joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
push edi
push 0xff
lea eax, [ebp - 0x11f]
push 0
push eax
mov byte [ebp - 0x120], 0
call fcn.0041a140
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov al, 0x6f
mov byte [ebp - 0xc], al
mov eax, dword [ecx + 0x7d8]
add eax, 0x2000
add esp, 0xc
cmp dword [edi + 0x950], 0
mov dword [ebp - 4], 0x544547
mov dword [ebp - 0x18], 0x646e6957
mov dword [ebp - 0x14], 0x2073776f
mov dword [ebp - 0x10], 0x6c707845
mov dword [ebp - 0xb], 0x726572
mov dword [ebp + 8], eax
jne 0x416fb8
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push edi
call fcn.00418c00
add esp, 0x18
mov dword [edi + 0x950], eax
mov esi, dword [edi + 0x950]
test esi, esi
je 0x417107
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.00416eb0
mov edx, dword [ebp + 0x18]
push 1
push 0
push 3
push 0
push 0
push 0x50
push edx
push esi
push edi
call fcn.00418c70
mov esi, eax
add esp, 0x2c
mov dword [ebp - 0x20], esi
test esi, esi
je 0x417107
push ebx
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 4]
push ecx
push esi
push edi
call fcn.00418cf0
mov ebx, eax
add esp, 0x24
test ebx, ebx
jne 0x417037
push esi
push edi
call fcn.00418e50
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push ebx
push edi
call fcn.00418d70
add esp, 0x18
test eax, eax
jle 0x4170f5
mov ecx, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
test ecx, ecx
je 0x41710d
lea eax, [esi + 0x956c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x50], 1
add esi, 0x24
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esi], 0
test ecx, ecx
je 0x41709f
lea ecx, [eax + 0x2ff97c]
push 0x14
push ecx
add eax, 0x8d2c
push eax
call fcn.0041a0c0
add esp, 0xc
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
mov ecx, 0x1f4000
sub ecx, eax
add eax, dword [ebp + 0xc]
push ecx
push eax
push ebx
push edi
call fcn.00418de0
add esp, 0x14
test eax, eax
je 0x4170e9
nop
mov eax, dword [ebp + 8]
test eax, eax
je 0x4170e9
add dword [esi], eax
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
mov edx, 0x1f4000
sub edx, eax
add eax, dword [ebp + 0xc]
push edx
push eax
push ebx
push edi
call fcn.00418de0
add esp, 0x14
test eax, eax
jne 0x4170c0
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [edx], 1
push ebx
push edi
call fcn.00418e50
push esi
push edi
call fcn.00418e50
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [esi + 0x380d6c]
mov dword [ebp + 0xc], edx
lea edx, [eax + 0x6c]
add esi, 0x68
mov dword [ebp - 0x1c], edx
jmp 0x41707e
Function at 0x417130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
xor eax, eax
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 8], al
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
push edi
mov al, 0x6f
mov byte [ebp - 0x20], al
xor eax, eax
push 0x7f
push eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc0], al
lea eax, [ebp - 0xbf]
push eax
mov dword [ebp - 0x38], 0x2a2f2a
mov dword [ebp - 0xc], 0x54534f50
mov dword [ebp - 0x2c], 0x646e6957
mov dword [ebp - 0x28], 0x2073776f
mov dword [ebp - 0x24], 0x6c707845
mov dword [ebp - 0x1f], 0x726572
call fcn.0041a140
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 0x7d8]
add esp, 0xc
cmp dword [esi + 0x950], 0
jne 0x4171e1
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
push esi
call fcn.00418c00
add esp, 0x18
mov dword [esi + 0x950], eax
test eax, eax
je 0x4172f0
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x417209
lea esp, [esp]
cmp dword [eax], 0xa0d0a0d
je 0x417200
inc eax
cmp byte [eax], 0
jne 0x4171f0
jmp 0x417209
mov dword [eax], 0
add eax, 4
push ebx
mov dword [ebp + 8], eax
push 0x2f
lea eax, [edi + 0x3019dc]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041a0c0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x950]
push 1
push 0
push 3
push 0
push 0
push 0x50
push eax
push ecx
lea edx, [ebp - 0x38]
push esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
call fcn.00418c70
mov ebx, eax
add esp, 0x30
test ebx, ebx
je 0x4172ef
push 1
push 0
lea edx, [ebp - 0x40]
push edx
push 0
push 0
lea eax, [edi + 0x30199c]
push eax
lea ecx, [ebp - 0xc]
push ecx
push ebx
push esi
call fcn.00418cf0
add esp, 0x24
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x417292
push ebx
push esi
call fcn.00418e50
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.0041a390
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.0041a390
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc0]
push edx
push eax
push esi
call fcn.00418d70
add esp, 0x18
test eax, eax
jle 0x4172db
cmp dword [ebp + 0x1c], 0
je 0x4172db
mov dword [edi + 0x2050], 1
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.00418e50
push ebx
push esi
call fcn.00418e50
add esp, 0x10
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
push edx
lea esi, [eax + 0x954]
push esi
push eax
mov dword [ebp - 0x10], 0x65746e49
mov dword [ebp - 0xc], 0x74656e72
mov dword [ebp - 8], 0x6e65704f
mov word [ebp - 4], 0x41
call fcn.00419290
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418c5e
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x958]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e6e6f43
mov dword [ebp - 8], 0x41746365
mov byte [ebp - 4], 0
call fcn.00419290
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418cdf
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x95c]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.00419290
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418d5f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x960]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.00419290
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418dd3
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x964]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.00419290
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418e3f
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.00419290
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418ea6
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x4196f6
cmp dword [esi + 0x18], 0
je 0x419711
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041b040
add esp, 8
test eax, eax
jne 0x4196ee
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4196d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x419711
mov eax, dword [esi + 0x18]
test eax, eax
je 0x419711
cmp eax, ecx
je 0x4196ee
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x419704
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x419778
cmp dword [esi + 0x18], 0
je 0x419778
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041b040
add esp, 8
test eax, eax
jne 0x419780
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419760
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x4197e8
cmp dword [esi + 0x18], 0
je 0x4197e8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041b040
add esp, 8
test eax, eax
jne 0x4197f0
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4197d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4198a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x4198e4
cmp dword [eax + 0x18], 0
je 0x4198e4
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x4198d7
mov esp, ebp
pop ebp
ret

Function at 0x4198f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0041a140
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41997b
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041a760
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00413df0
add esp, 0x10
test eax, eax
jne 0x419983
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419950
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419df0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x419dfe
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x419dfa
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x419dfa
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x419e70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x419e94
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x419e94
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x419e9c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0041a270
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0041a0f0
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0041a0c0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x419f2e
mov dword [ebp + 0xc], edx
jmp 0x419ed9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x419ef0
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x419f06
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x419f13
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0041a0c0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x419ed7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419f40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x419f60
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x419f60
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x419f64
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x419fe0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x41a000
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41a000
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x41a004
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x41a000
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x41ad20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x41af5c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0041a140
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x41aeec
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x41aee2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.00409a40
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x41af0d
inc eax
cmp byte [esi + eax], 0
jne 0x41af06
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0041a0c0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x41af2a
inc edi
cmp byte [edi + ebx], 0
jne 0x41af23
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x41af3a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x41af32
test esi, esi
je 0x41af4f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0041a110
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4010a0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x800
push esi
mov esi, ecx
mov ecx, dword [esi + 0x61c]
test ecx, ecx
je 0x4010d7
push 1
call fcn.00403a90
mov ecx, dword [esi + 0x61c]
push str._t_CAppSettingConverter::Convert___started_
call fcn.004037f0
mov ecx, dword [esi + 0x61c]
push 1
call fcn.00403a90
mov ecx, esi
call fcn.00401ba0
test eax, eax
jne 0x4011b1
push ebx
mov ecx, esi
call fcn.00401cf0
mov ebx, eax
test ebx, ebx
jne 0x401180
mov eax, dword [esi + 0x61c]
test eax, eax
je 0x40112a
mov eax, dword [str.SOFTWAREIntelNetwork_ServicesNCSPROSet.sav]
lea ecx, [esp + 8]
push eax
push str._tRemoving__if_exists__registry_sub_key__s
push ecx
call fcn.00409203
mov ecx, dword [esi + 0x61c]
add esp, 0xc
lea edx, [esp + 8]
push edx
call fcn.004037f0
mov eax, dword [str.SOFTWAREIntelNetwork_ServicesNCSPROSet.sav]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push eax
push 0x80000002
call edi
mov eax, dword [esi + 0x61c]
test eax, eax
je 0x401171
mov ecx, dword [str.SOFTWAREIntelWireless.sav]
lea edx, [esp + 0xc]
push ecx
push str._tRemoving__if_exists__registry_sub_key__s
push edx
call fcn.00409203
mov ecx, dword [esi + 0x61c]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call fcn.004037f0
mov ecx, dword [str.SOFTWAREIntelWireless.sav]
push ecx
push 0x80000002
call edi
pop edi
mov ecx, dword [esi + 0x61c]
test ecx, ecx
je 0x4011ae
push 1
call fcn.00403a90
mov ecx, dword [esi + 0x61c]
push str._t_CAppSettingConverter::Convert___completed_
call fcn.004037f0
mov ecx, dword [esi + 0x61c]
push 1
call fcn.00403a90
mov eax, ebx
pop ebx
pop esi
add esp, 0x800
ret

Function at 0x401880
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
push 1
push 0
mov esi, 4
push ecx
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018fc
mov eax, dword [esp + 4]
test eax, eax
je 0x4018fc
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x4018ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
neg eax
sbb eax, eax
and eax, 2
add esp, 8
ret 0x10
mov eax, 1
pop esi
add esp, 8
ret 0x10