joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c896
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x10
mov eax, 0x44b239
call fcn.00434843
xor eax, eax
push 0x7fe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00434950
add esp, 0xc
mov esi, 0x46caa0
push 0x44ea68
mov ecx, esi
call fcn.00403407
push eax
call fcn.00435593
push eax
mov dword [ebp - 0x1c], eax
call fcn.00435451
add esp, 0xc
mov ecx, esi
call fcn.00403407
push eax
push str.OnAuthOk:__Create__s
mov ebx, 0x44e95c
push ebx
mov edi, 0x46e908
push edi
call fcn.00401ae2
add esp, 0x10
cmp dword [ebp - 0x1c], 0
je 0x40c9cf
push 0x400
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00403407
push eax
call fcn.00410fb0
add esp, 0xc
mov ecx, esi
call fcn.00403407
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
call fcn.004107b0
push dword [ebp - 0x10]
mov esi, eax
lea eax, [ebp]
push eax
push str._File:_s_Version:__d
push ebx
push edi
call fcn.00401ae2
add esp, 0x1c
cmp esi, 1
jne 0x40c9cf
cmp dword [ebp - 0x10], 8
jne 0x40c9cf
push str.SOMWT001
lea eax, [ebp - 0x18]
mov esi, 0x46ee00
push eax
mov ecx, esi
call fcn.00412790
mov edi, eax
and dword [ebp - 4], 0
push str.SOMER025
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.00412790
push 0x10
push dword [edi]
push dword [eax]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004026da
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004026da
xor eax, eax
inc eax
jmp 0x40c9d1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00434834
add ebp, 0x804
leave
ret
Function at 0x40c9f4
Capabilities:
Delete file
Parse pe header
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
mov word [ebp - 0x78], ax
xor esi, esi
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.00434950
add esp, 0xc
mov edi, 0x46caa0
push 0x44ea68
mov ecx, edi
call fcn.00403407
push eax
call fcn.00435593
mov ebx, eax
push ebx
call fcn.00435451
add esp, 0xc
cmp ebx, esi
jne 0x40ca59
xor eax, eax
jmp 0x40cba4
push 0x400
lea eax, [ebp - 0x78]
push eax
mov ecx, edi
call fcn.00403407
push eax
call fcn.00410fb0
add esp, 0xc
mov ecx, edi
call fcn.00403407
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.winword.exe
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x40cab3
push str.excel.exe
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x40cab3
push str.powerpnt.exe
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x40ca52
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x7c], edi
cmp edi, 0xffffffff
je 0x40ca52
push esi
push esi
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp ebx, esi
jne 0x40cafa
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40ca52
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
jne 0x40cb1f
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x7c]
call esi
jmp 0x40ca52
mov eax, 0x5a4d
mov dword [ebp - 0x80], esi
cmp word [edi], ax
jne 0x40cb71
mov esi, dword [edi + 0x3c]
push 4
add esi, edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
jne 0x40cb48
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x40cb0c
cmp dword [esi], 0x4550
jne 0x40cb3f
xor ecx, ecx
mov eax, 0x20b
cmp ax, word [esi + 0x18]
sete cl
mov dword [ebp - 0x80], ecx
cmp ecx, 1
jne 0x40cb71
lea eax, [ebp - 0x78]
push eax
push str.Is64bitPEFile______64bit__File___s_
jmp 0x40cb7a
lea eax, [ebp - 0x78]
push eax
push str.Is64bitPEFile______32bit__File___s_
push 0x44e95c
push 0x46e908
call fcn.00401ae2
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x7c]
call esi
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434834
add ebp, 0x78c
leave
ret
Function at 0x40cbbc
Capabilities:
Create process on windows

Disassembly:
push 0x10
mov eax, 0x44b271
call fcn.00434843
mov edi, ecx
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push str.DSOHMAN
xor ebx, ebx
push ebx
call esi
test eax, eax
je 0x40cbee
push str.DSOHMAN64
push ebx
call esi
test eax, eax
jne 0x40ccd5
mov ecx, edi
call fcn.0040c9f4
