joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, eax
mov ebx, eax
shr edx, 3
shr ebx, 0xe
mov edi, edx
mov edx, eax
mov dword [ebp - 0x2c], ebx
shr edx, 0xa
and edi, 0xf
mov ecx, edx
xor edx, ebx
and ecx, 1
mov dword [ebp - 0x10], ecx
mov ecx, eax
shr ecx, 0xd
and ecx, 1
mov dword [ebp - 0x14], ecx
mov ecx, eax
shr eax, 0x17
mov ebx, eax
shr ecx, 7
and ebx, 1
and ecx, 7
mov dword [ebp - 0x24], ecx
setne cl
and eax, ecx
and edx, 1
mov dword [ebp - 0x28], edx
je 0x10039490
test al, al
je 0x100394e0
movzx eax, byte [esi]
add esi, dword [ebp - 0x24]
mov edx, eax
shl edx, 8
mov ecx, edx
mov edx, 0x80008001
or eax, ecx
movzx ecx, ax
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov dword [ebp - 0x20], eax
test edi, edi
je 0x100394f8
mov eax, dword [ebp - 0x20]
test eax, eax
setne al
xor ecx, ecx
and eax, ebx
mov byte [ebp - 0x15], al
lea eax, [edi - 1]
mov dword [ebp - 0x1c], eax
nop
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x1c]
sub ebx, ecx
test eax, eax
movzx eax, byte [esi + ecx]
cmove ebx, ecx
mov edx, eax
shl edx, 8
or edx, eax
cmp dword [ebp - 0x14], 0
mov eax, edx
not eax
cmovne edx, eax
cmp byte [ebp - 0x15], 0
movzx eax, dx
je 0x10039421
shl eax, 0x10
xor edx, edx
div dword [ebp - 0x20]
mov edx, 0xffff
cmp eax, 0xffff
cmovbe edx, eax
mov eax, dword [ebp + 0xc]
add ecx, 1
mov word [eax + ebx*2], dx
cmp edi, ecx
ja 0x100393e0
test edi, edi
mov ebx, 1
mov edx, dword [ebp - 0x28]
cmovne ebx, edi
add ebx, esi
test edx, edx
je 0x100394d0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x1003947f
test byte [ebp - 0x2c], 1
je 0x1003947f
mov eax, dword [ebp + 0xc]
movzx esi, word [eax]
lea eax, [edi + edi - 2]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
add eax, 2
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_memmove]
mov eax, dword [ebp + 0xc]
mov word [eax + edi*2 - 2], si
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x20], 1
test al, al
je 0x100394bf
movzx eax, byte [esi + edi]
mov edx, 0x80008001
mov ecx, eax
shl ecx, 8
or eax, ecx
movzx ecx, ax
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov dword [ebp - 0x20], eax
test edi, edi
jne 0x100393c9
mov ebx, esi
lea esi, [esi]
add ebx, dword [ebp - 0x24]
jmp 0x10039446
mov eax, dword [ebp - 0x28]
add esi, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
test edi, edi
jne 0x100393c9
mov ebx, esi
jmp 0x10039446
mov ebx, esi
jmp 0x1003947f
Function at 0x10039f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 4]
mov eax, ebx
mov edx, ebx
mov esi, ebx
mov ecx, ebx
shr eax, 0xb
shr edx, 0xd
shr esi, 0xe
and eax, 1
and edx, 1
shr ecx, 3
mov dword [ebp - 0x10], eax
mov eax, ebx
and ecx, 0xf
shr eax, 0xa
mov dword [ebp - 0x18], edx
mov edx, ebx
shr ebx, 0x17
mov edi, eax
shr edx, 7
xor eax, esi
mov dword [ebp - 0x2c], esi
and edi, 1
mov esi, edx
mov dword [ebp - 0x14], edi
mov edi, ebx
and edi, 1
and esi, 7
setne dl
mov dword [ebp - 0x24], esi
and edx, edi
and eax, 1
mov dword [ebp - 0x28], eax
je 0x1003a098
mov eax, dword [ebp + 0x10]
test dl, dl
je 0x1003a0e0
movzx ebx, word [eax]
mov edx, 0x80008001
lea eax, [ebx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ebx]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
lea esi, [eax + esi*2]
test ecx, ecx
je 0x1003a087
lea ebx, [ecx - 1]
xor eax, eax
mov dword [ebp - 0x1c], ebx
lea esi, [esi]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
sub edx, eax
test ebx, ebx
mov ebx, dword [ebp + 0xc]
cmove edx, eax
movzx ebx, word [ebx + edx*2]
mov edx, ebx
rol dx, 8
cmp dword [ebp - 0x10], 0
cmovne ebx, edx
cmp dword [ebp - 0x18], 0
mov edx, ebx
not edx
cmovne ebx, edx
test edi, edi
je 0x1003a038
movzx ebx, bx
imul ebx, dword [ebp - 0x20]
add ebx, 0x8000
shr ebx, 0x10
mov word [esi + eax*2], bx
add eax, 1
cmp ecx, eax
ja 0x10039ff8
test ecx, ecx
mov edx, 2
lea eax, [ecx + ecx]
cmove eax, edx
mov edx, dword [ebp - 0x28]
add esi, eax
test edx, edx
je 0x1003a0d0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x1003a087
test byte [ebp - 0x2c], 1
je 0x1003a087
lea eax, [ecx + ecx - 2]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_memmove]
mov eax, dword [ebp + 0x10]
mov word [eax], bx
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x20], 0
test dl, dl
je 0x1003a0c0
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
movzx esi, word [eax + ecx*2]
lea eax, [esi + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + esi]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp + 0x10]
