joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023a0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x4c]
push esi
mov esi, dword [eax]
push edi
mov edi, dword [ebp + 0x34]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
lea esp, [esp]
mov ebx, dword [ebp + 0x4c]
mov eax, dword [ebp + 0x34]
test edi, edi
je 0x4023ce
cmp edi, eax
je 0x4023d3
call fcn.0041976e
cmp esi, ebx
je 0x4024c2
test edi, edi
jne 0x40241e
call fcn.0041976e
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x4023f0
call fcn.0041976e
cmp dword [esi + 0x28], 1
jne 0x4024ac
test edi, edi
jne 0x402422
call fcn.0041976e
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x40240f
call fcn.0041976e
mov ebx, 0x10
cmp dword [esi + 0x24], ebx
jb 0x402426
mov eax, dword [esi + 0x10]
jmp 0x402429
mov eax, dword [edi]
jmp 0x4023e6
mov eax, dword [edi]
jmp 0x402405
lea eax, [esi + 0x10]
push eax
push str.RemoveInstallFiles:
mov ecx, ebp
call fcn.00401da0
test edi, edi
jne 0x402455
call fcn.0041976e
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x40244b
call fcn.0041976e
cmp dword [esi + 0x24], ebx
jb 0x402459
mov eax, dword [esi + 0x10]
jmp 0x40245c
mov eax, dword [edi]
jmp 0x402441
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4024ac
test edi, edi
jne 0x402484
call fcn.0041976e
cmp esi, dword [edi + 0x18]
jne 0x40247a
call fcn.0041976e
cmp dword [esi + 0x24], ebx
jb 0x402488
mov esi, dword [esi + 0x10]
jmp 0x40248a
mov edi, dword [edi]
jmp 0x402470
add esi, ebx
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [ebp + 4]
push 0
mov dword [ecx], 1
push str.Warning:__Reboot_required_to_complete_operation_
mov ecx, ebp
call fcn.00401da0
lea ecx, [esp + 0x10]
call fcn.00401b10
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
jmp 0x4023c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4030e0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x120
mov eax, dword [0x436ee0]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov ebx, dword [esp + 0x130]
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, dword [esp + 0x134]
push 0x104
lea eax, [esp + 0x25]
push 0
push eax
mov byte [esp + 0x2c], 0
call fcn.004193f0
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40317b
lea eax, [esp + 0x20]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403140
sub eax, edx
push eax
lea edx, [esp + 0x24]
push edx
mov ecx, ebx
call fcn.004026b0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00418f7f
add esp, 0x120
ret 0xc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx edx, word [esp + 0x1e]
movzx eax, word [esp + 0x1c]
movzx ecx, word [esp + 0x1a]
push edx
push eax
push ecx
push esi
push edi
push str._s_s__d_d_d.tmp
lea edx, [esp + 0x38]
push 0x104
push edx
call fcn.00419b35
add esp, 0x20
test eax, eax
jle 0x4031dc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4031c4
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
mov ecx, ebx
call fcn.004026b0
jmp 0x403161
push 8
call fcn.0040e8cc
mov esi, eax
add esp, 4
test esi, esi
je 0x403208
mov ecx, 0x13
mov edx, 0x312
mov word [esi], cx
mov word [esi + 2], dx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
jmp 0x40320a
xor esi, esi
push 0x432610
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], esi
call fcn.0041977e
int3
Function at 0x404ee0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x428e20
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x436ee0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x436ee0]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x68]
xor ebx, ebx
mov eax, 0xf
mov ebp, ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov eax, esi
mov byte [esp + 0x5c], 1
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x404f50
sub eax, ecx
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.004026b0
push 1
push 0x42a8a0
lea ecx, [esp + 0x20]
call fcn.00402790
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404f80
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.00402790
lea eax, [esp + 0x34]
push eax
push esi
push edi
mov ecx, ebp
call fcn.004030e0
mov ecx, dword [esp + 0x38]
mov esi, 0x10
cmp dword [esp + 0x4c], esi
jae 0x404fb5
lea ecx, [esp + 0x38]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x404fc3
lea eax, [esp + 0x1c]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x405012
push 8
call fcn.0040e8cc
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x404ffd
mov ecx, 0x13
mov edx, 0x294
mov word [esi], cx
mov word [esi + 2], dx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
jmp 0x404fff
xor esi, esi
push 0x432610
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], esi
call fcn.0041977e
lea ecx, [esp + 0x18]
push ecx
lea ecx, [ebp + 0x94]
call fcn.00404c00
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x3c]
push edx
mov ecx, eax
call fcn.004025d0
cmp dword [esp + 0x30], esi
jb 0x405044
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040e8fb
add esp, 4
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x4c], esi
jb 0x405067
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0040e8fb
add esp, 4
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00418f7f
add esp, 0x4c
ret 8
Function at 0x4054f0
Capabilities:
Create directory

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
push str.CreateDirectory:
mov esi, ecx
call fcn.00401da0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40555c
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x405564
push 8
call fcn.0040e8cc
mov esi, eax
add esp, 4
test esi, esi
je 0x405547
mov eax, 0x13
mov ecx, 0x3d0
mov word [esi], ax
mov word [esi + 2], cx
call edi
mov dword [esi + 4], eax
jmp 0x405549
xor esi, esi
push 0x432610
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], esi
call fcn.0041977e
push edi
mov ecx, esi
call fcn.00404e40
pop edi
pop esi
ret 4

Function at 0x4059e0
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 0xac]
mov eax, dword [eax]
push ebx
push ebp
push esi
lea esi, [ecx + 0x94]
push edi
mov edi, dword [esi]
mov ebp, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov ebx, dword [esi + 0x18]
mov eax, dword [esi]
test edi, edi
je 0x405a12
cmp edi, eax
je 0x405a17
call fcn.0041976e
cmp ebp, ebx
je 0x405a5a
test edi, edi
jne 0x405a39
call fcn.0041976e
cmp ebp, dword [edi + 0x18]
jne 0x405a2e
call fcn.0041976e
cmp dword [ebp + 0x40], 0x10
jb 0x405a3d
mov eax, dword [ebp + 0x2c]
jmp 0x405a40
mov edi, dword [edi]
jmp 0x405a24
lea eax, [ebp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
call fcn.00401aa0
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
jmp 0x405a05
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx + 4]
push edx
mov ecx, esi
call fcn.00403220
mov eax, dword [esi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x18]
xor edi, edi
mov dword [esi + 0x1c], edi
mov dword [eax], eax
mov esi, dword [esi + 0x18]
mov dword [esi + 8], esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xcc]
mov ecx, dword [eax + 4]
add esi, 0xb4
push ecx
mov ecx, esi
call fcn.00405880
mov eax, dword [esi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], edi
mov dword [eax], eax
mov esi, dword [esi + 0x18]
pop edi
mov dword [esi + 8], esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x407ca0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x407d28
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x407d27
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407cc6
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
mov edx, dword [edi + 4]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edx
call esi
test eax, eax
je 0x407d27
mov edx, dword [esp + 0x10]
test edx, edx
je 0x407d13
mov eax, edx
push ebx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407cf6
push 0
lea ecx, [esp + 0x14]
push ecx
sub eax, ebx
push eax
push edx
mov edx, dword [edi + 4]
push edx
call esi
pop ebx
test eax, eax
je 0x407d27
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push 2
push 0x42aa14
push ecx
call esi
pop esi
pop edi
ret 8

Function at 0x407e10
Capabilities:
Get file size
Read file on windows
Set registry value
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x407e33
mov ecx, dword [esi + 0xc]
push 4
lea eax, [esi + 0x1c]
push eax
push 4
push 0
push str.LogLevel
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esi + 0x20]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x407f06
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [esi + 0x18]
cmp edi, eax
jbe 0x407efb
sub edi, eax
cmp edi, 0x200000
jae 0x407efb
push ebx
push 0
push 0
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x407efa
mov edx, dword [esi + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407eec
push 0
push str._SetupApi_log_begin_
mov ecx, esi
call fcn.00407da0
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push str._SetupApi_log_end_
mov ecx, esi
call fcn.00407da0
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop ebx
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret

Function at 0x408730
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
push 0x40
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
push ecx
add eax, 0x1c
push eax
call fcn.004193f0
add esp, 0xc
ret
Function at 0x408950
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x436ee0]
xor eax, esp
mov dword [esp + 0x108], eax
mov edx, dword [esp + 0x114]
lea eax, [edx - 5]
push esi
mov esi, dword [esp + 0x114]
cmp eax, 0xfe
ja 0x4089ea
mov al, 0x5c
cmp byte [ecx + 8], al
jne 0x4089ea
cmp byte [ecx + 9], al
jne 0x4089ea
cmp byte [ecx + 0xa], 0x3f
jne 0x4089ea
cmp byte [ecx + 0xb], al
jne 0x4089ea
cmp byte [edx + ecx + 7], al
jne 0x4089ea
lea ecx, [esp + 4]
push ecx
push 0x104
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x4089ea
cmp dword [esp + 4], 2
jbe 0x4089ea
mov al, byte [esp + 8]
cmp al, 0x43
jl 0x4089c7
cmp al, 0x5a
jle 0x4089cd
sub al, 0x63
cmp al, 0x17
ja 0x4089ea
mov eax, 1
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00418f7f
add esp, 0x10c
ret 8
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00418f7f
add esp, 0x10c
ret 8
Function at 0x408f40
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4291d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x436ee0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.0040ee20
xor ecx, ecx
xor ebp, ebp
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x408f83
push 0x80004005
call fcn.00408a10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ebp
call fcn.0040ee20
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x408fb1
push 0x80004005
call fcn.00408a10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esp + 0x30]
push str.zs_usbsrv_setup.log
push ecx
lea edx, [esp + 0x1c]
push str._s_s
push edx
mov byte [esp + 0x38], 2
call fcn.00408dc0
add esp, 0x10
push 0x13
push str.ZS_ISP_Version_6.12
lea ecx, [esp + 0x20]
call fcn.00408cb0
mov ebx, dword [esp + 0x14]
push ebp
push 0x80
push 2
push ebp
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [esp + 0x18]
mov esi, eax
cmp esi, 0xffffffff
je 0x40903f
mov eax, dword [edi - 0xc]
push 0
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xffffffff
je 0x409052
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov byte [esp + 0x28], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409073
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409097
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x4090b0
Capabilities:
Enumerate disk volumes
Get common file path

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
lea esi, [edi + 8]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4090e5
cmp byte [eax + edi + 7], 0x5c
jne 0x4090d4
mov byte [eax + edi + 7], 0
push esi
mov ecx, edi
call fcn.00408f40
cmp eax, 1
je 0x4091f9
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x409130
cmp byte [eax + edi + 7], 0x5c
jne 0x409101
mov byte [eax + edi + 7], 0
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409104
mov ecx, dword [str.Temp]
mov dword [eax], ecx
mov dx, word [0x42abd4]
push esi
mov ecx, edi
mov word [eax + 4], dx
call fcn.00408f40
cmp eax, 1
je 0x4091f9
push ebx
push ebp
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409193
push 0x104
push esi
call fcn.0041a2d1
add esp, 8
mov ebp, eax
push ebp
push esi
mov ecx, edi
call fcn.00408950
test eax, eax
je 0x40917b
cmp byte [edi + ebp + 7], 0x5c
jne 0x40916e
mov byte [edi + ebp + 7], 0
push esi
mov ecx, edi
call fcn.00408f40
cmp eax, 1
je 0x4091f0
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
test eax, eax
jne 0x409145
push ebx
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4091c4
push 0x5c
push esi
call fcn.0041a0c0
add esp, 8
test eax, eax
je 0x4091c4
push esi
mov ecx, edi
mov byte [eax], 0
call fcn.00408f40
cmp eax, 1
je 0x4091f7
push 8
call fcn.0040e8cc
mov esi, eax
add esp, 4
test esi, esi
je 0x4091fd
mov eax, 0x1003
mov ecx, 0x9c
mov word [esi], ax
mov word [esi + 2], cx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
jmp 0x4091ff
push ebx
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
xor esi, esi
push 0x432610
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], esi
call fcn.0041977e
int3
Function at 0x418f7f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436ee0]
jne 0x418f89
repz ret
jmp fcn.0041f0cc

