joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d2e0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x6c
mov dword [ebp - 0x4c], eax
lea eax, [eax + edx*4]
mov dword [ebp - 0x54], ecx
cmp dword [eax + 0x1c], 0
mov dword [ebp - 0x50], eax
jne 0x46d475
mov eax, dword [ebp - 0x4c]
cmp edx, 0xa
lea edi, [ebp - 0x44]
mov esi, 0x4952e0
mov ecx, 0xb
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax]
ja case.0x46d320.5
jmp dword [edx*4 + 0x49cfc4]
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
jmp 0x46d40b
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp + edx*4 - 0x44]
mov dword [esp], eax
call fcn.00433b08
jmp 0x46d413
mov eax, dword [esi + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00433b08
jmp 0x46d413
mov eax, dword [esi + 0xc]
lea edi, [eax + 1]
lea eax, [edi + edi + 1]
mov dword [esp], eax
call fcn.00417377
mov edx, eax
xor eax, eax
test edx, edx
jne 0x46d3b4
mov ebx, 7
jmp 0x46d475
cmp eax, edi
jge 0x46d3c4
mov byte [edx + eax*2], 0x3f
mov byte [edx + eax*2 + 1], 0x2c
inc eax
jmp 0x46d3b4
mov byte [edx + eax*2 - 1], 0
mov dword [esp + 0xc], edx
mov eax, dword [esi + 8]
mov dword [ebp - 0x58], edx
mov dword [esp + 8], eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp + ebx*4 - 0x44]
mov dword [esp], eax
call fcn.00433b08
mov edx, dword [ebp - 0x58]
mov edi, eax
mov dword [esp], edx
call fcn.00409a90
jmp 0x46d415
mov eax, dword [esi + 8]
mov dword [esp + 8], eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp + ebx*4 - 0x44]
mov dword [esp], eax
call fcn.00433b08
mov edi, eax
test edi, edi
je 0x46d3aa
mov eax, dword [ebp - 0x4c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edi
lea eax, [eax + ebx*4 + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.0046d028
mov dword [esp], edi
mov ebx, eax
call fcn.00409a90
test ebx, ebx
je 0x46d475
cmp dword [ebp + 8], 0
je 0x46d475
mov eax, dword [esi]
mov dword [esp], eax
call fcn.0042701d
mov dword [esp], 0x498aa0
mov dword [esp + 4], eax
call fcn.00433b08
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
mov eax, dword [eax + 0x1c]
mov dword [ecx], eax
mov dword [esp], eax
call fcn.00452944
add esp, 0x6c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x476aed
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x4c
mov eax, dword [eax + 0x14]
mov dword [esp], str.SELECT_1_FROM__Q.sqlite_master_WHERE_tbl_name_q_stat
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], eax
call fcn.00433b08
test eax, eax
je 0x476b7f
mov edi, eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [esp], eax
call fcn.0046d028
test eax, eax
jne 0x476b6f
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.0045a992
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.004500a8
test eax, eax
jne 0x476b6f
cmp esi, 0x64
sete byte [ebx + 0xe5]
mov dword [esp], edi
mov dword [ebp - 0x2c], eax
call fcn.00409a90
mov eax, dword [ebp - 0x2c]
jmp 0x476b84
mov eax, 7
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4868fc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, edx
sub esp, 0x2c
mov dword [esp + 4], 0x4a6507
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
je 0x486994
mov ebx, eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_rewind
lea eax, [esi + 1]
mov dword [esp], eax
sar eax, 0x1f
mov dword [esp + 4], eax
call fcn.004196dc
test eax, eax
je 0x486994
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebx
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll_fclose
cmp dword [ebp - 0x1c], 1
mov edx, dword [ebp - 0x20]
je 0x486998
mov dword [esp], edx
call fcn.00409a90
xor eax, eax
jmp 0x4869a4
test edi, edi
mov byte [edx + esi], 0
mov eax, edx
je 0x4869a4
mov dword [edi], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x487147
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
cmp dword [0x4ab460], 0
jne 0x48716a
mov dword [esp], str.HOME
call sub.msvcrt.dll_getenv
mov dword [0x4ab460], eax
mov ebx, dword [0x4ab460]
test ebx, ebx
jne 0x4871eb
mov dword [esp], str.HOMEDRIVE
call sub.msvcrt.dll_getenv
mov dword [esp], str.HOMEPATH
mov esi, eax
call sub.msvcrt.dll_getenv
test esi, esi
mov edi, eax
je 0x4871e1
test eax, eax
je 0x4871e1
mov eax, esi
call fcn.00486020
mov ecx, eax
mov eax, edi
call fcn.00486020
lea edx, [ecx + eax + 1]
mov dword [esp], edx
mov dword [ebp - 0x1c], edx
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [0x4ab460], eax
je 0x48721c
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], str._s_s
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00421a93
jmp 0x487216
mov dword [0x4ab460], 0x4a65d2
mov esi, dword [0x4ab460]
test esi, esi
je 0x487216
mov eax, esi
call fcn.00486020
lea ebx, [eax + 1]
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
test eax, eax
je 0x487211
mov edi, eax
mov ecx, ebx
rep movsb byte es:[edi], byte [esi]
mov dword [0x4ab460], eax
mov ebx, dword [0x4ab460]
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x48f780
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0048f7e0

Function at 0x48f7e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4ab840]
test esi, esi
jle 0x48f8cd
mov edi, dword [0x4ab844]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x48f814
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x48f8c6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x48f800
mov dword [esp], eax
mov ebx, eax
call fcn.00490100
test eax, eax
mov edi, eax
