [esi + 4], eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4117d7
sub ecx, edi
xor edx, edx
inc ecx
test eax, eax
sete dl
pop edi
mov dword [esi + 0xc], ecx
mov dword [esi + 8], 1
pop esi
mov eax, edx
ret 8
Function at 0x411800
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
mov eax, dword [0x467fd0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
mov ebx, dword [esp + 0x98]
push esi
push edi
mov edi, dword [esp + 0x9c]
push 0x80
lea eax, [esp + 0x18]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0x80
call fcn.00432ab0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
test eax, eax
jne 0x41188a
push ecx
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.00432130
add esp, 0xc
mov eax, 1
jmp 0x41188c
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00432994
add esp, 0x8c
ret 0xc

Function at 0x411ad0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40
mov eax, dword [0x467fd0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
mov ebx, dword [esp + 0x48]
push esi
mov esi, ecx
call fcn.00411a80
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x411bce
cmp dword [esi + 4], eax
jne 0x411b1c
mov ecx, esi
call fcn.00411a80
test eax, eax
jne 0x411b1c
mov eax, dword [esi + 0x14]
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00432994
add esp, 0x40
ret 4
xor eax, eax
push edi
mov edi, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
mov dword [esi + 8], edi
lea eax, [edi + 0x1d8]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411b48
mov dword [esi + 0x14], 0
test edi, edi
je 0x411bca
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 8]
movzx ecx, byte [eax + 0x199]
movzx edx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push edx
movzx edx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
push edx
movzx edx, byte [eax + 0x194]
push ecx
push edx
lea eax, [esp + 0x24]
push str._02X__02X__02X__02X__02X__02X
push eax
call fcn.00433c73
add esp, 0x20
lea ecx, [esp + 0xc]
push ecx
call edi
lea edx, [esp + 0xc]
push ebx
push edx
call 0x440d14
add esp, 8
test eax, eax
je 0x411be1
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov dword [esi + 8], ecx
test ecx, ecx
jne 0x411b60
mov eax, dword [esi + 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00432994
add esp, 0x40
ret 4
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00432994
add esp, 0x40
ret 4
Function at 0x412870
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret

Function at 0x412a10
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x28
mov eax, dword [0x467fd0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0x144]
push ebx
push ebp
sub edx, 6
push esi
xor ebp, ebp
xor ebx, ebx
push edi
mov dword [esp + 0x10], eax
test edx, edx
jle 0x412a47
mov esi, dword [esp + 0x40]
mov ecx, edx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
test edx, edx
jle 0x412a88
lea ecx, [ecx]
mov esi, dword [esp + 0x10]
cmp ebp, dword [esi + 0x144]
ja 0x412bb2
cmp eax, edx
jge 0x412a7a
cmp ebx, 4
jge 0x412a7d
mov edi, dword [esp + eax*4 + 0x14]
lea ecx, [ebx + ebp*4]
inc eax
inc ebx
cmp eax, edx
mov dword [esi + ecx*4 + 0x54], edi
jl 0x412a64
cmp ebx, 4
jne 0x412a82
inc ebp
xor ebx, ebx
cmp eax, edx
jl 0x412a50
jmp 0x412a8c
mov esi, dword [esp + 0x10]
cmp ebp, dword [esi + 0x144]
ja 0x412bb2
mov dword [esp + 0x10], 0x466838
movzx ecx, byte [esp + edx*4 + 0x11]
mov al, byte [esp + 0x14]
xor al, byte [ecx + str.cw]
mov byte [esp + 0x14], al
movzx ecx, byte [esp + edx*4 + 0x12]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x15], cl
movzx ecx, byte [esp + edx*4 + 0x13]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x16], cl
movzx ecx, byte [esp + edx*4 + 0x10]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x17], cl
mov ecx, dword [esp + 0x10]
xor al, byte [ecx]
add ecx, 4
mov byte [esp + 0x14], al
mov dword [esp + 0x10], ecx
mov eax, 1
cmp edx, 8
je 0x412b11
cmp edx, eax
jle 0x412b72
mov ecx, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, edx
jl 0x412b02
jmp 0x412b72
mov ecx, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, 4
jl 0x412b11
movzx eax, byte [esp + 0x20]
movzx ecx, byte [eax + str.cw]
movzx eax, byte [esp + 0x21]
xor byte [esp + 0x24], cl
movzx ecx, byte [eax + str.cw]
movzx eax, byte [esp + 0x22]
xor byte [esp + 0x25], cl
movzx ecx, byte [eax + str.cw]
movzx eax, byte [esp + 0x23]
xor byte [esp + 0x26], cl
movzx ecx, byte [eax + str.cw]
xor byte [esp + 0x27], cl
mov eax, 5
mov ecx, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, 8
jl 0x412b64
xor eax, eax
test edx, edx
jle 0x412ba6
cmp ebp, dword [esi + 0x144]
ja 0x412bb2
cmp eax, edx
jge 0x412b9a
cmp ebx, 4
jge 0x412b9d
mov edi, dword [esp + eax*4 + 0x14]
lea ecx, [ebx + ebp*4]
inc eax
inc ebx
cmp eax, edx
mov dword [esi + ecx*4 + 0x54], edi
jl 0x412b84
cmp ebx, 4
jne 0x412ba2
inc ebp
xor ebx, ebx
cmp eax, edx
jl 0x412b78
cmp ebp, dword [esi + 0x144]
jbe 0x412aa0
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00432994
add esp, 0x28
ret