Function at 0x425761
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041eab4
and dword [ebp - 4], 0
cmp dword [0x43aab8], 0
mov ebx, eax
jne 0x425812
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4258c3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43101c
push edi
call esi
test eax, eax
je 0x4258c3
push eax
call fcn.0041ea42
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43aab8], eax
call esi
push eax
call fcn.0041ea42
mov dword [esp], 0x430ff8
push edi
mov dword [0x43aabc], eax
call esi
push eax
call fcn.0041ea42
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43aac0], eax
call esi
push eax
call fcn.0041ea42
pop ecx
mov dword [0x43aac8], eax
test eax, eax
je 0x425812
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041ea42
pop ecx
mov dword [0x43aac4], eax
mov eax, dword [0x43aac4]
cmp eax, ebx
je 0x42586a
cmp dword [0x43aac8], ebx
je 0x42586a
push eax
call fcn.0041eabd
push dword [0x43aac8]
mov esi, eax
call fcn.0041eabd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42586a
test edi, edi
je 0x42586a
call esi
test eax, eax
je 0x425861
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425861
test byte [ebp - 0xc], 1
jne 0x42586a
or dword [ebp + 0x10], 0x200000
jmp 0x4258a3
mov eax, dword [0x43aabc]
cmp eax, ebx
je 0x4258a3
push eax
call fcn.0041eabd
pop ecx
test eax, eax
je 0x4258a3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4258a3
mov eax, dword [0x43aac0]
cmp eax, ebx
je 0x4258a3
push eax
call fcn.0041eabd
pop ecx
test eax, eax
je 0x4258a3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43aab8]
call fcn.0041eabd
pop ecx
test eax, eax
je 0x4258c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4258c5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40446e
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x404f98
call fcn.0040488b
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x4065fc
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x40420d
cmp eax, esi
jne 0x404200
xor esi, esi
inc esi
mov ebx, esi
jmp 0x404210
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4041e7
xor esi, esi
inc esi
mov eax, dword [0x4065f8]
cmp eax, esi
jne 0x404223
push 0x1f
call fcn.00495000
pop ecx
jmp 0x404252
mov eax, dword [0x4065f8]
test eax, eax
jne 0x40424c
mov dword [0x4065f8], esi
push 0x4011f4
push 0x4011ec
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x404252
jmp 0x40437a
mov dword [0x406290], esi
mov eax, dword [0x4065f8]
cmp eax, esi
jne 0x404276
push 0x4011e8
push 0x4011d8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x4065f8], 2
test ebx, ebx
jne 0x404282
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x406608], 0
je 0x4042a6
push 0x406608
call fcn.00404813
pop ecx
test eax, eax
je 0x4042a6
push 0
push 2
push 0
call dword [0x406608]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x404302
test al, al
je 0x4042c0
cmp dword [ebp - 0x1c], 0
jne 0x404302
mov al, byte [esi]
test al, al
je 0x4042d0
cmp al, 0x20
ja 0x4042d0
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4042c0
test byte [ebp - 0x3c], 1
je 0x4042dc
movzx eax, word [ebp - 0x38]
jmp 0x4042df
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40628c], eax
cmp dword [0x406280], 0
jne 0x404356
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x404311
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x404324
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x4042ad
cmp dword [0x406290], 0
jne 0x404365
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40628c]
jmp 0x404386
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.004048d0
ret
call fcn.00403b1b
jmp 0x4041ad
Function at 0x10001000
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x1001a050]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 8]
push ebx
xor edx, edx
push esi
push edi
mov dword [esp + 0xc], ecx
cmp ecx, edx
jne 0x10001039
lea eax, [edx + 2]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.1000f5b7
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x74], edx
mov dword [esp + 0x70], edx
mov ecx, 8
mov esi, 0x100186d8
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
push ecx
push eax
lea ebx, [esp + 0x18]
call fcn.100010a0
mov esi, ebx
call fcn.100015a0
mov edx, dword [ebp + 0x10]
mov ecx, dword [esp + 0x14]
push edx
mov eax, ebx
push eax
push ecx
call fcn.10013090
mov ecx, dword [esp + 0x90]
add esp, 0x14
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1000f5b7
mov esp, ebp
pop ebp
ret

Function at 0x100010a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1001a050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1000134f
push edi
cmp dword [ebx + 0x64], 0
jne 0x10001318
cmp esi, 0x40
jb 0x10001314
lea ecx, [ebp - 0x11e]
sub ecx, dword [ebp + 8]
mov eax, esi
shr eax, 6
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x134], eax
lea ecx, [ecx]
mov eax, dword [ebp + 8]
xor edx, edx
add eax, 2
jmp 0x10001100
movzx esi, byte [eax - 2]
movzx edi, byte [eax - 1]
shl esi, 8
or esi, edi
movzx edi, byte [eax]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 1]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 3]
mov dword [ebp + edx*4 - 0x124], esi
movzx esi, byte [eax + 2]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 4]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 5]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 7]
mov dword [eax + ecx - 4], esi
movzx esi, byte [eax + 6]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 8]
and dword [ebp - 4], 0
mov eax, dword [edi]
pop es
mov dword [ebp - 0x10], eax
call fcn.100011e8
xor eax, 0x8302612b
jge 0x10001319
add byte [ebx + eax*2 - 0x75], dh
inc ebp
in al, dx
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, dword [ebp - 4]
jne 0x1000135b
mov eax, dword [ebp - 0xc]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, dword [ebp + 8]
push eax
call fcn.1000117e
pop ecx
test eax, eax
pop ecx
je 0x10001382
mov eax, dword [esi + 0x18]
inc dword [ebp - 0x10]
add dword [ebp - 8], 2
add dword [ebp - 0xc], 4
dec eax
cmp dword [ebp - 0x10], eax
jbe 0x10001339
mov eax, dword [esi + 0x14]
inc dword [ebp - 4]
dec eax
cmp dword [ebp - 4], eax
jbe 0x10001318
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 4]
mov eax, dword [edi + eax*4]
jmp 0x100013bf
add eax, dword [ebp + 8]
jmp 0x1000137d