joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415cc3
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
mov bl, byte [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
xor edi, edi
test bl, 2
mov dword [ebp - 4], edi
mov word [ebp - 0x204], di
je 0x415cf7
lea eax, [ebp - 0x204]
push str.Ctrl
push eax
call esi
test bl, 4
je 0x415d0a
lea eax, [ebp - 0x204]
push str.Shift
push eax
call esi
test bl, 1
je 0x415d1d
lea eax, [ebp - 0x204]
push str.Alt
push eax
call esi
test bl, 8
je 0x415d30
lea eax, [ebp - 0x204]
push str.Win
push eax
call esi
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x415dd7
push edi
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
test edi, edi
jbe 0x415dd7
cmp esi, 0x5d
je 0x415d8c
cmp esi, 0x21
je 0x415d8c
cmp esi, 0x22
je 0x415d8c
cmp esi, 0x23
je 0x415d8c
cmp esi, 0x24
je 0x415d8c
cmp esi, 0x25
je 0x415d8c
cmp esi, 0x26
je 0x415d8c
cmp esi, 0x27
je 0x415d8c
cmp esi, 0x28
je 0x415d8c
cmp esi, 0x2d
je 0x415d8c
cmp esi, 0x2e
je 0x415d8c
cmp esi, 0x90
jne 0x415d93
mov dword [ebp - 4], 0x1000000
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x204]
push eax
call esi
mov ecx, 0xff
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push eax
call esi
shl edi, 0x10
or edi, dword [ebp - 4]
lea eax, [ebp + eax*2 - 0x204]
push eax
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0x204]
push eax
call fcn.00415a93
pop ecx
jmp 0x415dd9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x416584
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x416606
cmp word [esi], 0
je 0x416606
lea eax, [ebp - 8]
push 1
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
cmp dword [ebp + 0x10], 0x20
jl 0x4165cb
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 4]
jmp 0x4165da
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x416608
cmp dword [ebp + 0x10], 0x10
sete al
or ah, 1
push eax
lea eax, [ebp - 0x2bc]
push 0x2b4
push eax
push 0x10
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2bc]
jmp 0x416608
xor eax, eax
pop esi
leave
ret
Function at 0x417e28
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x1c
call fcn.00415a49
xor esi, esi
pop ecx
cmp eax, esi
mov dword [0x42e4dc], eax
je 0x417e8d
mov ebx, dword [esp + 0x24]
mov dword [eax], 0x42b778
mov eax, dword [0x42e4dc]
mov dword [eax + 4], esi
mov eax, dword [0x42e4dc]
mov dword [eax + 8], ebx
mov eax, dword [0x42e4dc]
mov dword [eax + 0xc], ebx
lea eax, [ebx + ebx*4]
shl eax, 2
push eax
call fcn.00415a49
pop ecx
mov ecx, dword [0x42e4dc]
mov dword [ecx + 0x10], eax
mov eax, dword [0x42e4dc]
cmp dword [eax + 0x10], esi
jne 0x417e98
push 0x42e4dc
call fcn.00415a56
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x14
push 1
cmp ebx, esi
pop ebp
jle 0x417ef6
mov edi, dword [esp + 0x20]
mov eax, dword [0x42e4dc]
mov cx, word [edi]
mov eax, dword [eax + 0x10]
mov word [eax + esi], cx
mov eax, dword [0x42e4dc]
mov eax, dword [eax + 0x10]
and dword [eax + esi + 4], 0
mov eax, dword [0x42e4dc]
mov eax, dword [eax + 0x10]
mov dword [eax + esi + 8], ebp
mov eax, dword [0x42e4dc]
mov eax, dword [eax + 0x10]
or dword [eax + esi + 0xc], 0xffffffff
push dword [edi]
call fcn.00417891
pop ecx
add edi, 4
mov ecx, dword [0x42e4dc]
add esi, 0x14
dec ebx
mov ecx, dword [ecx + 0x10]
mov dword [ecx + esi - 4], eax
jne 0x417ea3
mov ecx, dword [0x42e4dc]
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x14], eax
mov eax, dword [0x42e4dc]
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x18], ecx
mov eax, dword [0x42e4dc]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
push 0x10
call fcn.00415a49
test eax, eax
pop ecx
mov dword [0x42e4d0], eax
jne 0x417f3b
mov eax, dword [0x42e4dc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x417e8d
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 2
mov dword [eax], 0x42b7a8
mov eax, dword [0x42e4d0]
pop edi
and dword [eax + 4], 0
push edi
call esi
mov ebx, 0x8000
test bx, ax
mov eax, dword [0x42e4d0]
je 0x417f6a
mov dword [eax + 0xc], edi
jmp 0x417f6d
mov dword [eax + 0xc], ebp
push 0x10
xor edi, edi
call esi
test bx, ax
je 0x417f7b
