joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c158
Capabilities:
Contain obfuscated stackstrings
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x4e22e4]
xor eax, esp
mov dword [esp + 0x150], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
call fcn.00454d5c
test eax, eax
je 0x49c18c
xor eax, eax
jmp 0x49c363
xor ebx, ebx
mov esi, str.Sound.c
cmp dword [0x5edf1c], ebx
jne 0x49c2be
cmp dword [0x5ee030], ebx
jne 0x49c2be
push 0x103
lea eax, [esp + 0x55]
push ebx
push eax
mov dword [esp + 0x20], 0x46464952
mov dword [esp + 0x24], 0x32
mov dword [esp + 0x28], 0x45564157
mov dword [esp + 0x2c], 0x20746d66
mov dword [esp + 0x30], 0x10
mov dword [esp + 0x34], 0x10001
mov dword [esp + 0x38], 0x5622
mov dword [esp + 0x3c], 0xac44
mov dword [esp + 0x40], 0x100002
mov dword [esp + 0x44], 0x61746164
mov dword [esp + 0x48], 0xe
mov dword [esp + 0x4c], 0xfe00fe01
mov dword [esp + 0x50], 0xff00
mov dword [esp + 0x54], 0xffff
mov word [esp + 0x58], 1
mov byte [esp + 0x5c], bl
call fcn.00401f80
add esp, 0xc
lea edi, [esp + 0x50]
mov dword [0x5ee030], 1
call fcn.0048cb93
test eax, eax
jne 0x49c25f
mov eax, edi
push str.TempDummySound.wav
push eax
call fcn.00401ba0
pop ecx
pop ecx
push 0x52
push esi
mov edx, 0x4ae7a4
lea ecx, [esp + 0x58]
call fcn.0048d3dd
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x49c291
push edi
push 0x3a
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040257f
add esp, 0x10
mov ecx, edi
call fcn.0048fcf9
lea eax, [esp + 0x50]
push eax
call fcn.0049c158
pop ecx
test eax, eax
jne 0x49c2b8
lea eax, [esp + 0x50]
push str.SoundsNotifyWinIllegalKey.wav
push eax
call fcn.0045500f
push eax
call fcn.0049c158
add esp, 0xc
mov dword [0x5ee030], ebx
push 1
push 0x724
call fcn.00401a3a
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x49c185
cmp dword [0x5edf1c], ebx
jne 0x49c2e8
call fcn.00444328
mov dword [0x5edf1c], eax
mov ebx, dword [0x5edf1c]
push edi
call fcn.004442d7
cmp dword [0x5edf1c], 0
pop ecx
jne 0x49c30a
push edi
call fcn.00401a00
pop ecx
jmp 0x49c185
lea ebx, [edi + 0x564]
push esi
push ebx
call fcn.0048ac23
pop ecx
pop ecx
mov esi, str.A_Sound_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0048aaae
mov eax, 0xdac
mov ecx, ebx
call fcn.0048aa9b
mov eax, edi
call fcn.0049a987
mov edx, dword [esp + 0x10]
call fcn.00439c75
test eax, eax
jne 0x49c361
push dword [esp + 0x10]
mov ecx, edi
call fcn.0049bbc9
pop ecx
test eax, eax
jne 0x49c361
mov eax, edi
call fcn.0049b49a
jmp 0x49c185
mov eax, edi
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401317
mov esp, ebp
pop ebp
ret
Function at 0x49c7e1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4e22e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10c], eax
test esi, esi
jg 0x49c80a
mov esi, 0x200
push 1
push 0x1f0
call fcn.00401a3a
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x49c825
xor eax, eax
jmp 0x49c921
lea eax, [esi + 0xa]
push eax
push 1
call fcn.00401a3a
pop ecx
pop ecx
mov dword [edi], eax
test eax, eax
jne 0x49c841
push edi
call fcn.00401a00
pop ecx
jmp 0x49c81e
and dword [edi + 4], 0
and dword [edi + 0xc], 0
inc dword [0x5d8944]
mov eax, dword [0x5d8944]
push ebx
mov ebx, dword [0x5d8940]
mov dword [edi + 0x2c], eax
mov dword [edi + 8], esi
test ebx, ebx
jne 0x49c872
call fcn.00444328
mov ebx, eax
mov dword [0x5d8940], ebx
push edi
call fcn.004442d7
cmp dword [0x5d8940], 0
pop ecx
jne 0x49c898
push dword [edi]
call fcn.00401a00
push edi
call fcn.00401a00
pop ecx
pop ecx
xor eax, eax
jmp 0x49c920
lea ebx, [edi + 0x30]
push str.Message.c
push ebx
call fcn.0048ac23
pop ecx
pop ecx
mov esi, str.A_Message_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0048aaae
mov eax, 0x7d0
mov ecx, ebx
call fcn.0048aa9b
cmp dword [ebp - 0x10c], 0
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
je 0x49c917
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00401f80
push dword [ebp - 0x10c]