xor ebx, ebx
test ecx, ecx
jne 0x10039fec
lea esi, [esi]
mov eax, dword [ebp - 0x24]
lea esi, [esi + eax*2]
jmp 0x1003a059
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
xor ebx, ebx
lea esi, [eax + esi*2]
test ecx, ecx
jne 0x10039fec
jmp 0x1003a059
Function at 0x1003a100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 4]
mov edx, ebx
mov ecx, ebx
mov esi, ebx
shr edx, 0xa
shr esi, 0xe
mov eax, edx
shr ecx, 3
xor edx, esi
mov dword [ebp - 0x28], esi
and eax, 1
and ecx, 0xf
mov dword [ebp - 0x10], eax
mov eax, ebx
shr eax, 0xd
and eax, 1
mov dword [ebp - 0x14], eax
mov eax, ebx
shr ebx, 0x17
mov edi, ebx
shr eax, 7
and edi, 1
and eax, 7
mov dword [ebp - 0x20], eax
mov ebx, eax
setne al
and eax, edi
and edx, 1
mov dword [ebp - 0x24], edx
je 0x1003a258
test al, al
je 0x1003a2b0
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
movzx eax, byte [eax]
mov esi, eax
shl esi, 8
or eax, esi
movzx esi, ax
lea eax, [esi + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + esi]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
add esi, ebx
test ecx, ecx
je 0x1003a248
lea eax, [ecx - 1]
xor edx, edx
mov dword [ebp - 0x18], eax
lea esi, [esi]
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
sub eax, edx
test ebx, ebx
mov ebx, dword [ebp + 0xc]
cmove eax, edx
cmp dword [ebp - 0x14], 0
movzx ebx, word [ebx + eax*2]
mov eax, ebx
not eax
cmovne ebx, eax
movzx eax, bx
test edi, edi
je 0x1003a1dc
imul eax, dword [ebp - 0x1c]
add eax, 0x8000
shr eax, 0x10
mov ebx, eax
imul eax, eax, 0xff01
add eax, 0x800000
shr eax, 0x18
mov byte [esi + edx], al
add edx, 1
cmp ecx, edx
ja 0x1003a1a8
test ecx, ecx
mov eax, 1
mov edx, dword [ebp - 0x24]
cmovne eax, ecx
add esi, eax
test edx, edx
je 0x1003a2a0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x1003a248
test byte [ebp - 0x28], 1
je 0x1003a248
mov eax, dword [ebp + 0x10]
sub ecx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
add eax, 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_memmove]
movzx eax, bx
mov edi, dword [ebp + 0x10]
imul eax, eax, 0xff01
add eax, 0x800000
shr eax, 0x18
mov byte [edi], al
add esp, 0x28
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x1c], 0
test al, al
je 0x1003a28a
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
movzx eax, byte [eax + ecx]
mov ebx, eax
shl ebx, 8
or eax, ebx
movzx ebx, ax
lea eax, [ebx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ebx]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0x10]
xor ebx, ebx
test ecx, ecx
jne 0x1003a19a
mov esi, esi
lea edi, [edi]
add esi, dword [ebp - 0x20]
jmp 0x1003a20b
mov esi, dword [ebp - 0x20]
xor ebx, ebx
add esi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], 0
test ecx, ecx
jne 0x1003a19a
jmp 0x1003a20b
Function at 0x1003eef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x1003ef48
cmp byte [esi + ebx - 1], 0xa
je 0x1003ef1c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10059144], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x1003f570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x1003f748
mov edi, dword [0x10059144]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x1003f657
test byte [0x10042878], 8
jne 0x1003f6f0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10042888], 8
jne 0x1003f6b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1003f5f9
cmp esi, 3
jbe 0x1003f668
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1003f60a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1004b5a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x1003f5f9
mov dword [esp], 0x10042888
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1003f5d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x1003f5d0
mov dword [esp], 0x10042878
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1003f5bb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x1003f5c3
mov eax, 0xffffffff
jmp 0x1003f657
Function at 0x404430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, 0x41c97c
push esi
call edi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x41d8ac], eax
jne 0x404464
push esi
call ebx
test eax, eax
mov dword [0x41d8ac], eax
je 0x404574
mov esi, 0x41c9a8
push esi
call edi
xor edi, edi
cmp eax, edi
mov dword [0x41d8b4], eax
jne 0x404487
push esi
call ebx
cmp eax, edi
mov dword [0x41d8b4], eax
je 0x404574
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x41c9d0
push dword [0x41d8ac]
call esi
push 0x41ca18
push dword [0x41d8b4]
mov dword [0x41d8a8], eax
call esi
cmp dword [0x41d8a8], edi
mov dword [0x41d8b8], eax
je 0x40455e
cmp eax, edi
je 0x40455e
mov dword [0x41d8a4], edi
mov dword [0x41d8b0], edi
call fcn.00403982
call fcn.00403d9b
call fcn.0040433d
call fcn.00403a5d
push dword [0x41d8ac]
mov esi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
call esi
push dword [0x41d8b4]
call esi
lea eax, [ebp - 4]
push eax
call fcn.00403499
mov edi, eax
test edi, edi
pop ecx
je 0x404557
push dword [ebp - 4]
push edi
call fcn.00401a80
push 0x4050ac
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x40454f
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
push 1
lea eax, [ebp - 4]
push 4
push eax
call esi
push ebx
push dword [ebp - 4]
push 1
push edi
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
call fcn.004033d8
jmp 0x404574
push dword [0x41d8ac]
mov esi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
call esi
push dword [0x41d8b4]
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404579
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push 0x4050ac
push dword [esp + 0x10]
xor edi, edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4045bb
push esi
push dword [esp + 0x18]
push 1
push dword [esp + 0x1c]
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, dword [esp + 0x14]
jne 0x4045b1
xor edi, edi
inc edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
ret
Function at 0x401d5d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e120]
jne 0x401d67
repz ret
jmp fcn.004032a0

Function at 0x421d93
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040b1bc
and dword [ebp - 4], 0
cmp dword [0x4ffe7c], 0
mov ebx, eax
jne 0x421e44
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421ef5
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x421ef5
push eax
call fcn.0040b14a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ffe7c], eax
call esi
push eax
call fcn.0040b14a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ffe80], eax
call esi
push eax
call fcn.0040b14a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ffe84], eax
call esi
push eax
call fcn.0040b14a
pop ecx
mov dword [0x4ffe8c], eax
test eax, eax
je 0x421e44
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040b14a
pop ecx
mov dword [0x4ffe88], eax
mov eax, dword [0x4ffe88]
cmp eax, ebx
je 0x421e9c
cmp dword [0x4ffe8c], ebx
je 0x421e9c
push eax
call fcn.0040b1c5
push dword [0x4ffe8c]
mov esi, eax
call fcn.0040b1c5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x421e9c
test edi, edi
je 0x421e9c
call esi
test eax, eax
je 0x421e93
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x421e93
test byte [ebp - 0xc], 1
jne 0x421e9c
or dword [ebp + 0x10], 0x200000
jmp 0x421ed5
mov eax, dword [0x4ffe80]
cmp eax, ebx
je 0x421ed5
push eax
call fcn.0040b1c5
pop ecx
test eax, eax
je 0x421ed5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421ed5
mov eax, dword [0x4ffe84]
cmp eax, ebx
je 0x421ed5
push eax
call fcn.0040b1c5
pop ecx
test eax, eax
je 0x421ed5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ffe7c]
call fcn.0040b1c5
pop ecx
test eax, eax
je 0x421ef5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421ef7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x428530
Capabilities:
Get geographical location
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x42e120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4fff60
lea edx, [eax + 1]
jmp 0x428550
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428550
sub eax, edx
cmp eax, 0xb05b7
jne 0x4285ed
cmp dword [0x4d67334], 0x212
jne 0x42857c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_OpenFileMappingA]
cmp dword [0x4d67334], 0x3d3
jne 0x42859b
push 0
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
push 4
push str.duku
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x408], 0xf
mov dword [ebp - 0x40c], 0
mov byte [ebp - 0x41c], 0
call fcn.00401330
push str.Wire_daduwi__s__d__f
call fcn.00402393
add esp, 4
cmp dword [ebp - 0x408], 0x10
jb 0x4285ed
mov ecx, dword [ebp - 0x41c]
push ecx
call fcn.00402409
add esp, 4
mov eax, dword [0x4d67334]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GlobalDeleteAtom]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
xor esi, esi
cmp eax, 0x976
jne 0x42861f
push 0
call edi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov eax, dword [0x4d67334]
cmp eax, 0xcd2
jne 0x428635