push 4
pop edi
push 0x11
call esi
test bx, ax
je 0x417f87
or edi, 8
push 0x12
call esi
test bx, ax
je 0x417f93
or edi, 0x20
push ebp
call esi
test bx, ax
je 0x417f9d
or edi, ebp
push 4
call esi
test bx, ax
je 0x417fa9
or edi, 0x10
push 2
call esi
test bx, ax
je 0x417fb5
or edi, 2
mov eax, dword [0x42e4d0]
mov dword [eax + 8], edi
mov eax, dword [0x42e4d0]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
lea eax, [esp + 0x10]
and dword [esp + 0x10], 0
push eax
push dword [esp + 0x2c]
push dword [0x42e4d0]
push dword [0x42e4dc]
call dword [sym.imp.ole32.dll_DoDragDrop]
mov esi, eax
mov eax, dword [0x42e4dc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [0x42e4d0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp esi, 0x40100
jne 0x417e8d
mov eax, dword [esp + 0x10]
jmp 0x417e90
Function at 0x4198be
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
xor ebx, ebx
cmp dword [0x42f2c0], ebx
push esi
push edi
jle 0x419977
mov esi, 0xff
lea eax, [ebp - 0x200]
push esi
push eax
push dword [ebp + 8]
mov word [ebp - 0x200], bx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x400]
push esi
push eax
mov word [ebp - 0x400], bx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [ebp + 0xc]
lea edi, [eax + 1]
cmp edi, dword [0x42f2c0]
jge 0x419977
mov esi, edi
shl esi, 5
mov eax, dword [0x42f2bc]
mov eax, dword [esi + eax]
cmp eax, ebx
je 0x419945
cmp word [eax], bx
je 0x419945
lea ecx, [ebp - 0x200]
push ecx
push eax
call fcn.0041a05e
pop ecx
cmp eax, 1
pop ecx
jne 0x41996b
mov eax, dword [0x42f2bc]
mov eax, dword [esi + eax + 4]
cmp eax, ebx
je 0x41997f
cmp word [eax], bx
je 0x41997f
lea ecx, [ebp - 0x400]
push ecx
push eax
call fcn.0041a05e
pop ecx
cmp eax, 1
pop ecx
je 0x41997f
inc edi
add esi, 0x20
cmp edi, dword [0x42f2c0]
jl 0x419920
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
mov eax, edi
jmp 0x41997a

Function at 0x419983
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 1
pop ebp
and eax, ebp
push 0
mov dword [esp + 0x20], eax
pop ebx
je 0x4199bd
push ebx
push ebp
push ebx
push 0x12
call edi
push eax
push 0x12
call esi
mov eax, dword [esp + 0x20]
and eax, 2
mov dword [esp + 0x10], eax
je 0x4199d6
push ebx
push ebp
push ebx
push 0x11
call edi
push eax
push 0x11
call esi
mov eax, dword [esp + 0x20]
and eax, 4
mov dword [esp + 0x14], eax
je 0x4199ef
push ebx
push ebp
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
mov eax, dword [esp + 0x20]
and eax, 8
mov dword [esp + 0x20], eax
je 0x419a08
push ebx
push ebp
push ebx
push 0x5b
call edi
push eax
push 0x5b
call esi
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push ebx
push ebp
call edi
push eax
push ebp
call esi
push ebx
push 3
push ebx
push ebp
call edi
push eax
push ebp
call esi
cmp dword [esp + 0x1c], ebx
je 0x419a34
push ebx
push 3
push ebx
push 0x12
call edi
push eax
push 0x12
call esi
cmp dword [esp + 0x10], ebx
je 0x419a47
push ebx
push 3
push ebx
push 0x11
call edi
push eax
push 0x11
call esi
cmp dword [esp + 0x14], ebx
je 0x419a5a
push ebx
push 3
push ebx
push 0x10
call edi
push eax
push 0x10
call esi
cmp dword [esp + 0x20], ebx
je 0x419a6d
push ebx
push 3
push ebx
push 0x5b
call edi
push eax
push 0x5b
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x41c333
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push 0x64
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
mov edi, eax
call fcn.0041c437
mov esi, dword [esp + 0x18]
pop ecx
cmp esi, dword [0x42ee74]
jne 0x41c3ba
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 1
jne 0x41c42b
mov esi, dword [0x42ee5c]
test esi, esi
je 0x41c425
cmp dword [esi + 0x18], 0
jne 0x41c3b5
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x41c3b5
lea edi, [esi + 0x1c]
push edi
push ebx
push dword [esi + 0xc]
call fcn.0040e096
add esp, 0xc
mov dword [esi + 0x18], eax
test eax, eax
jne 0x41c3b5
push edi
push ebx
push dword [esi + 0x14]
call fcn.00403617
add esp, 0xc
mov dword [esi + 0x18], eax
mov esi, dword [esi + 0x60]
jmp 0x41c371
push esi
push edi
call fcn.0041b674
cmp eax, dword [0x42ee74]
pop ecx
pop ecx
jne 0x41c42b
push esi