mov ecx, 0x104
lea eax, [ebp - 0x108]
call fcn.00438aa8
mov esi, eax
call fcn.00438922
mov eax, esi
push eax
push 0x16
lea eax, [edi + 0x14]
pop ecx
call fcn.00438aa8
add esp, 0x14
mov eax, edi
call fcn.0049c7be
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401317
leave
ret

Function at 0x49d350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x49d3c0
cmp byte [ebx], 0
je 0x49d3c0
mov eax, esi
call fcn.0049c94d
test eax, eax
je 0x49d3c0
mov eax, esi
call fcn.0049c7cb
test eax, eax
je 0x49d3c0
mov dword [esp + 0xc], 1
mov ecx, ebx
cmp dword [ebp + 8], edi
je 0x49d3c8
xor edx, edx
call fcn.0048ef71
test eax, eax
je 0x49d39b
mov dword [esp + 0xc], edi
push 0x4ad
mov edx, 0x4b1588
mov ecx, ebx
push str.Message.c
call fcn.0048d3dd
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x49d3d4
mov eax, esi
call fcn.0049c7be
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4b2
mov edx, 0x4b0634
jmp 0x49d3a7
cmp dword [esi + 4], edi
jle 0x49d422
cmp dword [ebp + 8], edi
je 0x49d3f1
cmp dword [esp + 0xc], edi
jne 0x49d3f1
push ebx
push 0xa
call fcn.00401858
pop ecx
xor edi, edi
pop ecx
inc edi
push ebx
push dword [esi + 4]
push 1
push dword [esi]
call fcn.0040257f
add edi, eax
add esp, 0x10
cmp edi, dword [esi + 4]
jge 0x49d422
mov eax, dword [esi]
call fcn.00438ae8
test eax, eax
jne 0x49d422
inc dword [0x5d8b48]
mov ecx, ebx
call fcn.0048fcf9
jmp 0x49d3b9
mov ecx, ebx
call fcn.0048fcf9
mov eax, esi
call fcn.0049c7be
xor eax, eax
inc eax
jmp 0x49d3c2
Function at 0x49d435
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x100000
mov edi, eax
mov dword [esp + 0x10], esi
call fcn.00439c75
test eax, eax
je 0x49d461
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
call fcn.0049c94d
test eax, eax
je 0x49d458
mov ecx, dword [ebp + 8]
xor edx, edx
call fcn.0048ef71
cmp eax, esi
jae 0x49d48a
mov dword [esp + 0x10], eax
test eax, eax
jg 0x49d48a
mov dword [esp + 0x10], 0x400
mov eax, edi
call fcn.0049c7cb
test eax, eax
je 0x49d458
mov ecx, dword [ebp + 8]
push 0x435
push str.Message.c
mov edx, 0x4b1d98
call fcn.0048d3dd
pop ecx
pop ecx
mov dword [esp + 0x14], eax
test eax, eax
jne 0x49d4bf
mov eax, edi
call fcn.0049c7be
jmp 0x49d458
mov ebx, dword [esp + 0x10]
lea eax, [ebx + 0x400]
push 1
push eax
call fcn.00401a3a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x49d4b6
push dword [esp + 0x14]
push ebx
jmp 0x49d52a
and dword [esp + 0xc], 0
test ebx, ebx
jle 0x49d522
mov eax, dword [edi + 0xc]
inc eax
cmp eax, dword [edi + 8]
jl 0x49d4fb
call fcn.0049c9d3
test eax, eax
je 0x49d540
mov eax, dword [edi + 0xc]
mov edx, dword [esp + 0xc]
mov dl, byte [edx + esi]
mov ecx, dword [edi]
mov byte [eax + ecx], dl
inc dword [edi + 0xc]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 4]
jle 0x49d518
mov dword [edi + 4], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x49d4e9
push dword [esp + 0x14]
push dword [esp + 0x14]
push 1
push esi
call fcn.00402244
mov ebx, eax
add esp, 0x10
test ebx, ebx
jg 0x49d4e0
xor ebx, ebx
inc ebx
jmp 0x49d542
xor ebx, ebx
mov ecx, dword [esp + 0x14]
call fcn.0048fcf9
mov eax, edi
call fcn.0049c7be
push esi
call fcn.00401a00
pop ecx
mov eax, ebx
jmp 0x49d45a
Function at 0x4a7a39
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4e22e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x110], bl
call fcn.00401f80
add esp, 0xc
mov edx, esi
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
call fcn.00439c75
test eax, eax
je 0x4a7a8c
xor eax, eax
jmp 0x4a7b50
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
mov edx, esi
call fcn.004994d4
pop ecx
test eax, eax
je 0x4a7a85
call fcn.0041a877
push ebx
push ebx
mov edi, eax
call fcn.0045531b
push eax
lea eax, [ebp - 0x110]
push str._sLUA.DAT
push eax
call fcn.00401954
add esp, 0x14
mov dword [ebp - 0x114], ebx
push 0x327
push str.UpdatePAULA2.c
mov edx, 0x4ae7a4
lea ecx, [ebp - 0x110]
call fcn.0048d3dd
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x4a7b21
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041a877
sub eax, edi
cmp eax, 0x157c
ja 0x4a7a85
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xf
jl 0x4a7ace
jmp 0x4a7a85
push esi
push 1
lea eax, [ebp - 0x118]
push 4
push eax
call fcn.0040257f
push esi
push 1
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.0040257f
add esp, 0x20
mov ecx, esi
call fcn.0048fcf9
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret

Function at 0x4a7b5f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4e22e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x110], bl
call fcn.00401f80
lea eax, [ebp - 0x118]
add esp, 0xc
push eax
lea ecx, [ebp - 0x124]
lea edx, [ebp - 0x110]
call fcn.004994d4
pop ecx
test eax, eax
jne 0x4a7bce
xor eax, eax
jmp 0x4a7ca9
call fcn.0041a877
push ebx
push ebx
mov dword [ebp - 0x128], eax
call fcn.0045531b
push eax
lea eax, [ebp - 0x110]
push str._sLUA.DAT
push eax
call fcn.00401954
add esp, 0x14
mov dword [ebp - 0x114], ebx
push 0x2e6
push str.UpdatePAULA2.c
mov edx, 0x4ae668
lea ecx, [ebp - 0x110]
call fcn.0048d3dd
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x4a7c5a
lea edi, [ebp - 0x110]
call fcn.0048e806
test eax, eax
je 0x4a7ca6
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041a877
sub eax, dword [ebp - 0x128]
cmp eax, 0x157c
ja 0x4a7ca6
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xf
jl 0x4a7bfb
jmp 0x4a7ca6
push esi
push 1
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.00402244
push esi
push 1
lea eax, [ebp - 0x120]
push 4
push eax
call fcn.00402244
add esp, 0x20
mov ecx, esi
call fcn.0048fcf9
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x120]
jne 0x4a7ca6
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x11c]
je 0x4a7bc7
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x16e4a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x16e4a860]
xor edx, dword [ebx*4 + 0x16e4ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x16e4a460]
add ecx, 4
xor edx, dword [eax*4 + 0x16e4b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x16e4a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x16e4ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x16e4a460]
add ecx, 4
xor eax, dword [edx*4 + 0x16e4b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x16e4a860]
xor edx, dword [ebx*4 + 0x16e4ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x16e4a460]
xor edx, dword [eax*4 + 0x16e4b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x16e4a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x16e4ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x16e4a460]
xor eax, dword [edx*4 + 0x16e4b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x16e4a860]
xor edx, dword [ebx*4 + 0x16e4ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x16e4a460]
xor edx, dword [eax*4 + 0x16e4b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x16e4a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x16e4ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x16e4a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x16e4b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x16e4a860]
xor edx, dword [ebx*4 + 0x16e4ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x16e4a460]
add ecx, 4
xor edx, dword [eax*4 + 0x16e4b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x16e4a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x16e4ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x16e4a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x16e4b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x16e4a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x16e4ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x16e4a460]
and eax, 0xff
xor edi, dword [eax*4 + 0x16e4b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x16e4a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x68a010
Capabilities:
