joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x4c2109
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [ebp + 4], eax
lea esi, [ebp + 8]
mov dword [esp + 0x18], 0
mov dword [esi], vtable.ClientListener.0
lea edi, [ebp + 0xc]
mov dword [edi], vtable.ClipboardListener.0
mov byte [esp + 0x18], 2
push 0x50
mov dword [ebp], vtable.UserInputServer.0
mov dword [esi], vtable.UserInputServer.1.0
mov dword [edi], vtable.UserInputServer.2.0
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x18], edx
call fcn.00480ed5
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x18], 3
test eax, eax
je 0x4170ab
mov ecx, dword [ebp + 0x18]
push 1
push edi
push eax
call fcn.00427990
jmp 0x4170ad
xor eax, eax
mov edi, dword [esp + 0x28]
mov byte [esp + 0x18], 2
mov dword [ebp + 0x10], eax
lea eax, [esp + 0x24]
push eax
add edi, 0x18
push edi
mov byte [esp + 0x2c], 0x1f
call fcn.00416700
lea ecx, [esp + 0x24]
push ecx
push edi
mov dword [eax], esi
mov byte [esp + 0x2c], 0x1e
call fcn.00416700
lea edx, [esp + 0x24]
push edx
push edi
mov dword [eax], esi
mov byte [esp + 0x2c], 0x20
call fcn.00416700
mov dword [eax], esi
lea eax, [esp + 0x24]
push eax
push edi
mov byte [esp + 0x2c], 0x22
call fcn.00416700
lea ecx, [esp + 0x24]
push ecx
push edi
mov dword [eax], esi
mov byte [esp + 0x2c], 0x23
call fcn.00416700
lea edx, [esp + 0x24]
push edx
push edi
mov dword [eax], esi
mov byte [esp + 0x2c], 0x24
call fcn.00416700
mov dword [eax], esi
lea eax, [esp + 0x24]
push eax
push edi
mov byte [esp + 0x2c], 0x25
call fcn.00416700
lea ecx, [esp + 0x24]
push ecx
push edi
mov dword [eax], esi
mov byte [esp + 0x2c], 0x26
call fcn.00416700
lea edx, [esp + 0x24]
push edx
push edi
mov dword [eax], esi
mov byte [esp + 0x2c], 0x27
call fcn.00416700
mov dword [eax], esi
lea eax, [esp + 0x24]
push eax
push edi
mov byte [esp + 0x2c], 0x28
call fcn.00416700
lea ecx, [esp + 0x24]
push ecx
push edi
mov dword [eax], esi
mov byte [esp + 0x2c], 0x21
call fcn.00416700
mov dword [eax], esi
mov eax, ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0xc
Function at 0x4175a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bbf58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00404990
mov ecx, dword [esp + 0x38]
xor edi, edi
mov dword [esp + 0x30], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call eax
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
lea eax, [esp + 0xc]
push eax
call edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], vtable.StringStorage.0
cmp eax, edi
je 0x417611
push eax
call fcn.00480e32
add esp, 4
mov eax, dword [esp + 0x10]
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call fcn.00480e32
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4

Function at 0x417680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bbf30
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x28]
call fcn.00404990
xor edi, edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], edi
call fcn.00404990
mov byte [esp + 0x4c], 1
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x2c]
push edx
call eax
mov eax, dword [esp + 0x54]
mov edx, dword [esi]
mov edx, dword [edx + 0x44]
push eax
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call edx
mov eax, dword [esp + 0x1c]
mov esi, vtable.StringStorage.0
mov dword [esp + 0xc], esi
cmp eax, edi
je 0x41770a
push eax
call fcn.00480e32
add esp, 4
mov eax, dword [esp + 0x10]
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call fcn.00480e32
mov eax, dword [esp + 0x3c]
add esp, 4
mov dword [esp + 0x28], esi
cmp eax, edi
je 0x417738
push eax
call fcn.00480e32
add esp, 4
mov ecx, dword [esp + 0x2c]
push ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call fcn.00480e32
add esp, 4
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
ret 4

Function at 0x4179e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b7cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x30]
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
push edi
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call edx
mov dword [esp + 0x28], 0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
lea edx, [esp + 0xc]
push edx
call eax
mov edx, dword [esi]
mov edx, dword [edx + 0x20]
push edi
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call edx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x418380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b8848
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x48]
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call edx
xor eax, eax
xor ebp, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
mov dword [esp + 0x20], vtable.FrameBuffer.0
mov dword [esp + 0x24], vtable.Dimension.0
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x5c], ebp
call fcn.00468610
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
push edx
push edi
lea ecx, [esp + 0x2c]
call fcn.00468040
mov ecx, dword [esp + 0x28]
cmp ecx, ebp
jle 0x418432
mov eax, dword [esp + 0x2c]
cmp eax, ebp
jg 0x418436
xor ecx, ecx
jmp 0x41843b
imul eax, ecx
mov ecx, eax
movzx eax, word [esp + 0x30]
imul eax, ecx
mov ecx, dword [esp + 0x5c]
cdq
and edx, 7
add eax, edx
mov ebx, eax
mov eax, dword [esp + 0x44]
push eax
add ecx, 0x1c
sar ebx, 3
push ecx
call fcn.00423530
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], vtable.FrameBuffer.0
cmp eax, ebp
je 0x418479
push eax
call fcn.00481b5a
add esp, 4
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x4c
ret 4
Function at 0x41a7e0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
sub esp, 0x60
push esi
push 0
mov edx, dword [ecx + 4]
push 0
push 0x4c8df0
push 0
push 0
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x556088
push 0x556074
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x41a830
lea eax, [esp + 0x20]
push eax
call fcn.00419ac0
push 0x56e788
lea ecx, [esp + 0x24]
push ecx
call fcn.004841dc
lea eax, [esp + 0xc]
push eax
push 2
lea edx, [esp + 0xc]
push esi
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x1388
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
add esp, 0x60
ret

Function at 0x41a890
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c20c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push ebx
push esi
push edi
mov eax, dword [0x57e030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
push 0
push edi
mov dword [ebp - 4], 0
call fcn.0041abd0
mov dword [ebp - 4], 0xffffffff
jmp 0x41a8e9
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0xf01ff
push 0x556074
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x41a922
lea ecx, [ebp - 0x94]
push ecx
call fcn.00419ac0
push 0x56e788
lea edx, [ebp - 0x94]
push edx
call fcn.004841dc
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
test eax, eax
jne 0x41a94b
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x54]
push eax
call fcn.00419ac0
push 0x56e788
lea ecx, [ebp - 0x54]
push ecx
call fcn.004841dc
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [edi + 4]
push 0xf01ff
push 0x556074
push edx
xor esi, esi
call ebx
test eax, eax
je 0x41a995
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
inc esi
cmp eax, 0xa
jg 0x41a9a9
mov ecx, dword [edi + 4]
push 0xf01ff
push 0x556074
push ecx
call ebx
test eax, eax
jne 0x41a967
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0xd4]
push edx
mov edi, 0x42e
call fcn.00419b30
push 0x56e788
lea eax, [ebp - 0xd4]
push eax
call fcn.004841dc
int3
Function at 0x41a9d0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c20a0
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
push ebx
push esi
push edi
mov eax, dword [0x57e030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push 0x14
push 0x556074
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
jne 0x41aa38
lea edx, [ebp - 0x144]
push edx
call fcn.00419ac0
push 0x56e788
lea eax, [ebp - 0x144]
push eax
call fcn.004841dc
lea ecx, [ebp - 0x18]
push ecx
push 0x24
lea edx, [ebp - 0x3c]
push edx
push 0
mov dword [ebp - 4], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push esi
call ebx
test eax, eax
jne 0x41aa75
lea eax, [ebp - 0x104]
push eax
call fcn.00419ac0
push 0x56e788
lea ecx, [ebp - 0x104]
push ecx
call fcn.004841dc
mov eax, dword [ebp - 0x38]
cmp eax, 4
je 0x41ab5a
cmp eax, 2
je 0x41ab5a
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x41aab6
lea edx, [ebp - 0x1c4]
push edx
call fcn.00419ac0
push 0x56e788
lea eax, [ebp - 0x1c4]
push eax
call fcn.004841dc
mov edi, 0xa
jmp 0x41aac0
lea ecx, [ebp - 0x18]
push ecx
push 0x24
lea edx, [ebp - 0x3c]
push edx
push 0
push esi
call ebx
test eax, eax
jne 0x41aaf0
lea eax, [ebp - 0x184]
push eax
call fcn.00419ac0
push 0x56e788
lea ecx, [ebp - 0x184]
push ecx
call fcn.004841dc
cmp dword [ebp - 0x38], 4
je 0x41ab3f
dec edi
test edi, edi
jle 0x41ab09
mov eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41aac0
push str._Exception_description_is_not_avaliable_
lea edx, [ebp - 0xc4]
push edx
call fcn.00419ba0
push 0x56e7c4
lea eax, [ebp - 0xc4]
push eax
mov dword [ebp - 0xc4], vtable.SCMClientException.0
mov dword [ebp - 0x84], 3
call fcn.004841dc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str._Exception_description_is_not_avaliable_
lea ecx, [ebp - 0x80]
push ecx
call fcn.00419ba0
push 0x56e7c4
lea edx, [ebp - 0x80]
push edx
mov dword [ebp - 0x80], vtable.SCMClientException.0
mov dword [ebp - 0x40], 2
call fcn.004841dc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0
call fcn.004841dc
int3
Function at 0x41abd0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2080
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
push ebx
push esi
push edi
mov eax, dword [0x57e030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push 0x24
push 0x556074
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
xor edi, edi
mov dword [ebp + 8], esi
cmp esi, edi
jne 0x41ac3a
lea edx, [ebp - 0x15c]
push edx
call fcn.00419ac0
push 0x56e788
lea eax, [ebp - 0x15c]
push eax
call fcn.004841dc
lea ecx, [ebp - 0x14]
push ecx
push 0x24
lea edx, [ebp - 0x38]
push edx
push edi
mov dword [ebp - 4], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push esi
call ebx
test eax, eax
jne 0x41ac72
lea eax, [ebp - 0x11c]
push eax
call fcn.00419ac0
push 0x56e788
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004841dc
mov eax, dword [ebp - 0x34]
cmp eax, 1
je 0x41ad51
cmp eax, 3
je 0x41ad51
lea edx, [ebp - 0xdc]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x41acb8
lea eax, [ebp - 0x1dc]
push eax
call fcn.00419ac0
push 0x56e788
lea ecx, [ebp - 0x1dc]
push ecx
call fcn.004841dc
cmp byte [ebp + 0xc], 0
je 0x41ad36
mov edi, 0xa
lea edx, [ebp + 0xc]
push edx
push 0x24
lea eax, [ebp - 0x38]
push eax
push 0
push esi
call ebx
test eax, eax
jne 0x41acf3
lea ecx, [ebp - 0x19c]
push ecx
call fcn.00419ac0
push 0x56e788
lea edx, [ebp - 0x19c]
push edx
call fcn.004841dc
cmp dword [ebp - 0x34], 1
je 0x41ad36
dec edi
test edi, edi
jle 0x41ad0c
mov eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41acc3
push str._Exception_description_is_not_avaliable_
lea eax, [ebp - 0x7c]
push eax
call fcn.00419ba0
push 0x56e7c4
lea ecx, [ebp - 0x7c]
push ecx
mov dword [ebp - 0x7c], vtable.SCMClientException.0
mov dword [ebp - 0x3c], 1
call fcn.004841dc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str._Exception_description_is_not_avaliable_
lea edx, [ebp - 0xc0]
push edx
call fcn.00419ba0
push 0x56e7c4
lea eax, [ebp - 0xc0]
push eax
mov dword [ebp - 0xc0], vtable.SCMClientException.0
mov dword [ebp - 0x80], edi
call fcn.004841dc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0
call fcn.004841dc
int3
Function at 0x41b020
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x57e030]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
sub eax, 0
je 0x41b063
sub eax, 1
je 0x41b05c
xor al, al
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004807f8
add esp, 0x210
ret
mov eax, 0x23
jmp 0x41b068
mov eax, 0x1a
push ebx
push 1
push eax
lea eax, [esp + 0xc]
push eax
push 0
xor bl, bl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x41b090
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea eax, [esp + 4]
push eax
mov ecx, esi
call edx
mov bl, 1
mov ecx, dword [esp + 0x210]
mov al, bl
pop ebx
xor ecx, esp
call fcn.004807f8
add esp, 0x210
ret

Function at 0x41b3f0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x28
mov eax, dword [0x57e030]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
lea eax, [esp + 4]
mov esi, ecx
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x41b42f
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004807f8
add esp, 0x28
ret
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea eax, [esp + 8]
push eax
mov ecx, esi
call edx
call fcn.00405600
mov ecx, dword [esp + 0x28]
pop esi
xor ecx, esp
mov al, 1
call fcn.004807f8
add esp, 0x28
ret

Function at 0x41b6d0
Capabilities:
Check os version

Disassembly:
cmp dword [0x594820], 0
jne 0x41b6f7
push 0x594820
mov dword [0x594820], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41b6f7
mov dword [0x594820], eax
cmp dword [0x594824], 5
jne 0x41b718
cmp dword [0x594828], 2
jne 0x41b718
call fcn.0041b5f0
test al, al
je 0x41b718
mov eax, 1
ret
xor eax, eax
ret

Function at 0x41b720
Capabilities:
Check os version

Disassembly:
sub esp, 0x18
push esi
push str.Requested_CtrlAltDel_simulation
mov esi, eax
call fcn.004239b0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 4
cmp dword [0x594820], 0
jne 0x41b75c
push 0x594820
mov dword [0x594820], 0x114
call esi
test eax, eax
jne 0x41b75c
mov dword [0x594820], eax
cmp dword [0x594824], 6
jae 0x41b7c1
cmp dword [0x594820], 0
jne 0x41b788
push 0x594820
mov dword [0x594820], 0x114
call esi
test eax, eax
jne 0x41b788
mov dword [0x594820], eax
cmp dword [0x594830], 2
jne 0x41b7c1
lea esi, [esp + 8]
call fcn.0041e860
cmp byte [esp + 0x14], 0
je 0x41b7ae
mov eax, dword [esp + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
push ecx
mov dword [esp + 0xc], vtable.Thread.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x18
ret
Function at 0x41bc20
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x4bfb82
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x1c], ebp
xor esi, esi
cmp dword [ebp + 4], esi
jne 0x41bc5b
xor al, al
jmp 0x41bd88
mov eax, dword [esp + 0x74]
push 1
push eax
push ebp
lea ecx, [esp + 0x44]
push ecx
mov byte [esp + 0x27], 1
call fcn.0041bb50
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x40]
mov dword [esp + 0x74], esi
push eax
mov dword [esp + 0x24], esi
call fcn.0041bf30
test al, al
je 0x41bd55
mov ebx, dword [esp + 0x18]
cmp ebx, esi
je 0x41bd55
push ebx
lea ecx, [esp + 0x24]
push ecx
call fcn.0041c2b0
push esi
xor edi, edi
lea esi, [esp + 0x24]
mov byte [esp + 0x70], 1
call fcn.0041c360
push eax
lea edx, [esp + 0x40]
push edx
call fcn.0041bf30
test ebx, ebx
jbe 0x41bd40
xor ebx, ebx
jmp 0x41bcd0
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x41bcf4
call fcn.00480e22
mov ecx, dword [esp + 0x2c]
mov ebp, dword [ebx + ecx + 0x10]
cmp ebp, dword [ebx + ecx + 0x14]
lea esi, [ebx + ecx + 4]
jbe 0x41bd0b
call fcn.00480e22
mov esi, dword [esi]
test esi, esi
jne 0x41bd51
call fcn.00480e22
cmp ebp, dword [esi + 0x10]
jb 0x41bd20
call fcn.00480e22
push ebp
lea ecx, [esp + 0x3c]
call fcn.0041bc20
test al, al
jne 0x41bd32
mov byte [esp + 0x17], al
inc edi
add ebx, 0x1c
cmp edi, dword [esp + 0x18]
jb 0x41bcd0
mov ebp, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x70], 0
call fcn.004425d0
jmp 0x41bd5a
mov esi, dword [esi]
jmp 0x41bd16
mov byte [esp + 0x17], 0
mov eax, dword [ebp + 4]
test eax, eax
je 0x41bd76
mov ecx, dword [esp + 0x74]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete al
test al, al
jne 0x41bd7b
mov byte [esp + 0x17], 0
lea ecx, [esp + 0x38]
call fcn.0041bbc0
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 4

Function at 0x41bda0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [eax + 4]
test edx, edx
jne 0x41bdac
xor al, al
ret 4
mov eax, edi
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bdb2
sub eax, esi
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 8]
push ecx
push edi
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
ret 4
Function at 0x41bde0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bbe68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebp
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
mov edi, ecx
mov eax, dword [ebx + 4]
test eax, eax
je 0x41be8d
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x44]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x5c], 4
call esi
test eax, eax
jne 0x41be8d
mov eax, dword [esp + 0x44]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00405860
mov dword [esp + 0x3c], 0
mov edx, dword [esp + 0x28]
sub edx, dword [esp + 0x24]
sar edx, 1
jne 0x41be68
call fcn.00480e22
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x44]
push eax
mov eax, dword [ebx + 4]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push eax
call esi
test eax, eax
je 0x41bea4
lea esi, [esp + 0x18]
call fcn.00477db0
xor al, al
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x30
ret 4
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x44]
mov edi, eax
sub edi, ecx
sar edi, 1
mov esi, edx
cmp edx, edi
jb 0x41becd
call fcn.00480e22
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cmp word [ecx + esi*2], 0
je 0x41bef5
sub eax, ecx
sar eax, 1
mov esi, edx
cmp edx, eax
jb 0x41bee7
call fcn.00480e22
mov ecx, dword [esp + 0x24]
xor edx, edx
mov word [ecx + esi*2], dx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
sub eax, ecx
sar eax, 1
jne 0x41bf04
call fcn.00480e22
mov ecx, dword [esp + 0x24]
mov eax, dword [ebp]
mov edx, dword [eax + 4]
push ecx
mov ecx, ebp
call edx
lea esi, [esp + 0x18]
call fcn.00477db0
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x30
ret 4