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetSystemTimeAdjustment]
mov eax, dword [0x4d67334]
cmp esi, 0x21e49f
jle 0x428649
cmp dword [ebp - 0x418], 0x7239c9ee
jne 0x4286aa
inc esi
cmp esi, 0x38f964ff
jl 0x428603
xor esi, esi
cmp eax, 0xd47
jne 0x428679
mov edx, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x424]
push esi
push esi
push edx
lea eax, [ebp - 0x404]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileExW]
call fcn.004280c0
cmp dword [0x4d67334], 0x5aa
jne 0x428695
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileWithProgressA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401d5d
mov esp, ebp
pop ebp
ret 0x10
xor esi, esi
mov dword [0x4d66f90], esi
mov dword [0x4d66f94], esi
cmp eax, 0x801
jne 0x428654
mov dword [0x4d67328], esi
jmp 0x428679
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x447004]
jne 0x40100a
repz ret
jmp fcn.004015b9

Function at 0x4053eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403eca
and dword [ebp - 0x14], 0
cmp dword [0x449d68], 0
mov dword [ebp - 0x18], eax
jne 0x40549e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405546
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405546
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x449d68], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x449d6c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x449d70], eax
call edi
push eax
call esi
mov dword [0x449d78], eax
test eax, eax
je 0x40549e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x449d74], eax
mov eax, dword [0x449d74]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4054f7
cmp dword [0x449d78], ecx
je 0x4054f7
push eax
call esi
push dword [0x449d78]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4054f7
test ebx, ebx
je 0x4054f7
call edi
test eax, eax
je 0x4054ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4054ee
test byte [ebp - 8], 1
jne 0x4054f7
or dword [ebp + 0x10], 0x200000
jmp 0x40552a
mov eax, dword [0x449d6c]
cmp eax, dword [ebp - 0x18]
je 0x40552a
push eax
call esi
test eax, eax
je 0x40552a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40552a
mov eax, dword [0x449d70]
cmp eax, dword [ebp - 0x18]
je 0x40552a
push eax
call esi
test eax, eax
je 0x40552a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x449d68]
call esi
test eax, eax
je 0x405546
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405548
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x442e10
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x804
mov eax, dword [0x447004]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x838930]
imul eax, eax, 0x343fd
cmp dword [0x83ada4], 0x139e
mov dword [0x838930], eax
jne 0x442e51
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
mov eax, dword [0x838930]
add eax, 0x269ec3
push esi
mov dword [0x838930], eax
movzx esi, word [0x838932]
and esi, 0x7fff
cmp dword [0x83ada4], 0x8e7
jne 0x442e86
push 0
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x804]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret

Function at 0x442ed0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x442ee4
call fcn.00442e10
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x442ed7
pop esi
cmp ebx, 0x2d
jne 0x442efe
mov dword [0x83adb0], 0xa62e7790
mov dword [0x83adb4], 0xffffffff
ret

Function at 0x442f00
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x4481e8]
sub esp, 0x14
push ebx
mov ebx, dword [0x83ada4]
push edi
mov edi, dword [0x838934]
call fcn.00442ea0
cmp dword [0x83ada4], 0x2f
jne 0x442f5a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00442ed0
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x443260
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409f80
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x443289
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0f4a
jge 0x443331
cmp dword [0x83ada4], 0xa5f
jne 0x4432d5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.zayekezipusunagozisanuhima
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84620b
jne 0x4432fa
mov eax, dword [0x449008]
mov dword [0x83ada4], eax
mov ecx, dword [0x83ada4]
add ecx, 0xa231
mov dword [0x83ada4], ecx
cmp dword [0x83ada4], 0x141
jne 0x44332c
push str.wucusipeyekexe_zelisapecuyozabozecaxufer_miweyumeriwosizupuyubahu_regorekuzet_begazixezibunodumekacefasuhato
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x44a2a8], 0xec58acac
mov dword [0x44a2ac], 0xffffffff
jmp 0x443280
call fcn.00442f70
jmp dword [0x838934]