Access peb ldr_data

Disassembly:
push esi
xor ecx, ecx
mov esi, dword fs:[ecx + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x20]
mov esi, dword [esi]
cmp word [edi + 0x18], cx
jne 0x68a01d
pop esi
ret

Function at 0x68a030
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor edx, edx
test edi, edi
je 0x68a0ea
cmp dword [ebp + 8], edx
je 0x68a0ea
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x68a0ea
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi], 0x4550
jne 0x68a0ea
mov ecx, dword [ecx + edi + 0x78]
add ecx, edi
cmp ecx, edi
je 0x68a0ea
mov eax, dword [ecx + 0x1c]
add eax, edi
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x24]
add eax, edi
push esi
mov esi, dword [ecx + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x18]
add esi, edi
test eax, eax
je 0x68a0f2
push ebx
nop
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
dec eax
add ecx, edi
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x68a0b8
test bl, bl
je 0x68a0b4
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x68a0b8
add ecx, 2
add edx, 2
test bl, bl
jne 0x68a098
xor ecx, ecx
jmp 0x68a0bd
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x68a0d4
add dword [ebp - 4], 2
add esi, 4
test eax, eax
jne 0x68a090
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
mov eax, dword [ebp - 8]
mov eax, dword [eax + edx*4]
pop ebx
add eax, edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, edx
mov esp, ebp
pop ebp
ret 4
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x408390
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xd54d26a4
mov al, 0x12
mov dword [ecx], eax
mov ebp, dword [eax]
stc
dec ebp
aad 0xb0
adc cl, byte [ecx - 0x6d774ff]
imul esp, ebp, 0x3c
ret
lea edx, [ebp + 0x18]
mov ecx, dword fs:[ebp + 0x6c]
fldcw word [ebx + 0x50]
jno 0x40832c
rol byte [ecx], 0
add bl, ch
loop 0x40832e
inc ebp
or byte [ebp - 0x72ad5bab], 0x4d
sbb byte [eax - 0x75], dl
jl 0x4083c0
lea ecx, [ebp + 0x18]
push eax
mov edi, dword [eax + edx - 0x73]
xchg edi, eax
add dword [ecx - 0x75], edx
mov word [edi], es
lea edx, [edi - 0x7374aeff]
pop es
push edx
push eax
push ecx
pop eax
invalid
adc eax, 0x409674
mov ebx, eax
adc dword [ecx], 0x18
cmp dword [edx], 1
in eax, dx
adc eax, 0x8768c033
add dword [eax], eax
dec dword [edx + 0x15ff5003]
push 0x830040c1
les ecx, [eax]
jno 0x4083f9
mov eax, edx
js 0x4083a9
inc eax
add byte [ebx], dh
test eax, 0x28b0b8a
mov ax, word [ebx + edx]
and eax, dword [ebx]
add dword [eax], eax
add byte [ebp - 0x26c88bf5], al
sti
test dword [ebx], ecx
je 0x408434
fsincos
or ecx, 0xffffffff
xor eax, eax
fst qword [ebp + 0x24]
dec ebx
stosb byte es:[edi], al
inc ebp
and byte [ebx + 0x49d1f7f3], cl
mov edi, eax
mov dword [edx], ecx
inc ecx
mov edx, ecx
shr ecx, 2
in eax, 0xa5
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x5eec1cfb]
pop ebx
mov dword [ecx], 0x61e500
mov esp, ebp
pop ebp
push ebx
mov dl, byte [ebp + 8]
sbb bl, 0x66
aad 0x1a
mov eax, dword [ebp + 0x1a]
test eax, eax
jg 0x408484
mov esi, dword [ebp + 0x20]
mov byte [esi], 0x30
inc esi
test edi, edi
jle 0x408489
jg 0x4084bb
inc esi
cmc
ror byte [eax], 0x28
and dword [esi + 0x4589c8bb], ebx
sbb al, 0x77
sar edi, 1
fidiv word [eax]
xor byte [esi], dl
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esi - 0xa]
mov ecx, edx
or edx, dword [ebp + 8]
add ecx, dword [esi - 0x76bff6fd]
ljmp 0x8967
dec eax
mov dword [di + 0x18], eax
mov cl, byte [ebx]
mov byte [esi - 1], cl
inc ebx
test eax, eax
jg 0x408484
push esi
test edi, edi
xchg ebp, eax
inc ebp
sbb byte [edi + 7], bh
dec ebp
adc al, 0x85
leave
out 0x21, eax
mov byte [esi], 0x89
inc esi
sbb byte [ebx], 0x8b
jne 0x4084cb
salc
add ecx, dword [eax - 0x7abc9cfa]
invalid
add al, 0xc6
push es
inc esi
mov eax, dword [ebp + 0x18]
push eax
or ecx, edx
leave
je 0x4084d4
dec esp
push cs
mov cl, byte [ebx + 1]
inc esi
inc ebx
test cl, cl
jne 0x4084c9
cmp dl, 0x30
je 0x408541
mov byte [esi], dl
inc esi
dec eax
inc ebp
sbb byte [ebx + edx*2 - 0x73], dh
dec ebp
sbb al, 0x8d
push ebp
cmp dword [ecx - 0x73], edx
dec ebp
mov dl, byte [edx + 0x51]
push 0
adc ebp, eax
cli
sti
invalid
mov byte [esi], 0x2b
add dword [esi], 0x6c64630
add dword [esi], 0x6c64630
xor byte [esi - 0x75], al
xchg esi, eax
and byte [ebx - 0xf1ddbb3], cl
mov edx, dword [esi + 0x244d8b20]
loop 0x408539
pop edi
mov dword [ecx], esi
pop esi
pop ebx
loope 0x408535
pop ebp
ret
Function at 0x4087e0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x44aaf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [0x45cbcc]
mov eax, 0x98eb62a3
imul ecx
add edx, ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
push esi
mov esi, dword [0x45cbd4]
push edi
mov edi, dword [0x45cbe8]
mov edx, ecx
imul edi, edi, 0x857ee
imul edx, edx, 0x898dd
sub edi, eax
add edi, edx
mov eax, 0x220de0d
imul esi
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x220de0d
imul ecx
sar edx, 0xd
mov ecx, edx
add edi, edx
mov edx, dword [0x45cbdc]
imul edx, edx, 0xa0576
shr ecx, 0x1f
add ecx, edi
add ecx, edx
mov eax, 0x331da7cd
imul esi
sar edx, 0x11
mov eax, edx
add ecx, edx
mov edx, dword [0x572f4c]
shr eax, 0x1f
add eax, ecx
mov ecx, 0x572f4c
mov dword [str._r_____r____], eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov ecx, dword [0x45cbd0]
mov esi, dword [0x45cbe8]
mov eax, 0x9a8b8787
imul esi, esi, 0x857ee
imul ecx
add edx, ecx
mov ecx, dword [0x45cbd8]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4d49d1e9
imul ecx
imul ecx, ecx, 0xf08ec
sar edx, 0x11
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x45cbdc]
mov eax, 0x220de0d
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cbc8]
sub edi, ecx
imul edx, edx, 0xa0576
mov dword [esp + 0x18], 0
mov eax, dword [0x45cbe4]
mov ecx, dword [esp + 0x20]
add edi, edx
sub edi, eax
lea eax, [esp + 0x24]
push eax
push ecx
sub edi, 0x69fe2
lea ecx, [esp + 0x14]
mov dword [0x45cbd0], edi
call fcn.00408550
mov ecx, dword [0x45cbcc]
mov edx, dword [0x45cbd0]
mov eax, dword [0x45cbe0]
mov esi, dword [0x45cbe4]
imul eax, eax, 0xd5e3b
lea edi, [edx + ecx]
mov edx, dword [0x45cbdc]
imul edi, edi, 0xd6486
imul edx, edx, 0x69fe2
add edi, eax
add edi, edx
mov eax, 0x220de0d
imul esi
sar edx, 0xd
mov ebx, edx
add edi, edx
mov eax, 0x662e995b
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
shr ebx, 0x1f
add eax, edx
add ebx, edi
sub ebx, eax
mov eax, 0x331da7cd
imul esi
mov esi, dword [esp + 0xc]
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
push esi
mov dword [0x45cbdc], ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
pop edi
pop esi
pop ebx
jg 0x4089d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41b4c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x45e540]
xor eax, esp
push ebp
push esi
push edi
mov edi, dword [esp + 0x12c]
mov ebp, ecx
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
mov dword [esp + 0x130], eax
mov eax, dword [ebp]
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41b5c2
lea ecx, [esp + 0xc]
call fcn.0041b3a0
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
jne 0x41b5c6
lea edx, [esp + 0x1c]
push edx
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x38]
push edx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x41b59e
jmp 0x41b560
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.0041b4c0
mov edi, eax
test edi, edi
jne 0x41b5ed
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x41b560
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41b5b5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41b5d1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0042fe7d
add esp, 0x11c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41b5fc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x41b5d3
Function at 0x41bae0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x41baf2
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8