je 0x48f90a
lea ebx, [esi + esi*2]
mov esi, dword [0x4ab844]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00490230
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4ab844]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x48f8ea
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x48f8bf
sub eax, 0x40
and eax, 0xffffffbf
je 0x48f8bf
mov eax, dword [esp + 0x20]
add ebx, dword [0x4ab844]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x48f8d4
add dword [0x4ab840], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x48f81e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0048f780
mov eax, dword [0x4ab844]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0048f780
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0048f780
lea esi, [esi]
Function at 0x48fd70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4ab858
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4ab850]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x48fdc5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x48fdbe
test esi, esi
je 0x48fdbe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x48fda0
mov dword [esp], 0x4ab858
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407120
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4449e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [0x45681c]
mov eax, 0x49f9945f
imul ecx
mov ecx, dword [0x456824]
push esi
mov esi, dword [0x456838]
sar edx, 0xe
imul esi, esi, 0xe0dd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x302debc5
imul ecx
sar edx, 0xe
push edi
mov edi, edx
add esi, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x56cb8c]
sub edi, eax
mov ecx, 0x56cb8c
mov dword [str._r_____r____], edi
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x456820]
mov esi, dword [0x456818]
mov eax, 0x18008403
imul esi, esi, 0x398f
imul ecx
mov ecx, dword [0x45682c]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
mov edi, dword [0x456834]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x107f4
sub esi, ecx
mov ecx, dword [esp + 0x1c]
add esi, edx
lea eax, [esp + 0x20]
push eax
sub esi, edi
push ecx
sub esi, 0x1558c
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [0x456820], esi
call fcn.00406e90
mov ecx, dword [0x456820]
mov edx, dword [0x45682c]
imul edx, edx, 0x1558c
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub esi, eax
add esi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
add esi, edx
shr eax, 0x1f
add eax, esi
mov esi, dword [esp + 8]
push esi
mov dword [0x45682c], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
jg 0x4072b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40da00
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
mov ecx, dword [0x45681c]
push ebx
push esi
mov esi, dword [0x456838]
mov eax, 0x49f9945f
imul esi, esi, 0xe0dd
imul ecx
mov ecx, dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x302debc5
imul ecx
push edi
sar edx, 0xe
mov edi, edx
add esi, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
lea ecx, [esp + 0x14]
mov dword [str._r_____r____], edi
mov edi, dword [esp + 0x20]
push ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x40dc5e
mov ecx, dword [0x45681c]
mov ebx, dword [0x456838]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
push ebp
mov eax, 0x302debc5
imul ebx
mov ebp, ebx
imul ebp, ebp, 0xe0dd
sub ecx, ebp
sar edx, 0xe
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0xa8da
add eax, ecx
sub eax, dword [str._r_____r____]
add eax, 0xaaa7
push esi
mov dword [0x45681c], eax
call fcn.0043bdd2
add esp, 4
mov ebx, eax
push ebx
push esi
xor esi, esi
push esi
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40dc48
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
mov ebp, dword [0x456830]
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xf
imul ecx, ecx, 0x15410
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
sub ecx, eax
imul edx, edx, 0x398f
mov eax, dword [0x456818]
imul eax, eax, 0xa8da
add edx, ebp
add edx, ecx
lea ecx, [eax + edx - 0x1558c]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
push 0x4471f4
push ebx
mov dword [0x456824], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40dbed
mov ecx, dword [0x456828]
mov esi, dword [0x456818]
mov eax, 0x49f9945f
imul esi, esi, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x10]
sub esi, ecx
mov dword [0x456834], esi
mov ax, word [edx + 0x14]
mov word [esp + 0x14], ax
mov ecx, dword [0x456820]
mov edx, dword [0x45682c]
imul edx, edx, 0x1558c
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, edx
mov edx, dword [0x45681c]
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub esi, eax
add esi, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x45682c], eax
push ebx
call fcn.0043bdd7
mov ax, word [esp + 0x18]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
pop edi
pop esi
mov ax, bx
pop ebx
add esp, 0x10
ret
Function at 0x4174b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x458190]
mov edx, dword [esp + 0x11c]
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x128], eax
mov eax, dword [ebp]
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4175d2
lea ecx, [esp + 8]
call fcn.00417390
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x4175d6
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x417580
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.004174b0
mov edi, eax
