joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413e20
Capabilities:
Hash data with crc32

Disassembly:
push 0x400
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
mov dword [0x814338], eax
jne 0x413e3a
or eax, 0xffffffff
ret
xor edx, edx
lea esp, [esp]
mov ecx, edx
shr ecx, 1
test dl, 1
je 0x413e4f
xor ecx, 0xedb88320
test cl, 1
je 0x413e5e
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x413e60
shr ecx, 1
test cl, 1
je 0x413e6f
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x413e71
shr ecx, 1
test cl, 1
je 0x413e80
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x413e82
shr ecx, 1
test cl, 1
je 0x413e91
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x413e93
shr ecx, 1
test cl, 1
je 0x413ea2
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x413ea4
shr ecx, 1
test cl, 1
je 0x413eb3
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x413eb5
shr ecx, 1
test cl, 1
je 0x413ec4
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x413ec6
shr ecx, 1
mov dword [eax + edx*4], ecx
add edx, 1
cmp edx, 0xff
jle 0x413e40
xor eax, eax
ret

Function at 0x413ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [0x814338]
test ebp, ebp
push edi
mov edi, dword [esp + 0xc]
jne 0x413f13
call fcn.00413e20
test eax, eax
je 0x413eff
pop edi
or eax, 0xffffffff
pop ebp
ret
mov ebp, dword [0x814338]
test ebp, ebp
mov dword [0x5efb7c], 0
je 0x413ef9
mov ecx, dword [esp + 0x10]
test ecx, ecx
push esi
mov esi, dword [esp + 0x18]
je 0x413f42
movzx edx, byte [edi]
mov eax, dword [esi]
xor edx, eax
and edx, 0xff
mov edx, dword [ebp + edx*4]
shr eax, 8
sub ecx, 1
xor eax, edx
add edi, 1
test ecx, ecx
mov dword [esi], eax
jne 0x413f20
mov eax, dword [esi]
pop esi
pop edi
pop ebp
ret
Function at 0x413f50
Capabilities:
Check os version

Disassembly:
sub esp, 0xa8
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0xa4], eax
push edi
mov edi, dword [esp + 0xb0]
push 0x3f
lea eax, [esp + 0x6d]
push 0
push eax
mov byte [esp + 0x74], 0
call sub.VCRUNTIME140.dll_memset
push 0x3f
lea ecx, [esp + 0x39]
push 0
push ecx
mov byte [esp + 0x40], 0
call sub.VCRUNTIME140.dll_memset
xor eax, eax
add esp, 0x18
mov byte [esp + 8], 0
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
mov dword [edi], eax
call fcn.00402060
test eax, eax
jne 0x413fe3
lea edx, [esp + 0x68]
push 0x40
push edx
call fcn.0041ac20
add esp, 8
neg eax
sbb eax, eax
neg eax
je 0x414009
lea eax, [esp + 0x68]
push 0x40
push eax
call fcn.0041a380
add esp, 8
test eax, eax
je 0x414009
lea ecx, [esp + 0x68]
push 0x40
push ecx
call fcn.0041a790
add esp, 8
test eax, eax
jne 0x414055
push esi
xor esi, esi
lea esp, [esp]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x414015
sub eax, edx
movzx edx, byte [esp + esi + 0x6c]
push edx
add eax, edi
push 0x5b1d70
push eax
call fcn.00410db0
add esi, 1
add esp, 0xc
cmp esi, 6
jl 0x414010
pop esi
pop edi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.0052bfb9
add esp, 0xa8
ret
push 0x40
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
lea ecx, [esp + 0x34]
push 0x40
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.004031d0
add esp, 0x14
test eax, eax
jne 0x4140ad
push eax
push 4
lea edx, [esp + 0x30]
push edi
push edx
call fcn.004026d0
add esp, 0x10
test eax, eax
je 0x4140f5
lea eax, [esp + 8]
push 0x40
push eax
call fcn.00402a20
add esp, 8
test eax, eax
jne 0x4140cf
lea ecx, [esp + 8]
push ecx
push 4
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
jmp 0x4140f2
cmp byte [esp + 0x28], 0
je 0x4140e5
lea edx, [esp + 0x28]
push edx
push 4
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
jmp 0x4140f2
push str.NoMacAddr
push 4
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
add esp, 0xc
mov ecx, dword [esp + 0xa8]
pop edi
xor ecx, esp
call fcn.0052bfb9
add esp, 0xa8
ret
Function at 0x415fd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x24]
cmp ebx, 0x10
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x28]
push edi
jae 0x416054
mov al, bl
mov cl, al
mov ch, cl
lea edx, [esp + 0x10]
push edx
push ebp
mov eax, ecx
shl eax, 0x10
mov ax, cx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call fcn.00416a00
add esp, 8
test ebx, ebx
jbe 0x41608b
lea edi, [esp + 0x10]
lea eax, [ebx + esi]
sub edi, esi
lea esp, [esp]
mov cl, byte [edi + eax - 1]
xor byte [eax - 1], cl
sub eax, 1
sub ebx, 1
test ebx, ebx
ja 0x416030
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x14
ret
jbe 0x41607d
lea edx, [ebx - 0x11]
mov eax, 0xaaaaaaab
mul edx
mov edi, edx
shr edi, 3
add edi, 1
push esi
push ebp
call fcn.00416a00
add esp, 8
add esi, 0xc
sub ebx, 0xc
sub edi, 1
jne 0x416068
lea eax, [ebx + esi - 0x10]
push eax
push ebp
call fcn.00416a00
add esp, 8
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052bfb9
add esp, 0x14
ret

Function at 0x4160a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x24]
cmp ebx, 0x10
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x24]
jae 0x416123
mov al, bl
mov cl, al
mov ch, cl
lea edx, [esp + 0xc]
push edx
push edi
mov eax, ecx
shl eax, 0x10
mov ax, cx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.00416a00
add esp, 8
test ebx, ebx
jbe 0x416166
lea edi, [esp + 0xc]
lea eax, [ebx + esi]
sub edi, esi
jmp 0x416100
mov cl, byte [edi + eax - 1]
xor byte [eax - 1], cl
sub eax, 1
sub ebx, 1
test ebx, ebx
ja 0x416100
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x14
ret
xor edx, edx
lea eax, [ebx - 4]
mov ecx, 0xc
div ecx
push ebp
mov ebp, edx
test ebp, ebp
jbe 0x416146
lea edx, [ebx + esi - 0x10]
push edx
push edi
call fcn.00416b50
add esp, 8
sub ebx, ebp
cmp ebx, 0x10
pop ebp
jb 0x416166
lea esp, [esp]
lea eax, [esi + ebx - 0x10]
push eax
push edi
call fcn.00416b50
sub ebx, 0xc
add esp, 8
cmp ebx, 0x10
jae 0x416150
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052bfb9
add esp, 0x14
ret

Function at 0x416570
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 2]
sub esi, eax
mov edi, 4
mov edi, edi
movzx edx, byte [esi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x416580
pop edi
pop esi
ret
Function at 0x4168c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x14
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
push edi
mov ebx, ebp
xor eax, eax
xor edi, edi
mov ecx, esi
sub ebx, esi
mov dl, byte [ebx + ecx]
mov byte [ecx], dl
mov byte [esp + edi + 0x10], dl
mov dl, byte [eax + ebp + 1]
mov byte [ecx + 1], dl
mov byte [esp + edi + 0x14], dl
mov dl, byte [eax + ebp + 2]
mov byte [ecx + 2], dl
mov byte [esp + edi + 0x18], dl
mov dl, byte [eax + ebp + 3]
mov byte [esp + edi + 0x1c], dl
mov byte [ecx + 3], dl
add edi, 1
add eax, 4
add ecx, 4
cmp edi, 4
jl 0x4168e4
cmp eax, 0xb0
jge 0x4169e9
mov edi, 0x5effd8
lea esp, [esp]
movzx edx, byte [esp + 0x17]
mov cl, byte [esp + 0x10]
xor cl, byte [edx + str.cw]
movzx edx, byte [esp + 0x1b]
movzx edx, byte [edx + str.cw]
xor byte [esp + 0x14], dl
movzx edx, byte [esp + 0x1f]
movzx edx, byte [edx + str.cw]
xor byte [esp + 0x18], dl
movzx edx, byte [esp + 0x13]
xor cl, byte [edi]
movzx edx, byte [edx + str.cw]
xor byte [esp + 0x1c], dl
mov byte [esp + 0x10], cl
add edi, 4
mov ecx, 1
lea ecx, [ecx]
movzx edx, byte [esp + ecx + 0xf]
xor byte [esp + ecx + 0x10], dl
movzx edx, byte [esp + ecx + 0x13]
xor byte [esp + ecx + 0x14], dl
movzx edx, byte [esp + ecx + 0x17]
xor byte [esp + ecx + 0x18], dl
movzx edx, byte [esp + ecx + 0x1b]
xor byte [esp + ecx + 0x1c], dl
add ecx, 1
cmp ecx, 4
jl 0x416980
xor ecx, ecx
mov edi, edi
movzx edx, byte [esp + ecx + 0x10]
mov byte [esi + eax], dl
movzx edx, byte [esp + ecx + 0x14]
mov byte [esi + eax + 1], dl
movzx edx, byte [esp + ecx + 0x18]
mov byte [esi + eax + 2], dl
movzx edx, byte [esp + ecx + 0x1c]
mov byte [esi + eax + 3], dl
add ecx, 1
add eax, 4
cmp ecx, 4
jl 0x4169b0
cmp eax, 0xb0
jl 0x416930
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052bfb9
add esp, 0x14
ret
Function at 0x416a00
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov eax, edi
call fcn.00416570
lea ebx, [edi + 1]
add ebp, 0x11
mov dword [esp + 0x10], 9
mov eax, ebx
mov ecx, 4
jmp 0x416a30
movzx edx, byte [eax - 1]
movzx edx, byte [edx + str.cw]
mov byte [eax - 1], dl
movzx edx, byte [eax]
movzx edx, byte [edx + str.cw]
mov byte [eax], dl
movzx edx, byte [eax + 1]
movzx edx, byte [edx + str.cw]
mov byte [eax + 1], dl
movzx edx, byte [eax + 2]
movzx edx, byte [edx + str.cw]
mov byte [eax + 2], dl
add eax, 4
sub ecx, 1
jne 0x416a30
xor esi, esi
mov ecx, edi
call fcn.004165b0
call fcn.00416630
mov eax, ebx
mov ecx, ebp
mov esi, 4
movzx edx, byte [ecx - 1]
xor byte [eax - 1], dl
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
sub esi, 1
jne 0x416a85
sub dword [esp + 0x10], 1
mov ebp, ecx
jne 0x416a24
mov eax, ebx
lea ecx, [esi + 4]
lea esp, [esp]
movzx edx, byte [eax - 1]
movzx edx, byte [edx + str.cw]
mov byte [eax - 1], dl
movzx edx, byte [eax]
movzx edx, byte [edx + str.cw]
mov byte [eax], dl
movzx edx, byte [eax + 1]
movzx edx, byte [edx + str.cw]
mov byte [eax + 1], dl
movzx edx, byte [eax + 2]
movzx edx, byte [edx + str.cw]
mov byte [eax + 2], dl
add eax, 4
sub ecx, 1
jne 0x416ac0
xor esi, esi
mov ecx, edi
call fcn.004165b0
mov ecx, dword [esp + 0x18]
mov eax, ebx
add ecx, 0xa1
mov esi, 4
jmp 0x416b20
movzx edx, byte [ecx - 1]
xor byte [eax - 1], dl
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
sub esi, 1
jne 0x416b20
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x416b50
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
add ecx, 0xa0
mov eax, edi
call fcn.00416570
lea ebx, [edi + 1]
mov eax, ebx
mov ecx, 4
jmp 0x416b80
movzx edx, byte [eax - 1]
movzx edx, byte [edx + 0x5efed8]
mov byte [eax - 1], dl
movzx edx, byte [eax]
movzx edx, byte [edx + 0x5efed8]
mov byte [eax], dl
movzx edx, byte [eax + 1]
movzx edx, byte [edx + 0x5efed8]
mov byte [eax + 1], dl
movzx edx, byte [eax + 2]
movzx edx, byte [edx + 0x5efed8]
mov byte [eax + 2], dl
add eax, 4
sub ecx, 1
jne 0x416b80
lea esi, [ecx + 0x10]
mov ecx, edi
call fcn.004165b0
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], 9
add ebp, 0x91
lea ebx, [ebx]
mov eax, ebx
mov ecx, ebp
mov esi, 4
lea esp, [esp]
movzx edx, byte [ecx - 1]
xor byte [eax - 1], dl
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
sub esi, 1
jne 0x416bf0
push edi
call fcn.00416740
add esp, 4
mov eax, ebx
lea ecx, [esi + 4]
jmp 0x416c30
movzx edx, byte [eax - 1]
movzx edx, byte [edx + 0x5efed8]
mov byte [eax - 1], dl
movzx edx, byte [eax]
movzx edx, byte [edx + 0x5efed8]
mov byte [eax], dl
movzx edx, byte [eax + 1]
movzx edx, byte [edx + 0x5efed8]
mov byte [eax + 1], dl
movzx edx, byte [eax + 2]
movzx edx, byte [edx + 0x5efed8]
mov byte [eax + 2], dl
add eax, 4
sub ecx, 1
jne 0x416c30
lea esi, [ecx + 0x10]
mov ecx, edi
call fcn.004165b0
mov eax, dword [esp + 0x10]
sub eax, 1
sub ebp, 0x10
test eax, eax
mov dword [esp + 0x10], eax
jg 0x416be0
mov esi, dword [esp + 0x18]
lea ecx, [esi + 2]
mov eax, edi
sub esi, edi
mov edi, 4
mov edi, edi
movzx edx, byte [esi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x416ca0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4175d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
mov ebx, dword [esp + 0xac]
push ebp
mov ebp, dword [esp + 0xb8]
push esi
push edi
mov edi, dword [esp + 0xb0]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x41763b
cmp dword [esp + 0x14], 5
jne 0x41763b
cmp dword [esp + 0x18], 0
jne 0x41763b
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..GlobalSNTNLUSB
jmp 0x41764f
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..SNTNLUSB
call fcn.00423620
mov esi, eax
cmp esi, 0xffffffff
jne 0x417661
mov ax, 0x1d03
jmp 0x4176bd
mov ecx, dword [esp + 0xbc]
mov edx, dword [esp + 0xb4]
mov eax, dword [esp + 0xac]
push 0
push ebp
push ecx
push ebx
push edx
push edi
push eax
push esi
call fcn.00423c40
test eax, eax
je 0x41768c
xor edi, edi
jmp 0x4176b4
call fcn.00423ee0
cmp eax, 6
jne 0x41769d
mov edi, 0x1d43
jmp 0x4176b4
call fcn.00423ee0
sub eax, 0x39
neg eax
sbb eax, eax
and eax, 0xffffffa0
add eax, 0x1d6d
movzx edi, ax
push esi
call fcn.00423aa0
mov ax, di
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052bfb9
add esp, 0x98
ret
Function at 0x4176e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push ebp
call fcn.00424030
mov ebx, dword [esp + 0x18]
add esp, 4
test ebx, ebx
je 0x4177f8
mov al, byte [ebp + 1]
and al, 0xf
cmp al, 0xf
je 0x41770d
pop esi
pop ebp
mov ax, 0x1d02
pop ebx
ret
push edi
push ebp
lea esi, [ebp + 8]
mov ecx, 0x40
mov edi, ebp
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.00416b50
add esp, 8
xor eax, eax
pop edi
jmp 0x417730
movzx ecx, byte [eax + ebp + 0x10]
movzx edx, byte [eax + ebp + 0x11]
xor byte [eax + ebp], cl
xor byte [eax + ebp + 1], dl
movzx ecx, byte [eax + ebp + 0x12]
movzx edx, byte [eax + ebp + 0x13]
xor byte [eax + ebp + 2], cl
xor byte [eax + ebp + 3], dl
add eax, 4
cmp eax, 0x10
jb 0x417730
lea esi, [ebp + 0x10]
push esi
push ebx
call fcn.00416b50
add esp, 8
mov eax, esi
mov ecx, 4
nop
movzx edx, byte [eax + 0x10]
xor byte [eax], dl
movzx edx, byte [eax + 0x11]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x12]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x13]
xor byte [eax + 3], dl
add eax, 4
sub ecx, 1
jne 0x417770
lea esi, [ebp + 0x20]
push esi
push ebx
call fcn.00416b50
add esp, 8
mov eax, esi
mov ecx, 4
jmp 0x4177b0
movzx edx, byte [eax + 0x10]
xor byte [eax], dl
movzx edx, byte [eax + 0x11]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x12]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x13]
xor byte [eax + 3], dl
add eax, 4
sub ecx, 1
jne 0x4177b0
lea eax, [ebp + 0x30]
push eax
push ebx
call fcn.00416b50
mov cl, byte [ebp + 6]
add esp, 8
cmp cl, byte [ebp + 0x3e]
jne case.0x417830.4
mov dl, byte [ebp + 7]
cmp dl, byte [ebp + 0x3f]
jne case.0x417830.4
movzx esi, byte [ebp + 1]
movzx ecx, byte [ebp + 4]
movzx eax, byte [ebp + 5]
movzx edx, byte [ebp + 3]
add ecx, esi
add eax, ecx
movzx ecx, byte [ebp + 2]
add eax, edx
movzx edx, byte [ebp]
add ecx, eax
xor ecx, edx
test cl, cl
je 0x417826
pop esi
pop ebp
mov ax, 0x1d0d
pop ebx
ret
mov eax, esi
and eax, 0xf
cmp eax, 7
ja case.default.0x417830
jmp dword [eax*4 + 0x417878]
pop esi
pop ebp
xor ax, ax
pop ebx
ret
pop esi
pop ebp
mov ax, 0x1d41
pop ebx
ret
pop esi
pop ebp
mov ax, 0x1d04
pop ebx
ret
pop esi
pop ebp
mov ax, 0x1d0a
pop ebx
ret
pop esi
pop ebp
mov ax, 0x1d15
pop ebx
ret
pop esi
pop ebp
mov ax, 0x1d42
pop ebx
ret
pop esi
pop ebp
mov ax, 0x1d3f
pop ebx
ret
pop esi
pop ebp
mov ax, 0x1dff
pop ebx
ret
Function at 0x41a4d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x41a55b
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 4]
push ecx
push 0x20019
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call esi
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x41a552
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.ServiceName
push ecx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a560
cmp dword [esp + 0x10], 1
jne 0x41a560
mov edx, dword [esp + 4]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
xor eax, eax
pop esi
add esp, 0x10
ret
or eax, 0xffffffff
pop esi
add esp, 0x10
ret

Function at 0x41a570
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x18], eax
push edi
mov edi, dword [esp + 0x24]
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.WS2_32.dll_bind
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41a5fd
push esi
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41a5fa
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0041a4d0
add esp, 8
pop esi
pop edi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x1c
ret
mov eax, esi
pop esi
mov ecx, dword [esp + 0x1c]
pop edi
xor ecx, esp
call fcn.0052bfb9
add esp, 0x1c
ret
Function at 0x41a610
Capabilities:
Check if file exists
Get disk information

Disassembly:
sub esp, 0x40c
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x418]
push ebx
push ebp
mov ebp, dword [esp + 0x428]
push esi
mov esi, dword [esp + 0x41c]
push edi
push 0x200
lea ecx, [esp + 0x1c]
push ecx
xor ebx, ebx
push esi
mov dword [esp + 0x20], eax
mov byte [esp + 0x1f], 0
mov dword [ebp], ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x41a6b6
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
jne 0x41a6ac
push str.Device_
lea edx, [esp + 0x1c]
push 0x200
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
push esi
lea eax, [esp + 0x28]
push 0x200
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
add esp, 0x18
lea ecx, [esp + 0x18]
push ecx
push esi
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x41a73f
call edi
mov ebx, eax
test ebx, ebx
jne 0x41a772
push str.._
lea edx, [esp + 0x21c]
push 0x200
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy_s
push esi
lea eax, [esp + 0x228]
push 0x200
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat_s
add esp, 0x18
push 0xffffffffffffffff
push 0
push 3
push 0
push 1
push 0
lea ecx, [esp + 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41a749
mov edx, dword [esp + 0x42c]
mov eax, dword [esp + 0x14]
push 0
push ebp
push edx
push eax
push 4
lea ecx, [esp + 0x438]
push ecx
push 0x170002
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41a736
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41a751
mov byte [esp + 0x13], 1
jmp 0x41a6b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp byte [esp + 0x13], 0
je 0x41a772
lea edx, [esp + 0x18]
push edx
push esi
push 7
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x41a772
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41a774
mov eax, ebx
mov ecx, dword [esp + 0x418]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052bfb9
add esp, 0x40c
ret
Function at 0x422180
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x60
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
mov esi, dword [esp + 0x70]
push edi
mov edi, dword [esp + 0x6c]
xor eax, eax
push 0x40
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 0x24], 0xc3d2e1f0
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x7c]
add esp, 0xc
push ecx
push edi
lea edx, [esp + 0x10]
push edx
call fcn.00422010
lea eax, [esp + 8]
push eax
push esi
call fcn.00422090
mov ecx, dword [esp + 0x64]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0052bfb9
add esp, 0x60
ret 0xc
Function at 0x422240
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x44
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x40], eax
cmp word [esp + 0x48], 4
push esi
mov esi, dword [esp + 0x50]
mov word [esi], 0
jbe 0x422274
xor al, al
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x44
ret 8
push str.SYSTEM.INI
call fcn.00405ef0
movzx eax, ax
add eax, 1
cmp eax, 0x10
jg 0x4222c0
mov al, 0x49
mov byte [esp + 4], 0x53
mov byte [esp + 5], 0x59
mov byte [esp + 6], 0x53
mov byte [esp + 7], 0x54
mov byte [esp + 8], 0x45
mov byte [esp + 9], 0x4d
mov byte [esp + 0xa], 0x2e
mov byte [esp + 0xb], al
mov byte [esp + 0xc], 0x4e
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0
push str.Sentinel
call fcn.00405ef0
movzx ecx, ax
add ecx, 1
cmp ecx, 0x10
jg 0x422302
mov cl, 0x65
mov al, 0x6e
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0
push str.port
call fcn.00405ef0
movzx edx, ax
add edx, 2
cmp edx, 0x10
jg 0x422330
mov byte [esp + 0x24], 0x70
mov byte [esp + 0x25], 0x6f
mov byte [esp + 0x26], 0x72
mov byte [esp + 0x27], 0x74
mov byte [esp + 0x28], 0
lea eax, [esp + 0x24]
push eax
call fcn.00405ef0
movzx eax, ax
cmp ax, 0x10
jae 0x422351
mov cl, byte [esp + 0x4c]
movzx edx, ax
add cl, 0x31
mov byte [esp + edx + 0x24], cl
lea eax, [esp + 4]
push eax
push 0x10
lea ecx, [esp + 0x3c]
push ecx
push 0x57a034
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4223d9
push 0x2c
lea ecx, [esp + 0x38]
push ecx
call fcn.00422210
movzx eax, ax
cmp ax, 0x10
jae 0x422393
movzx edx, ax
mov byte [esp + edx + 0x34], 0
cmp byte [esp + 0x34], 0x30
jne 0x4223cc
mov al, byte [esp + 0x35]
and al, 0xdf
cmp al, 0x58
jne 0x4223cc
push esi
lea ecx, [esp + 0x3a]
push ecx
call fcn.00406080
test al, al
jne 0x4223d9
mov word [esi], 0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x44
ret 8
push esi
lea edx, [esp + 0x38]
push edx
call fcn.00405f40
jmp 0x4223af
movzx eax, word [esi]
test ax, ax
je 0x4223b8
cmp ax, 0xffff
je 0x4223b8
mov ecx, dword [esp + 0x44]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0052bfb9
add esp, 0x44
ret 8