cmp eax, 1
jne 0x40cc0f
cmp dword [0x46e3a0], 8
mov eax, dword [0x46e38c]
jae 0x40cc22
mov eax, 0x46e38c
jmp 0x40cc22
cmp dword [0x46e384], 8
mov eax, dword [0x46e370]
jae 0x40cc22
mov eax, 0x46e370
push ebx
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x40cca8
push eax
push str.ERROR_Excute_DSOHMAN_code__d_
push 0x44f1c8
push 0x46e908
call fcn.00403d65
add esp, 0x10
push str.SOMWT001
lea eax, [ebp - 0x14]
mov esi, 0x46ee00
push eax
mov ecx, esi
call fcn.00412790
mov edi, eax
push str.SOMER011
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00412790
mov edi, dword [edi]
mov eax, dword [eax]
push 0x10
push edi
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004026da
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004026da
push str.SOM_SYNC_EVENT
lea ecx, [ebp - 0x1c]
call fcn.004138c0
push 0x1f4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.00413880
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00413860
call fcn.0043491b
ret
Function at 0x40eade
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x2a4
mov eax, 0x44b4f8
call fcn.004348ac
xor esi, esi
push esi
mov ebx, ecx
call fcn.0042086a
push 1
mov ecx, ebx
call fcn.0041bfdd
push 0x43
push esi
push esi
push esi
push esi
push 0x470798
mov ecx, ebx
call fcn.00420af5
mov ecx, ebx
call fcn.0040e6ec
cmp eax, 0xffffffc3
je 0x40ec72
cmp eax, 0xffffffcc
je 0x40ec66
push 0x46d6c0
lea ecx, [ebp - 0x2c]
call fcn.00407b7c
push str.DSSomOath.ini
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.0040e9c6
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40eb54
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, 0x44e95c
mov esi, 0x46ea98
test eax, eax
je 0x40ebd7
push 0
mov ecx, ebx
call fcn.0042086a
push str.SOMAuth::ExcuteSOM_DSSomOath.ini_exist
push edi
push esi
call fcn.00401ae2
add esp, 0xc
push 0
lea ecx, [ebp - 0x2b0]
call fcn.0041038f
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 1
jae 0x40eb9e
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0041036a
lea ecx, [ebp - 0x2b0]
call fcn.00419b62
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40ebc1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0
call fcn.0041941f
call fcn.0041ff5c
mov ecx, dword [eax + 4]
call fcn.0040d484
push str.CSOMAuthorizeDlg::OnAuthOk_PreExcuteSOM
push edi
push esi
call fcn.00401ae2
mov ecx, dword [ebx + 0xc0]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0xc]
test eax, eax
je 0x40ec51
push str.CSOMAuthorizeDlg::OnAuthOk_ExcuteSOM
push edi
push esi
call fcn.00401ae2
mov ecx, dword [ebx + 0xc0]
mov eax, dword [ecx]
add esp, 0xc
call dword [eax + 0x10]
test eax, eax
jne 0x40ec38
mov ecx, ebx
call fcn.00419516
push str.SOMAuth::ExcuteSOM_Error____
push edi
push esi
call fcn.00401ae2
add esp, 0xc
jmp 0x40ec58
mov ecx, 0x46e5a0
call fcn.0040a6fe
push 0x454998
push edi
push esi
call fcn.00401ae2
add esp, 0xc
mov ecx, ebx
call fcn.00419516
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401bef
jmp 0x40ec72
call fcn.0041060c
mov ecx, ebx
call fcn.00419516
call fcn.0043492f
ret
Function at 0x40f4b1
Capabilities:
Create process on windows

Disassembly:
push 0x54
mov eax, 0x44b600
call fcn.00434843
mov edi, ecx
push 0x44
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00434950
push 0x10
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00434950
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x60], 0x44
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40f54e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess:_CreateProcess_Error____Code:_d_
push 0x44e95c
push 0x46eb58
call fcn.00401ae2
add esp, 0x10
push str.SOMER011
lea eax, [ebp + 8]
push eax
mov ecx, 0x46ee00
call fcn.00412790
push eax
lea ecx, [edi + 0x804]
mov dword [ebp - 4], esi
call fcn.00403185
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004026da
xor eax, eax
jmp 0x40f551
xor eax, eax
inc eax
call fcn.0043491b
ret 4

Function at 0x41060c
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x81c