test edi, edi
jne 0x4175fa
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x417542
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x417599
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x128]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4175b8
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.0042a141
add esp, 0x118
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x4175e1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
call fcn.0042a141
add esp, 0x118
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x417609
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
mov eax, edi
pop edi
pop esi
pop ebp
call fcn.0042a141
add esp, 0x118
ret 4
Function at 0x417ae0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x417af2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x41b4c0
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, 0x49f9945f
imul dword [0x45681c]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp], eax
push ebx
push ebp
mov ebp, dword [0x456824]
mov eax, 0x302debc5
imul ebp
mov ecx, dword [0x456830]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
push esi
mov esi, eax
mov eax, dword [esp + 0xc]
sub esi, eax
mov eax, 0x3e12562b
imul ebp
push edi
mov edi, dword [0x456838]
mov ebx, ecx
imul edi, edi, 0xe0dd
imul ebx, ebx, 0xa8da
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [esp + 0x18]
add esi, ebx
add esi, edi
cmp eax, 0x132b600
mov dword [str._r_____r____], esi
je 0x41b562
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x64
lea esp, [esp]
push 0x3e8
call edi
dec esi
jne 0x41b550
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ebp, dword [0x456834]
imul ecx, ecx, 0xdd7b
mov eax, 0x2ff8513b
imul ebp
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0x1558c
add eax, ecx
mov ecx, eax
mov eax, 0x47298a5
imul ebp
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x395bd985
imul dword [0x456820]
sar edx, 0xd
mov eax, ecx
add eax, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, eax
mov eax, dword [0x56a64c]
mov edx, eax
inc eax
test edx, edx
mov dword [0x456818], ecx
mov dword [0x56a64c], eax
jle 0x41b620
mov ecx, dword [0x45681c]
mov eax, 0x99b19d5b
imul ecx
add edx, ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x302debc5
imul dword [0x456838]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
sub eax, edi
pop edi
sub eax, esi
pop esi
lea ecx, [eax + ebx + 0xaaa7]
pop ebp
mov dword [0x45681c], ecx
mov eax, 1
pop ebx
pop ecx
ret
mov eax, 0x18008403
imul ecx, ecx, 0x398f
imul esi, esi, 0x107f4
imul dword [0x456820]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
sub ecx, eax
mov eax, 0x3e12562b
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add ecx, esi
sub ecx, ebp
sub ecx, 0x1558c
mov dword [0x456820], ecx
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0x41afa0
push 0
push 0
mov dword [0x56a36c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x45682c]
mov eax, 0x99b19d5b
imul ecx
mov edi, dword [0x456830]
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xf
imul ecx, ecx, 0x15410
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
sub ecx, eax
imul edx, edx, 0x398f
mov eax, dword [0x456818]
imul eax, eax, 0xa8da
add edx, edi
pop edi
pop esi
add edx, ecx
lea ecx, [eax + edx - 0x1558c]
pop ebp
mov dword [0x456824], ecx
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x41fe70
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
mov ebp, dword [0x456824]
mov eax, 0x302debc5
imul ebp
sar edx, 0xe
mov ebx, dword [0x45681c]
push esi
mov esi, dword [0x456838]
push edi
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x246e57b5
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov edx, esi
imul edx, edx, 0x1558c
mov eax, ebx
imul eax, eax, 0xd534
sub ecx, edx
add ecx, eax
mov eax, 0x61082f49
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, edi
cmp eax, 0x132b600
mov dword [0x456828], ecx
je 0x41ff42
mov eax, 0x49f9945f
imul esi, esi, 0xe0dd
imul ebx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
sub esi, ecx
add esi, edx
mov eax, 0x3e12562b
imul ebp
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [str._r_____r____], esi
mov esi, 0x64
push 0x3e8
call edi
dec esi
jne 0x41ff31
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov esi, dword [0x456820]
mov edx, dword [0x45682c]
imul edx, edx, 0x1558c
mov edi, esi
imul edi, edi, 0xdd7b
add edi, edx
mov eax, 0x47298a5
imul ebx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x8ed2
sub edi, eax
add edi, edx
mov eax, 0x3e12562b
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [0x45682c], eax
mov eax, dword [0x56a360]
test eax, eax
jne 0x42007b
mov esi, dword [0x456818]
mov eax, 0x49f9945f
imul esi, esi, 0xd534
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0x41e950
push 0
sub esi, ecx
push 0
mov dword [0x456834], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x45682c]
mov dword [0x56a350], eax
mov eax, 0x99b19d5b
imul ecx
mov edi, dword [0x456830]
add edx, ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xf
imul ecx, ecx, 0x15410
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456828]
sub ecx, eax
imul edx, edx, 0x398f
mov eax, dword [0x456818]
imul eax, eax, 0xa8da
add edx, edi
add edx, ecx
lea ecx, [eax + edx - 0x1558c]
mov dword [0x56a360], 1
mov dword [0x456824], ecx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret