joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a190
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x42c]
push edi
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x434], 0
call fcn.00408630
cmp dword [ebp - 0x418], 8
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push eax
push 0
push 0x5c5814
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
mov eax, dword [ebp - 0x418]
test ebx, ebx
je 0x40a370
cmp eax, 8
jb 0x40a217
inc eax
lea ecx, [ebp - 0x42c]
push eax
push dword [ebp - 0x42c]
call fcn.00402610
lea ecx, [esi + 2]
nop word [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40a220
push 0x208
lea eax, [ebp - 0x414]
sub esi, ecx
push 0
push eax
sar esi, 1
call fcn.00486960
mov eax, 0x14f8b589
imul ebx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x186a0
sub ebx, eax
lea eax, [ebp - 0x414]
push ebx
push dword [ebp - 0x430]
push str._s_05d
push eax
call fcn.0040ad20
lea ecx, [esi + 5]
mov eax, 0x66666667
imul ecx
push 0x208
sar edx, 1
lea eax, [ebp - 0x20c]
mov esi, edx
push 0
shr esi, 0x1f
push eax
add esi, edx
call fcn.00486960
add esp, 0x28
xor ecx, ecx
nop
movzx eax, word [ebp + ecx - 0x414]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x20e], ax
test ax, ax
jne 0x40a2a0
test esi, esi
jle 0x40a318
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x40c]
lea eax, [eax + 0xa]
mov word [ebp + eax - 0x216], cx
movzx ecx, word [ebp + eax - 0x41e]
mov word [ebp + eax - 0x20e], cx
movzx ecx, word [ebp + eax - 0x41c]
mov word [ebp + eax - 0x214], cx
movzx ecx, word [ebp + eax - 0x418]
mov word [ebp + eax - 0x212], cx
movzx ecx, word [ebp + eax - 0x41a]
mov word [ebp + eax - 0x210], cx
sub esi, 1
jne 0x40a2c0
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [ebp - 0x20c], ax
jne 0x40a347
xor ecx, ecx
lea eax, [ebp - 0x20c]
push ecx
push eax
mov ecx, edi
call fcn.00402510
jmp 0x40a394
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a350
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00402510
jmp 0x40a394
cmp eax, 8
jb 0x40a388
inc eax
lea ecx, [ebp - 0x42c]
push eax
push dword [ebp - 0x42c]
call fcn.00402610
push 0x625f30
mov ecx, edi
call fcn.004023b0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret 8
Function at 0x40a3b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00409dc0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push 0xf003f
push 0
push str.EUDC936
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a42c
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00408580
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x40a42c
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00402610
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00455afe
mov esp, ebp
pop ebp
ret
Function at 0x411520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x41162a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub eax, 0xffffff80
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
lea esi, [ecx + 2]
sub ecx, eax
lea edx, [eax + 2]
add ecx, 0xfffffffe
lea eax, [edi - 1]
mov dword [ebp + 0x14], edx
shr eax, 3
inc eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
push ecx
push dword [ebp - 0xc]
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
call fcn.004107c0
mov ecx, dword [ebp + 8]
lea esi, [esi + 8]
mov edx, dword [ebp + 0x14]
add esp, 0xc
movzx eax, byte [ecx + 0x100]
mov ecx, dword [ebp - 8]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x14], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [ebp - 4], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [ebp - 8]
jne 0x411560
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x415b70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bcbc8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004607a1