push edi
call fcn.0041b5e1
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x41c42b
cmp dword [esi + 0x18], 0
jne 0x41c42b
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 1
jne 0x41c42b
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x41c425
lea edi, [esi + 0x1c]
push edi
push ebx
push dword [esi + 0xc]
call fcn.0040e096
add esp, 0xc
mov dword [esi + 0x18], eax
test eax, eax
jne 0x41c425
push edi
push ebx
push dword [esi + 0x14]
call fcn.00403617
add esp, 0xc
mov dword [esi + 0x18], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
call fcn.0041c437
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x420b19
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x420b31
leave
ret
lea eax, [ebp - 0x200]
push esi
push eax
push 0
push 0
call fcn.004033ed
add esp, 0xc
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
leave
ret
Function at 0x422bde
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x42f2a0], edi
jle 0x422c90
mov esi, 0xff
lea eax, [ebp - 0x200]
push esi
push eax
push dword [ebp + 8]
mov word [ebp - 0x200], di
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x400]
push esi
push eax
mov word [ebp - 0x400], di
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameW]
xor ebx, ebx
cmp dword [0x42f2a0], edi
jle 0x422c90
xor esi, esi
mov eax, dword [0x42f29c]
mov eax, dword [esi + eax]
cmp eax, edi
je 0x422c5e
cmp word [eax], di
je 0x422c5e
lea ecx, [ebp - 0x200]
push ecx
push eax
call fcn.0041a05e
pop ecx
cmp eax, 1
pop ecx
jne 0x422c84
mov eax, dword [0x42f29c]
mov eax, dword [esi + eax + 4]
cmp eax, edi
je 0x422c98
cmp word [eax], di
je 0x422c98
lea ecx, [ebp - 0x400]
push ecx
push eax
call fcn.0041a05e
pop ecx
cmp eax, 1
pop ecx
je 0x422c98
inc ebx
add esi, 0x14
cmp ebx, dword [0x42f2a0]
jl 0x422c39
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
mov eax, ebx
jmp 0x422c93
Function at 0x406161
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, ecx
mov dword [ebp - 0x10], edx
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
jne 0x40617c
xor al, al
jmp 0x406259
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x206f
push eax
push edi
mov dword [ebp - 0x20], str.shrt_ufqfuexp_wjuv_bymg_zvk_bpcxd_cerd_lopq_prmk_xrnb_heu_woigztj
call fcn.00416979
push 0xe52
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00409883
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004152c3
add esp, 0x20
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00403165
jmp 0x40623b
lea ecx, [ebp - 4]
call fcn.0040325f
mov al, byte [eax]
cmp al, 0x30
jl 0x40625f
cmp al, 0x39
jg 0x40625f
mov dword [ebp - 0x18], 0x4436
cmp dword [ebp - 0x18], 0x47b9
mov dword [ebp - 0x24], str.smnjrhtcz_pgiliqlyh_tza_oplh_dwvj_eepcra_rxw_xoptdrlmi_avfvqv_grnufg_khx_qlkw_wuvijthek
jle 0x40620f
mov dword [ebp - 8], edi
lea eax, [ebp - 8]
push eax
push edi
call fcn.0041f7a3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
pop ecx
pop ecx
cmp eax, 0x271e
jl 0x4061f5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0xb74
push edi
call fcn.00407a70
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00406779
add esp, 0x1c
lea ecx, [ebp - 4]
call fcn.0042f7fd
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00403179
push eax
lea ecx, [ebp - 4]
call fcn.00402ba7
test al, al
jne 0x4061c1
inc al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x11f3
cmp dword [ebp - 0x1c], 0x1254
mov dword [ebp - 0x2c], str.qlguevu_tzx_fyftnpil_qyjlqiyv_mjzd_kbcctz_hbxyxzfw_uyfr_saj
jle 0x4062a1
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0xc]
push eax
push 0x2d09
push edi
call fcn.004068f7
mov eax, dword [ebp - 0xc]
add esp, 0xc
inc eax
mov dword [ebp - 0xc], eax
cmp eax, 0x79c5
jl 0x406279
push edi
push edi
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x1b4e
lea eax, [ebp - 0x10]
push eax
push edi
push 0x5d47
call fcn.004067cb
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00408925
add esp, 0x1c
jmp 0x406175
Function at 0x4160bc
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x41623a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x416155