lea ebp, [esp - 4]
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp + 0x81c], eax
push 0x54
mov eax, 0x44b7f2
call fcn.00434843
push 0x44
xor esi, esi
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00434950
push 0x10
lea eax, [ebp - 0x1c]
push esi
push eax
mov dword [ebp - 0x60], 0x44
call fcn.00434950
add esp, 0x18
push 0x104
lea eax, [ebp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x46d6c0
lea ecx, [ebp]
call fcn.00407b7c
push str.SomDeletor.exe
lea ecx, [ebp]
mov dword [ebp - 4], esi
call fcn.0040e9c6
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.0040e9c6
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x410699
lea eax, [ebp + 4]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4106ba
push str.SOMUtil::SelfDeleteByProcess___CreateProcess_Error___
jmp 0x4106bf
push str.SOMUtil::SelfDeleteByProcess___CreateProcess_Success___
push 0x44f1c8
push 0x46ec18
call fcn.00403d65
add esp, 0xc
push esi
push 1
lea ecx, [ebp]
call fcn.00401bef
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x81c]
xor ecx, ebp
call fcn.00434834
add ebp, 0x820
leave
ret
Function at 0x410700
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 8]
push eax
push edi
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x410728
pop edi
pop esi
add esp, 0xc
ret
push ebx
push esi
call fcn.00416608
mov ecx, dword [esp + 0x10]
add esp, 4
mov ebx, eax
push ebx
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x410777
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x45062c
push ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call sub.VERSION.dll_VerQueryValueW
push ebx
test eax, eax
jne 0x410780
call fcn.004165fd
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x24]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
call fcn.004165fd
add esp, 4
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x4110a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov dword [esp + 4], 0
mov esi, 0x20019
call fcn.00410f70
cmp eax, 1
jne 0x4110be
mov esi, 0x20219
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push esi
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x41110e
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 4]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
test eax, eax
je 0x411107
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret
mov eax, dword [esp]
test eax, eax
je 0x41111c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
Function at 0x4112a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x46aff0]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00434950
add esp, 0xc
mov edi, 0x104
lea ebx, [esp + 8]
call fcn.004111b0
mov eax, ebx
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4112e3
mov edx, dword [str.SDSMAN.EXE]
mov ecx, dword [0x455dd4]
mov dword [eax], edx
mov edx, dword [0x455dd8]
mov dword [eax + 4], ecx
mov ecx, dword [0x455ddc]
mov dword [eax + 8], edx
mov edx, dword [0x455de0]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x455de4]
mov dword [eax + 0x10], edx
lea edx, [esp + 8]
push 0
push edx
mov dword [eax + 0x14], ecx
call fcn.00438095
add esp, 8
cmp eax, 0xffffffff
jne 0x411351
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00434834
add esp, 0x20c
ret
lea ebx, [esp + 8]
call fcn.004111b0
mov edi, ebx
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x411360
push esi
lea eax, [esp + 0xc]
push 0
mov ecx, 7
mov esi, str.DSEDCO05.DLL
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00438095
add esp, 8
pop esi
cmp eax, 0xffffffff
je 0x411338
push 0x104
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4113a5
mov edx, dword [str.icoreg.sys]
mov ecx, dword [0x455da0]
mov dword [eax], edx
mov edx, dword [0x455da4]
mov dword [eax + 4], ecx
mov ecx, dword [0x455da8]
mov dword [eax + 8], edx
mov edx, dword [0x455dac]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x455db0]
mov dword [eax + 0x10], edx
lea edx, [esp + 8]
push 0
push edx
mov dword [eax + 0x14], ecx
call fcn.00438095
xor ecx, ecx
add esp, 8
cmp eax, 0xffffffff
setne cl
pop edi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00434834
add esp, 0x20c
ret
Function at 0x411e40
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x411fbb
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SFC_SKEY_SecretKey_New
push eax
call edi
mov ecx, dword [esi]
push str.SFC_SKEY_SecretKey_Free
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi]
push str.SFC_SKEY_SecretKey_FromBinary
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi]
push str.SFC_CIPHER_CTX_New
push eax
call edi
mov ecx, dword [esi]
push str.SFC_CIPHER_CTX_Free
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi]
push str.SFC_Cipher_Encrypt_Init
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi]
push str.SFC_Cipher_Encrypt_Update
push eax
call edi
mov ecx, dword [esi]
push str.SFC_Cipher_Encrypt_Final
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi]
push str.SFC_Cipher_Decrypt_Init
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi]
push str.SFC_Cipher_Decrypt_Update
push eax
call edi
mov ecx, dword [esi]
push str.SFC_Cipher_Decrypt_Final
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi]
push str.SFC_GetRandom
push edx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi]
push str.SFC_HASH_CTX_New
push eax
call edi
mov ecx, dword [esi]
push str.SFC_HASH_CTX_Free
push ecx
mov dword [esi + 0x34], eax
call edi
mov edx, dword [esi]
push str.SFC_Hash_Init
push edx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi]
push str.SFC_Hash_Update
push eax
call edi
mov dword [esi + 0x40], eax
mov ecx, dword [esi]
push str.SFC_Hash_Final
push ecx
call edi
mov edx, dword [esi]
push str.SFC_Hash
push edx
mov dword [esi + 0x44], eax
call edi
cmp dword [esi + 4], 0
mov dword [esi + 0x48], eax
pop edi
je 0x411fbb
cmp dword [esi + 8], 0
je 0x411fbb
cmp dword [esi + 0xc], 0
je 0x411fbb
cmp dword [esi + 0x10], 0
je 0x411fbb
cmp dword [esi + 0x14], 0
je 0x411fbb
cmp dword [esi + 0x18], 0
je 0x411fbb
cmp dword [esi + 0x1c], 0
je 0x411fbb
cmp dword [esi + 0x20], 0
je 0x411fbb
cmp dword [esi + 0x24], 0
je 0x411fbb
cmp dword [esi + 0x28], 0
je 0x411fbb
cmp dword [esi + 0x2c], 0
je 0x411fbb
cmp dword [esi + 0x30], 0
je 0x411fbb
cmp dword [esi + 0x34], 0
je 0x411fbb
cmp dword [esi + 0x38], 0
je 0x411fbb
cmp dword [esi + 0x3c], 0
je 0x411fbb
cmp dword [esi + 0x40], 0
je 0x411fbb
cmp dword [esi + 0x44], 0
je 0x411fbb
test eax, eax
je 0x411fbb
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4
Function at 0x413650
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, edi
mov esi, ecx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413660
mov ecx, dword [esi + 0x10]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x10]
push edi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, edi
mov dword [esi + 4], eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x413687
sub ecx, edi
xor edx, edx
inc ecx
test eax, eax
sete dl
pop edi
mov dword [esi + 0xc], ecx
mov dword [esi + 8], 1
pop esi
mov eax, edx
ret 8

Function at 0x4136b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
mov eax, dword [0x46aff0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
mov ebx, dword [esp + 0x98]
push esi
push edi
mov edi, dword [esp + 0x9c]
push 0x80
lea eax, [esp + 0x18]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0x80
call fcn.00434950
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
test eax, eax
jne 0x41373a
push ecx
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.00433fd0
add esp, 0xc
mov eax, 1
jmp 0x41373c
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00434834
add esp, 0x8c
ret 0xc
Function at 0x413980
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40
mov eax, dword [0x46aff0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
mov ebx, dword [esp + 0x48]
push esi
mov esi, ecx
call fcn.00413930
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x413a7e
cmp dword [esi + 4], eax
jne 0x4139cc
mov ecx, esi
call fcn.00413930
test eax, eax
jne 0x4139cc
mov eax, dword [esi + 0x14]
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00434834
add esp, 0x40
ret 4
xor eax, eax
push edi
mov edi, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
mov dword [esi + 8], edi
lea eax, [edi + 0x1d8]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4139f8
mov dword [esi + 0x14], 0
test edi, edi
je 0x413a7a
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 8]
movzx ecx, byte [eax + 0x199]
movzx edx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push edx
movzx edx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
push edx
movzx edx, byte [eax + 0x194]
push ecx
push edx
lea eax, [esp + 0x24]
push str._02X__02X__02X__02X__02X__02X
push eax
call fcn.00435b13
add esp, 0x20
lea ecx, [esp + 0xc]
push ecx
call edi
lea edx, [esp + 0xc]
push ebx
push edx
call fcn.00437bff
add esp, 8
test eax, eax
je 0x413a91
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov dword [esi + 8], ecx
test ecx, ecx
jne 0x413a10
mov eax, dword [esi + 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00434834
add esp, 0x40
ret 4
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00434834
add esp, 0x40
ret 4
Function at 0x414720
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret

Function at 0x4148c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x28
mov eax, dword [0x46aff0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0x144]
push ebx
push ebp
sub edx, 6
push esi
xor ebp, ebp
xor ebx, ebx
push edi
mov dword [esp + 0x10], eax
test edx, edx
jle 0x4148f7
mov esi, dword [esp + 0x40]
mov ecx, edx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
test edx, edx
jle 0x414938
lea ecx, [ecx]
mov esi, dword [esp + 0x10]
cmp ebp, dword [esi + 0x144]
ja 0x414a62
cmp eax, edx
jge 0x41492a
cmp ebx, 4
jge 0x41492d
mov edi, dword [esp + eax*4 + 0x14]
lea ecx, [ebx + ebp*4]
inc eax
inc ebx
cmp eax, edx
mov dword [esi + ecx*4 + 0x54], edi
jl 0x414914
cmp ebx, 4
jne 0x414932
inc ebp
xor ebx, ebx
cmp eax, edx
jl 0x414900
jmp 0x41493c
mov esi, dword [esp + 0x10]
cmp ebp, dword [esi + 0x144]
ja 0x414a62
mov dword [esp + 0x10], 0x469868
movzx ecx, byte [esp + edx*4 + 0x11]
mov al, byte [esp + 0x14]
xor al, byte [ecx + str.cw]
mov byte [esp + 0x14], al
movzx ecx, byte [esp + edx*4 + 0x12]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x15], cl
movzx ecx, byte [esp + edx*4 + 0x13]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x16], cl
movzx ecx, byte [esp + edx*4 + 0x10]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x17], cl
mov ecx, dword [esp + 0x10]
xor al, byte [ecx]
add ecx, 4
mov byte [esp + 0x14], al
mov dword [esp + 0x10], ecx
mov eax, 1
cmp edx, 8
je 0x4149c1
cmp edx, eax
jle 0x414a22
mov ecx, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, edx
jl 0x4149b2
jmp 0x414a22
mov ecx, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, 4
jl 0x4149c1
movzx eax, byte [esp + 0x20]
movzx ecx, byte [eax + str.cw]
movzx eax, byte [esp + 0x21]
xor byte [esp + 0x24], cl
movzx ecx, byte [eax + str.cw]
movzx eax, byte [esp + 0x22]
xor byte [esp + 0x25], cl
movzx ecx, byte [eax + str.cw]
movzx eax, byte [esp + 0x23]
xor byte [esp + 0x26], cl
movzx ecx, byte [eax + str.cw]
xor byte [esp + 0x27], cl
mov eax, 5
mov ecx, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, 8
jl 0x414a14
xor eax, eax
test edx, edx
jle 0x414a56
cmp ebp, dword [esi + 0x144]
ja 0x414a62
cmp eax, edx
jge 0x414a4a
cmp ebx, 4
jge 0x414a4d
mov edi, dword [esp + eax*4 + 0x14]
lea ecx, [ebx + ebp*4]
inc eax
inc ebx
cmp eax, edx
mov dword [esi + ecx*4 + 0x54], edi
jl 0x414a34
cmp ebx, 4
jne 0x414a52
inc ebp
xor ebx, ebx
cmp eax, edx
jl 0x414a28
cmp ebp, dword [esi + 0x144]
jbe 0x414950
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00434834
add esp, 0x28
ret