test al, al
je 0x415bc1
inc ebp
test dword [esi - 0x6b306072], edi
jo 0x415ba5
call 0xf142e470
ljmp 0x8712
call fcn.00460579
test al, al
je 0x415be6
jae 0x415c15
mov eax, dword [0x36cc6103]
mov dl, 0x4f
fdivr qword [edx]
dec ecx
invalid
push 0x11
xor eax, eax
mov dword [ebp - 0x14], 7
push str.C:LogResLog.dll
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00402510
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
add byte [eax], al
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415cd4
call fcn.004607e6
test al, al
je 0x415c43
cmc
enter 0xffffffffffff9ab5, 0x52
int3
call fcn.004651c9
test eax, eax
jne 0x415cd4
call fcn.0046030c
test al, al
je 0x415c76
jge 0x415c8e
push 0x9968a941
into
inc ecx
leave
cmpsb byte [esi], byte es:[edi]
mov bl, 0x70
popal
aaa
outsb dx, byte [esi]
cdq
test eax, 0x9b889beb
les ebx, ss:[esi + 0x683b2252]
invalid
push 0x270f
push 0
call fcn.00471aeb
add esp, 8
cmp eax, 0x64
jle 0x415cd4
call fcn.004606d2
test al, al
je 0x415cb1
add byte [eax + eax*8 + 0x4401e74], al
mul byte [ecx]
jmp 0xc62d074f
inc eax
add al, 0xf6
and ecx, ebp
mov bl, 0xaa
jmp 0x415c61
call fcn.0046016e
test al, al
je 0x415cd0
or eax, dword [0xfacdcd8f]
pop edi
ljmp 0x3e6d
xor bl, bl
jmp 0x415cd6
mov bl, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x415ceb
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00402610
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret

Function at 0x416730
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x41679c
cmp byte [esi + 1], 0
je 0x41679c
push ebx
push edi
call fcn.0041ab50
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
cmp edi, 0x14
jl 0x41675d
cmp byte [esi + 3], 0
je 0x41676d
cmp byte [esi + 2], 0
jne 0x416771
push 0x1f4
inc edi
call ebx
jmp 0x416752
cmp byte [esi + 2], 0
pop edi
pop ebx
jne 0x41679c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
mov eax, dword [esi + 8]
pop esi
test eax, eax
je 0x4167ab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x41c2b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd326
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cdq
push edx
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.00470fad
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x828], ax
lea ecx, [ebp - 0x828]
lea eax, [ebp - 0x840]
mov dword [ebp - 0x814], 7
push eax
mov dword [ebp - 0x818], 0
call fcn.00402760
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.00486960
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x41c356
mov esi, dword [esi]
cmp dword [ebp - 0x82c], 8
lea ecx, [ebp - 0x810]
push esi
push 0x400
push ecx
lea eax, [ebp - 0x840]
cmovae eax, dword [ebp - 0x840]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x810], 0
jne 0x41c38e
xor ecx, ecx
jmp 0x41c3a6
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c397
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00402510
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0048f705
mov ecx, dword [ebp - 0x814]
add esp, 4
mov esi, eax
cmp ecx, 8
jb 0x41c3f6
inc ecx
push ecx
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.00402610
xor eax, eax
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x818], 0
cmp eax, 8
jb 0x41c431
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.00402610
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c610
Capabilities:
Delete service
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x41c654
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
call fcn.004606d2
test al, al
je 0x41c673
xor ch, byte [esp + eax*8 + 0x29]
mov al, byte [ecx]
jmp 0x240c14a3
call fcn.00460465
add al, 0
test al, al
je 0x41c695
xchg ebx, eax
adc edi, ebp
cmp byte [eax + 0x2c], dl
jg 0x41c6f2
push esi
sub byte [edx], ah
adc cl, byte [edx - 0x2e]
xchg edi, eax
adc esp, dword [ebx]
add cl, dl
mov dh, 0xfc
int 0x75
inc edi
xor al, 0xe8
call fcn.00460282
test al, al
je 0x41c6b2
call 0x8441cad6
sal byte [esp + edx - 0x6e], 0x84
adc eax, 0x230066fc
xchg edx, eax
test byte [0x230066fc], dl
xchg byte [edi], dl
pop esi
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
nop
mov eax, dword [0x740f747e]
pop ss
mov dword [0xf01ff68], eax
add bh, bh
jne 0x41c696
push 0xf01ff
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x41c63f
call fcn.0046068d
test al, al
je 0x41c6ef
in eax, dx
push eax
jmp 0x41c676
call fcn.0046023d
add al, 0
test al, al
je 0x41c711
sal byte [ecx + ebx - 0x3d], 0xa9
aas
invalid
ret
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x41c63f
call fcn.00460351
test al, al
je 0x41c747
lahf
insd dword es:[edi], dx
push 0x67f3a19d
jae 0x41c6f5
rcl byte [edx], cl
push ebp
cli
lcall 0xe8b1, 0xae33ef7f
jnp 0x41c785
call fcn.004602c7
add al, 0
test al, al
je 0x41c76a
rol ebx, cl
jp 0x41c74a
rcl byte [ebp - 0x6f], cl
push ss
lodsb al, byte [esi]
invalid
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x41c63f
call fcn.004600e4
test al, al
je 0x41c792
add byte [eax + eax*8 + 0x27d71074], al
xlatb
daa
sub al, 0x80
mov al, 0x5f
mov esi, 0x42de128d
xor byte [eax + 0x128dbe5f], 0xde
inc edx
in eax, dx
push es
sbb dword [eax + 0x3a1ce808], ebx
add al, 0
call fcn.004601b3
test al, al
je 0x41c7af
inc esp
add al, 0x1c
stosd dword es:[edi], eax
xlatb
mov al, byte [0x60cddd50]
jae 0x41c77d
cmc
dec esi
call 0x47fed03b
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
Function at 0x41cfa0
Capabilities:
Delete registry value

Disassembly:
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
push ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
call fcn.0041ce30
test al, al
jne 0x41cfe8
push ebx
push 0x7d
call fcn.00465785
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
call fcn.004606d2
test al, al
je 0x41d00a
or esp, dword [esi + 0x280eaa14]
sbb cl, byte [ecx]
or esp, dword [eax]
jb 0x41cf8a
loopne 0x41cfe5
pop edi
cmpsb byte [esi], byte es:[edi]
pop ds
pop esp
test byte [esi], dl
sal al, 1
sbb cl, al
enter 0x39e8, 0x36
add al, 0
call fcn.00460648
test al, al
je 0x41d033
push es
jne 0x41d04c
invalid
call fcn.004607e6
test al, al
je 0x41d054
clc
or dh, byte [ebx - 0x26]
and dword [esi], esi
cdq
outsd dx, dword [esi]
push es
ror byte [esi], 0x37
popal
std
cdq
pop esp
mov ebp, 0xbf9e8939
int3
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
push esi
call fcn.0041c610
test al, al
jne 0x41d084
invalid
push esi
push 0x7e
call fcn.00465785
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
call fcn.004606d2
test al, al
je 0x41d0a8
xlatb
movsb byte es:[edi], byte [esi]
cld
cmp al, 0x6a
push edi
invalid
call fcn.004604aa
test al, al
je 0x41d0c2
pop ebp
pop eax
xlatb
aaa
sbb cl, al
leave
int1
ja 0x41d05e
sub eax, 0xa3e2e439
mov esp, 0x436dae8
add byte [eax + eax*8 - 0x2bb2ef8c], al
and eax, 0x59b1fac4
outsd dx, dword [si]
or ecx, dword [ebx + 0x4263f469]
sbb al, 0x8d
inc ebp
loopne 0x41d12f
call fcn.004607a1
test al, al
je 0x41d0db
dec ebp
aam 0x25
invalid
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push 0
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionSvchost
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d12d
push str.LocalWorkSvc
lea ecx, [ebp - 0x1c]
call fcn.004023b0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
call fcn.00402370
mov ecx, dword [ebp - 4]
cld
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
Function at 0x41f840
Capabilities:
Get disk information

Disassembly:
nop
leave
bound eax, qword [ebx]
add byte [ebx + 0x8c25de5], cl
add ah, cl
int3
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
call fcn.00460579
test al, al
je 0x41f86f
add byte [esi - 0x69], 0xc2
adc edi, dword [eax - 0x1a88b583]
xchg dl, bh
jbe 0x41f8d8
pop edi
sbb al, 0x49
shr al, 1
fisttp qword [edx]
add al, 0
call fcn.00460351
test al, al
je 0x41f897
mov dword [0x4049395c], eax
sbb bh, byte [ebp - 0x19ab2cc1]
and byte [edi], al
retf
mov cl, 0xdc
js 0x41f883
jns 0x41f831
jo 0x41f817
jnp 0x41f90c
push es
call fcn.0046082b
add al, 0
test al, al
je 0x41f8b8
xchg ebp, eax
dec edi
or al, 0x36
sub eax, 0xbfa758dc
fnstenv [edi]
inc esi
rol byte [esp + ebp*2], 0x5a
mov bh, 0xe3
les esi, [ebx - 0x60]
jl 0x41f916
imul eax
outsb dx, byte [esi]
invalid
call fcn.0046082b
test al, al
je 0x41f8d9
sal edx, 1
mov ebx, 0x8bc495b8
das
mov eax, 0xfcbbb1e6
adc byte [ebp + edx*2 + 0x6c57865e], ah
jo 0x41f89a
pop esi
sub ebp, eax
movsb byte es:[edi], byte [esi]
or dword [eax + eax], eax
call fcn.00460282
test al, al
je 0x41f900
mov ch, 0x95
lahf
fsub qword [edi]
xchg ebp, eax
loope 0x41f945
arpl word [ecx + 0x2b], bp
xchg dword [ecx + 0x71], ecx
in eax, dx
shr byte [eax + 0x45], 0xf5
daa
jno 0x41f918
jp 0x41f96a
xlatb
mov al, 0x73
jno 0x41f88c
mov esi, dword [ebp + 8]
jne 0x41f90b
xor eax, eax
push 0xffffffffffffffff
push eax
push dword [ebp - 4]
mov dword [esi + 0x14], 7
mov ecx, esi
mov dword [esi + 0x10], 0
inc esi
adc al, 7
add byte [eax], al
add byte [ebx + 0x1046c7ce], cl
add byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
add byte [esi - 0x77], ah
push es
mov word [esi], ax
call fcn.00402760
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
or byte [ebx + 0x56], dl
dec edi
add edx, ecx
sbb byte [ecx + 8], ah
movsd dword es:[edi], dword [esi]
cld
lea edx, [edi]
sbb byte [ebx + 0x40aeae8], bh
Function at 0x420030
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x21c], 0
call fcn.00460579
test al, al
je 0x42007e
rcl dword ds:[eax - 0x77], 6
out 0x12, al
mov ah, 0x89
int1
dec ebp
invalid
call fcn.00460351
test al, al
je 0x4200a6
sbb al, 0x60
loop 0x4200a0
lodsd eax, dword [esi]
std
mov ch, 0xe8
sbb esi, dword [edi]
cmp dh, al
jb 0x4200ac
test dword [edi], esp
and al, 0xd7
and byte [0x50b05acb], 0xc1
xchg ebx, ebp
invalid
call fcn.0046082b
test al, al
je 0x4200c7
sal byte [eax + ebx + 0x49], 0xfc
dec ecx
cld
cmp dword [ebx - 0x750ed58f], eax
test al, 0x1e
invalid
call fcn.0046082b
test al, al
je 0x4200e8
sahf
hlt
call fcn.00460282
test al, al
je 0x42010f
push ebx
push esp
dec ebx
fcompi st(6)
cmc
jae 0x42015e
sub edi, ebx
dec ebp
ret 0x2913
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00486960
add esp, 0xc
push dword [ebp - 0x210]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x210], edi
test edi, edi
je 0x420205
call fcn.00460351
test al, al
je 0x420164
popfd
lodsd eax, dword [esi]
lahf
mov bl, 0x19
jbe 0x4200ed
test dword [0xbadfb92d], ecx
salc
lea ebx, [eax + 0x26]
xor byte [ebp - 0x18], ch
pop esi
add dword [eax + eax], eax
call fcn.004602c7
test al, al
je 0x42018a
or byte [edi - 0x5956f6cf], cl
jp 0x42012b
int3
lea eax, [ebp - 0x220]
push eax
push 4
lea eax, [ebp - 0x214]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4201bc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
call fcn.00460351
test al, al
je 0x4201d8
pop ebx
xchg edi, eax
pop ss
lcall 0xfde9, 0x5381627e
salc
test eax, 0x314a3da
wait
xchg edx, eax
pop ds
call fcn.004602c7
test al, al
je 0x4201fe
pushal
xor al, 0x34
nop
jp 0x42021d
mov al, byte [0x219d348c]
cld
sahf
sbb al, 4
mov al, 0xfe
lahf
shr dword [ecx - 0x74b0c8df], cl
mov ebp, 0xfffffdf0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004600e4
test al, al
je 0x42021e
adc byte [ebx - 0x4e], al
sub byte [edi + 0x472b6ca3], dl
enter 0x2942, 0xffffffffffffffe1
inc ebx
mov dl, 0x28
xchg edi, eax
mov dword [0xc8472b6c], eax
inc edx
sub ecx, esp
pop esp
mov ah, 0x73
inc eax
call fcn.004601b3
test al, al
je 0x42023b
xchg edi, eax
jne 0x42020d
inc ebx
xchg edi, eax
mov ah, 0x98
pop edi
mov cl, 0x14
xor dword [edi - 0x74], edx
push ebp
enter 0x4416, 0x4d
invalid
mov ebx, dword [ebp - 0x218]
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
cmp word [ebp - 0x20c], ax
jne 0x420261
xor ecx, ecx
jmp 0x42027f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420270
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00402510
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret 8
Function at 0x424eb0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.004607e6
test al, al
je 0x424ed9
retf 0xe9b9
call fcn.0046009f
test al, al
je 0x424ef7
xor edx, dword [eax - 0x433e86ad]
invalid
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov eax, dword [ebp + 0xc]
push 0xf003f
neg eax
push 0
sbb eax, eax
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
add eax, reloc.OLEAUT32.dll_SysReAllocString
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424f3a
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add al, ch
push edi
mov ah, 3
add byte [eax + eax*8 + 0x5b341874], al
call fcn.00460396
test al, al
je 0x424f5b
xor al, 0x5b
pop ebp
invalid
call fcn.0046082b
test al, al
je 0x424f81
ficomp word [edx + 0x78]
fnsave dword [eax - 0x67722612]
jb 0x424f39
loop 0x424fe7
invalid
call fcn.004601b3
test al, al
je 0x424fa3
sbb dh, byte [ebp - 0x4575f55c]
mov al, 0xa1
push ebp
xchg ebp, eax
mov esi, 0x84de7990
cmp esi, dword [0xdcb0b53e]
lcall 0x5b5e, 0x5fc7b8f9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
inc esp
daa
test byte [eax + 0x6d], dl
jecxz 0x424fec
arpl word [esi], ax
call fcn.0046009f
test al, al
je 0x42500b
test byte [edx + ecx + 0x7f6c35b9], cl
sbb eax, 0xab74dde5
add eax, 0x5035c398
add ebp, eax
push eax
and byte [eax], al
add byte [ebp - 0x74f68b40], al
adc byte [ebx - 0xfe9538], cl
push edx
or al, 0xe8
int 0xb4
add eax, dword [eax]
call fcn.00427060
test eax, eax
je 0x42501d
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0xc]
call fcn.004604ef
test al, al
je 0x42503c
call 0xb2dc1ea1
in al, 0xd9
dec edi
outsb dx, byte [esi]
push esp
cmpsd dword [esi], dword es:[edi]
inc eax
sti
cld
mov ch, 0x6e
dec byte [ebp - 0x65]
jmp 0x42507d
call fcn.004605be
test al, al
je 0x425062
mov ch, 0x9d
pop ecx
sbb eax, 0xe606ccef
pop ebx
fbld tbyte [eax + 0xeaadbcc]
cmovbe ebp, ebx
sub eax, 0xea9ff229
invalid
pop edi
pop esi
pop ebx
ret
add byte [eax], al
add byte [eax - 0x7f], dl
in al, dx
push 0xa100000f
je 0x4250cc
arpl word [eax], ax
Function at 0x427310
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x210], edi
call fcn.00427060
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x44]
call eax
test al, al
je 0x4273f7
call fcn.00460351
test al, al
je 0x427360
fdiv dword [eax + ebp + 0x71]
ret 0x3a6e
call fcn.004602c7
test al, al
je 0x427386
xchg edx, eax
jb 0x42738d
invalid
rol byte [ecx - 0x25a639d1], 1
xor byte [edx + edx*8], ah
cmpsd dword [esi], dword es:[edi]
clc
sbb edx, dword [ecx]
mov edi, dword [ebp - 0x210]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00486960
hlt
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4273c1
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00427e20
call fcn.004600e4
test al, al
je 0x4273da
loopne 0x427372
lcall 0xccc6, 0x67601fbd
sbb dl, byte ss:[esi]
popfd
cmp eax, esp
inc eax
call fcn.004601b3
test al, al
je 0x4273f7
test byte [0x8b725d76], cl
mov ah, 0x14
jl 0x427399
pop esi
xchg ecx, eax
xchg byte [esi], cl
adc esp, esp
aam 0xbc
daa
dec ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00455afe
mov esp, ebp
pop ebp
ret