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41612c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push dword [ebp - 0x1c]
call fcn.00416256
pop ecx
pop ecx
jmp 0x416150
push 0x67d5
push 1
push 0x4425
push 0
push 0x7912
push 0x2945
push 1
push 1
call fcn.0041a21d
add esp, 0x20
jmp 0x416238
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4161eb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x41619c
push 0
push 0xaae
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4161e9
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
and dword [ebp - 4], 0
jmp 0x4161b5
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x622f
jge 0x4161e9
push 0x656b
push 0x7362
push 0
push 1
lea eax, [ebp - 4]
push eax
push 0x132d
push dword [ebp - 0x48]
push 1
push 0x7111
call fcn.004203a4
add esp, 0x24
jmp 0x4161ae
jmp 0x416238
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 0x6b39
push 0x272
push 1
push 0x5385
push 0x6b03
push 1
push 1
push 0
push 0x7cea
push 0x5a66
push 0x31e9
push 0x642f
push dword [ebp - 0x50]
push 0x353
push 1
push 0x48e2
call fcn.0040b835
add esp, 0x40
jmp 0x416252
push 1
push 0x6924
push 1
push 1
push 0x1c95
call fcn.0040b0ed
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x418d05
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x418ea8
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x418e89
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x418e32
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x418dc0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push dword [eax + 4]
push dword [eax]
mov ecx, 0xaa8ef8
call fcn.0042f678
jmp 0x418e30
and dword [ebp - 0xc], 0
jmp 0x418dcd
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x553f
jge 0x418e30
and dword [ebp - 4], 0
jmp 0x418de3
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41bb
jge 0x418e2e
and dword [ebp - 8], 0
jmp 0x418df9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3ded
jge 0x418e2c
mov eax, dword [ebp - 4]
and eax, dword [ebp - 8]
xor eax, dword [ebp - 0xc]
cdq
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edx
lea eax, [ebp - 0x80]
push eax
push 0x35bb
push 0
push 0x16a9
call fcn.004248f0
add esp, 0x10
jmp 0x418df2
jmp 0x418ddc
jmp 0x418dc6
jmp 0x418e87
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x418e69
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
add eax, 0x21
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x418e87
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
push dword [eax + 4]
push dword [eax]
mov ecx, 0xaa8ef8
call fcn.0042f678
jmp 0x418ea6
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
push 0x1f69
push 0
push 0x4d3a
push dword [ebp - 0x74]
call fcn.00424e57
add esp, 0x10
jmp 0x418eba
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
push dword [ebp - 0x78]
push 1
call fcn.00407eb1
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41bcaa
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b032f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x41be2a
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41bd13
push 1
call fcn.0041be74
pop ecx
jmp 0x41be28
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41be00
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x41bdf4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
and dword [ebp - 4], 0
push 1
push 0x52c4
push 0x5d8c
push 0x7e22
push 1
push dword [ebp - 0x50]
push 0x10eb
push 1
push dword [ebp - 0x54]
push 0
push 0x28eb
push 1
push 1
push 0x19ae
push 0x128d
push 1
call fcn.0040db2a
add esp, 0x40
jmp 0x41bde8
or dword [ebp - 4], 0xffffffff
jmp 0x41bdf2
jmp 0x41bdfe
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x41be28
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
push dword [ebp - 0x5c]
push 0x6ad6
push 0
push 0
push 1
push 0x2a7f
push 0x7188
push 0
call fcn.00413fd8
add esp, 0x20
jmp 0x41be63
lea eax, [ebp + 0x14]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x64]
push 1
push dword [ebp - 0x68]
push 0x1890
push dword [ebp - 0x6c]
push 0
call fcn.0041c048
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret