joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4346e2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
lea eax, [ebx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 4]
mov esi, dword [ebx]
sub eax, esi
push 0x28
cdq
pop edi
idiv edi
test eax, eax
jle 0x434779
cmp esi, dword [ebx + 4]
je 0x434779
lea ecx, [esi + 0x14]
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 8]
test eax, 0xfffffffc
jne 0x434730
cmp dword [esi], 0
je 0x43473b
mov eax, dword [ecx]
sub eax, dword [ecx - 4]
sar eax, 2
cmp eax, dword [0x549e4c]
jae 0x43473b
add esi, edi
add ecx, edi
cmp esi, dword [ebx + 4]
jne 0x43470e
jmp 0x434779
lea edi, [esi + 0xc]
push edi
lea ecx, [ebx + 0xc]
call fcn.00410e2c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
push 0
test eax, eax
je 0x434765
push 0
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x43476d
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
lea eax, [ebp - 4]
mov ecx, ebx
push eax
call fcn.0043546b
lea eax, [ebx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434afe
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x4ffd73
call fcn.004e6cb7
mov esi, ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
je 0x434b1e
xor edi, edi
inc edi
jmp 0x434bdb
lea ebx, [esi + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
xor edi, edi
sub eax, dword [esi]
push 0x28
cdq
pop ecx
idiv ecx
xor edx, edx
test eax, eax
jle 0x434b67
mov ecx, dword [esi]
cmp dword [ecx], edi
jne 0x434b4b
inc edx
add ecx, 0x28
cmp edx, eax
jl 0x434b3d
jmp 0x434b67
imul eax, edx, 0x28
sub esp, 0x28
mov ecx, esp
add eax, dword [esi]
push eax
call fcn.00434aae
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00434979
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x434bdb
push 0x14
call fcn.004da35a
mov esi, eax
xor ebx, ebx
pop ecx
test esi, esi
je 0x434ba0
mov eax, dword [0x548750]
mov dword [esi], eax
mov eax, dword [0x548750]
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 1
jmp 0x434ba2
mov esi, ebx
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.00402aef
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 4]
call fcn.00402aef
mov eax, dword [ebp + 0x10]
push ebx
push ebx
push esi
push 0x4352a6
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp + 0xc]
call fcn.00403080
lea ecx, [ebp + 8]
call fcn.00403080
mov eax, edi
call fcn.004e6c85
ret 0x14
Function at 0x435037
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x270], edx
push edi
push 0
push 0x1f0fff
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4350ae
and dword [ebp - 0x30], 0
lea edi, [ebp - 0x2c]
push 9
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 0x28
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessMemoryInfo]
test eax, eax
je 0x4350a1
mov ecx, dword [ebp - 0x270]
mov eax, dword [ebp - 0x24]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x26c]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x435120
push 0x228
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.004deff0
add esp, 0xc
mov dword [ebp - 0x264], 0x22c
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x435105
cmp dword [ebp - 0x25c], edi
je 0x43510b
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4350ef
jmp 0x435119
mov ecx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x250]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.004d9731
mov esp, ebp
pop ebp
ret

Function at 0x435130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x435172
mov eax, dword [ebp + 8]
cmp dword [esi + 0xc], eax
je 0x43515b
add esi, 0x28
cmp esi, dword [edi + 4]
jne 0x43514c
jmp 0x435172
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0043546b
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc dword [edi + 0x30]
push 0
push 0
push 0x4ad
push dword [0x54dbe0]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x435309
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
sub eax, dword [esi]
push 0x28
cdq
pop ecx
idiv ecx
mov ebx, eax
test ebx, ebx
jle 0x43535a
xor edi, edi
mov eax, dword [esi]
push dword [eax + edi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435354
mov eax, dword [esi]
push 0
push 1
push 0x10
push dword [edi + eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
add edi, 0x28
dec ebx
jne 0x435332
push dword [esi + 4]
push dword [esi]
call fcn.00424d4e
mov eax, dword [esi]
mov dword [esi + 4], eax
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00435642
test eax, eax
je 0x4353a2
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x435373
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435642
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x435746
push 0x228
lea eax, [ebp - 0x65c]
push edi
push eax
call fcn.004deff0
add esp, 0xc
mov dword [ebp - 0x660], 0x22c
lea eax, [ebp - 0x660]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
push 0x424
mov esi, eax
lea eax, [ebp - 0x42c]
push edi
push eax
call fcn.004deff0
add esp, 0xc
mov dword [ebp - 0x430], 0x428
lea ecx, [ebp - 0x664]
push 0x5256c8
call fcn.00404fa0
test esi, esi
je 0x435734
push dword [ebp - 0x658]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x43571a
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x664]
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x43571a
cmp dword [ebp - 0x428], edi
jne 0x43572e
lea eax, [ebp - 0x660]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4356d0
jmp 0x435734
mov edi, dword [ebp - 0x428]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x664]
call fcn.00403080
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x4357d0
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x4ffe74
call fcn.004e6cb7
mov esi, ecx
test esi, esi
je 0x4358cd
push esi
lea ecx, [ebp - 0x1c]
call fcn.00404fa0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push esi
call fcn.00404fa0
push dword [0x549e80]
mov esi, dword [ebp - 0x1c]
mov ebx, 0x525878
push esi
push str.hwid
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [0x548750]
mov dword [ebp - 0x18], eax
push str.kw.ini
push 0x54e030
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push 0x511e14
push eax
call fcn.0040306c
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x28]
add esp, 0x10
mov dword [ebp - 0x28], vtable.CIniFile.0
push dword [ebp - 0x18]
call fcn.00433da9
push dword [ebp - 0x24]
push esi
push str.hwid
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 0x20006
push ebx
push str.Software6wanGame
push SysReAllocStringLen
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4358ad
mov eax, dword [esi - 8]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push str.hwid
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.00433ed4
lea ecx, [ebp - 0x18]
call fcn.00403080
lea ecx, [ebp - 0x20]
call fcn.00403080
lea ecx, [ebp - 0x1c]
call fcn.00403080
call fcn.004e6c85
ret
Function at 0x4358d3
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0x224
mov eax, 0x4ffe9a
call fcn.004e6cea
mov edi, ecx
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x230], ebx
call fcn.004deff0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x21c]
add esp, 0xc
push dword [0x549e80]
push 0x104
push eax
mov eax, 0x512700
push eax
push str.hwid
push 0x525878
call esi
cmp word [ebp - 0x21c], bx
je 0x435945
xor esi, esi
inc esi
jmp 0x435a5d
mov eax, dword [0x548750]
mov dword [ebp - 0x220], eax
push str.kw.ini
push 0x54e030
lea eax, [ebp - 0x220]
mov dword [ebp - 4], ebx
push 0x511e14
push eax
call fcn.0040306c
add esp, 0x10
mov dword [ebp - method.CIniFile.virtual_0], vtable.CIniFile.0
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x224], ebx
push dword [ebp - 0x220]
call fcn.00433da9
push dword [ebp - 0x224]
lea eax, [ebp - 0x21c]
push 0x104
push eax
push 0x512700
push str.hwid
push 0x525878
call esi
xor eax, eax
lea ecx, [ebp - 0x228]
mov esi, ebx
inc eax
cmp word [ebp - 0x21c], si
cmovne esi, eax
call fcn.00433ed4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00403080
test esi, esi
jne 0x435a5d
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], ebx
push eax
push 0x20019
push ebx
push str.Software6wanGame
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x435a5d
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x224], 1
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x22c], 0x208
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
push str.hwid
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x21c], si
push 1
pop eax
cmovne esi, eax
test esi, esi
lea ecx, [ebp - 0x21c]
mov eax, 0x512700
cmove ecx, eax
push ecx
mov ecx, edi
call fcn.00404fa0
mov eax, edi
call fcn.004e6c99
ret
Function at 0x435ba2
Capabilities:
Get common file path
Read .ini file

Disassembly:
push 0xc
mov eax, 0x4ffed2
call fcn.004e6cb7
push 0x208
xor ebx, ebx
mov esi, 0x54dbe8
push ebx
push esi
call fcn.004deff0
add esp, 0xc
push ebx
push 0x23
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [esi - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x435bd2
push 5
pop ecx
mov esi, 0x5258e4
rep movsd dword es:[edi], dword [esi]
call fcn.00433651
mov ecx, 0x54dbe8
lea edi, [ecx - 2]
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, bx
jne 0x435bf5
mov eax, dword [0x513338]
mov dword [edi], eax
mov eax, dword [0x548750]
mov dword [ebp - 0x14], eax
push str.AllUser.ini
push ecx
mov esi, 0x511e14
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0040306c
add esp, 0x10
mov ecx, 0x549e7c
push dword [ebp - 0x14]
call fcn.00433da9
mov eax, dword [0x548750]
mov dword [ebp - 0x10], eax
push str.Channel.ini
push 0x54e030
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push esi
push eax
call fcn.0040306c
add esp, 0x10
push dword [ebp - 0x10]
push 0x104
push 0x54d9b8
push str.dzb6wan
push str.name
push 0x525944
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x10]
call fcn.00403080
lea ecx, [ebp - 0x14]
call fcn.00403080
call fcn.004e6c85
ret
Function at 0x435f90
Capabilities:
Read .ini file

Disassembly:
push 0x218
mov eax, 0x4fe4fa
call fcn.004e6cea
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00404fa0
xor ebx, ebx
lea ecx, [ebp - 0x21c]
push 0x5259c0
mov dword [ebp - 4], ebx
call fcn.0040e832
mov edi, eax
cmp edi, 0xffffffff
je 0x4360ca
push edi
push 0x5f
lea ecx, [ebp - 0x21c]
call fcn.0040e53a
mov esi, eax
cmp esi, 0xffffffff
jne 0x435ff9
push edi
push 0x2e
lea ecx, [ebp - 0x21c]
call fcn.0040e53a
mov esi, eax
cmp esi, 0xffffffff
je 0x4360ca
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004deff0
mov eax, dword [0x548750]
mov dword [ebp - 0x220], eax
push str.Channel.ini
push 0x54e030
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 1
push 0x511e14
push eax
call fcn.0040306c
add esp, 0x1c
lea eax, [ebp - 0x218]
push dword [ebp - 0x220]
push 0x104
push eax
push 0x512700
push str.oldversion
push 0x525944
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x436071
sub ecx, edx
sar ecx, 1
jne 0x4360bf
sub esi, edi
lea eax, [ebp - 0x224]
push esi
push edi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040e7cd
push dword [ebp - 0x220]
push dword [ebp - 0x224]
push str.name
push 0x525944
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x224]
call fcn.00403080
lea ecx, [ebp - 0x220]
call fcn.00403080
lea ecx, [ebp - 0x21c]
call fcn.00403080
call fcn.004e6c99
ret
Function at 0x436b9c
Capabilities:
Get disk information

Disassembly:
push 0x444
mov eax, 0x4fff62
call fcn.004e6cea
mov esi, ecx
mov dword [ebp - 0x440], esi
mov eax, dword [0x54f358]
xor ecx, ecx
mov dword [ebp - 0x43c], ecx
test al, 1
jne 0x436bec
push str.GetDiskFreeSpaceExW
or eax, 1
push str.kernel32.dll
mov dword [0x54f358], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x54f35c], eax
xor ecx, ecx
jmp 0x436bf1
mov eax, dword [0x54f35c]
test eax, eax
jne 0x436c06
push 0x512700
mov ecx, esi
call fcn.00404fa0
jmp 0x436d23
xor eax, eax
push 0x40e
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ecx
push eax
call fcn.004deff0
add esp, 0xc
lea edi, [ebp - 0x420]
mov eax, edi
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
lea ecx, [ebp - 0x424]
mov eax, edi
mov dword [ebp - 0x444], ebx
push eax
call fcn.00404fa0
xor eax, eax
xorps xmm0, xmm0
mov dword [ebp - 4], eax
movlpd qword [ebp - 0x430], xmm0
test ebx, ebx
jle 0x436d0a
mov ebx, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x430]
mov esi, dword [ebp - 0x444]
mov dword [ebp - 0x42c], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x436cdc
xor eax, eax
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x438]
push eax
push edi
call dword [0x54f35c]
test eax, eax
je 0x436cdc
cmp ebx, dword [ebp - 0x434]
ja 0x436cdc
jb 0x436cbe
mov eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x438]
jae 0x436cdc
mov eax, dword [ebp - 0x438]
lea ecx, [ebp - 0x424]
mov ebx, dword [ebp - 0x434]
push edi
mov dword [ebp - 0x42c], eax
call fcn.004028f2
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x43c]
jne 0x436ce1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
sub esi, eax
lea edi, [edi + eax*2]
test esi, esi
jg 0x436c7e
mov esi, dword [ebp - 0x440]
lea eax, [ebp - 0x424]
mov ecx, esi
push eax
call fcn.0040291d
lea ecx, [ebp - 0x424]
call fcn.00403080
mov eax, esi
call fcn.004e6c99
ret
Function at 0x4381b0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
test ecx, ecx
jne 0x4381b8
inc eax
ret
xor edx, edx
mov word [ecx + 0x1c], ax
mov dword [ecx + 0x14], edx
xor eax, eax
mov dword [ecx + 0x18], edx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x60], edx
mov dword [ecx + 0x64], edx
ret
Function at 0x4381ef
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x158], esi
mov edi, ebx
lea edx, [esi + 0x1f]
movzx ecx, byte [edx - 1]
movzx eax, byte [edx]
lea edx, [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [ebp + edi*4 - 0x144], ecx
inc edi
cmp edi, 0x10
jl 0x438214
push 0x40
lea ecx, [ebp - 0x13c]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
dec edx
jne 0x43824b
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 8]
mov dword [ebp - 0x150], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x154], eax
mov eax, dword [esi + 0xc]
mov esi, dword [ebp - 0x154]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp - 0x150]
mov ecx, esi
not ecx
rol edx, 5
and ecx, eax
mov eax, edi
and eax, esi
or ecx, eax
mov eax, dword [ebp - 0x148]
add edx, ecx
add eax, 0x5a827999
add edx, dword [ebp + ebx*4 - 0x144]
add edx, eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x148], eax
mov eax, edi
mov edi, esi
mov dword [ebp - 0x14c], eax
mov esi, dword [ebp - 0x150]
ror edi, 2
inc ebx
push 0x14
pop ecx
mov dword [ebp - 0x150], edx
cmp ebx, ecx
jl 0x43828d
mov dword [ebp - 0x154], esi
mov ebx, esi
xor eax, edi
rol edx, 5
xor eax, ebx
add edx, eax
mov eax, dword [ebp - 0x148]
add edx, dword [ebp + ecx*4 - 0x144]
add eax, 0x6ed9eba1
add edx, eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x148], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x14c], eax
mov ebx, dword [ebp - 0x150]
ror edi, 2
inc ecx
mov dword [ebp - 0x150], edx
cmp ecx, 0x28
jl 0x4382ed
push 0x28
pop esi
mov ecx, edi
rol edx, 5
or ecx, ebx
add edx, 0x8f1bbcdc
add edx, dword [ebp - 0x148]
and ecx, eax
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0x14c]
add ecx, dword [ebp + esi*4 - 0x144]
mov dword [ebp - 0x148], eax
add edx, ecx
mov eax, edi
mov edi, ebx
mov ebx, dword [ebp - 0x150]
ror edi, 2
inc esi
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
cmp esi, 0x3c
jl 0x438338
mov esi, dword [ebp - 0x158]
push 0x3c
pop ecx
xor eax, edi
rol edx, 5
add edx, dword [ebp - 0x148]
xor eax, ebx
add eax, 0xca62c1d6
add eax, dword [ebp + ecx*4 - 0x144]
add edx, eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x148], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x14c], eax
mov ebx, dword [ebp - 0x150]
ror edi, 2
inc ecx
mov dword [ebp - 0x150], edx
cmp ecx, 0x50
jl 0x438390
add dword [esi + 0xc], eax
mov eax, dword [ebp - 0x148]
add dword [esi + 0x10], eax
xor eax, eax
add dword [esi + 8], edi
add dword [esi + 4], ebx
add dword [esi], edx
mov ecx, dword [ebp - 4]
pop edi
mov word [esi + 0x1c], ax
xor ecx, ebp
pop esi
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x438401
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
movzx eax, word [esi + 0x1c]
cmp ax, 0x37
cwde
mov byte [eax + esi + 0x1e], 0x80
jle 0x43844d
push 0x40
pop ecx
jmp 0x43841f
cwde
mov byte [eax + esi + 0x1e], 0
inc word [esi + 0x1c]
mov ax, word [esi + 0x1c]
cmp ax, cx
jl 0x438419
mov ecx, esi
call fcn.004381ef
push 0x38
pop ecx
jmp 0x438445
movsx eax, word [esi + 0x1c]
mov byte [eax + esi + 0x1e], 0
inc word [esi + 0x1c]
cmp word [esi + 0x1c], cx
jl 0x438438
jmp 0x438465
push 0x38
pop ecx
jmp 0x438458
cwde
mov byte [eax + esi + 0x1e], 0
inc word [esi + 0x1c]
mov ax, word [esi + 0x1c]
cmp ax, cx
jl 0x438452
mov al, byte [esi + 0x1b]
mov ecx, esi
mov byte [esi + 0x56], al
mov al, byte [esi + 0x1a]
mov byte [esi + 0x57], al
mov eax, dword [esi + 0x18]
shr eax, 8
mov byte [esi + 0x58], al
mov al, byte [esi + 0x18]
mov byte [esi + 0x59], al
mov al, byte [esi + 0x17]
mov byte [esi + 0x5a], al
mov al, byte [esi + 0x16]
mov byte [esi + 0x5b], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [esi + 0x5c], al
mov al, byte [esi + 0x14]
mov byte [esi + 0x5d], al
pop esi
jmp fcn.004381ef

Function at 0x4388aa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x4388bd
push 0xd
pop eax
jmp 0x438901
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x4388d0
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4388c8
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x438d0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x500054
call fcn.004e6d56
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x438d88
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x438d88
call fcn.0041c9a6
mov esi, eax
jmp 0x438e93
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x438dab
call fcn.0041c9a6
jmp 0x438e86
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x438da1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
lea ecx, [ebx + 1]
cmp ecx, ebx
jae 0x438dde
mov esi, 0x8007000e
jmp 0x438e88
xor eax, eax
mov byte [ebp - 4], 2
shld eax, ecx, 1
add ecx, ecx
cmp eax, esi
ja 0x438e17
cmp ecx, 0xffffffff
ja 0x438e17
cmp ecx, 0x400
jbe 0x438e09
push ecx
lea ecx, [ebp - 0x418]
call fcn.0043a58a
jmp 0x438e35
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x438e35
push 0x80070216
call fcn.00402c6f
mov eax, 0x438e27
ret
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x438dd4
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x438da1
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004398f5
mov esi, eax
test edi, edi
je 0x438e93
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x438eac
lea ecx, [ebp - 0x418]
call fcn.0043a581
mov eax, esi
call fcn.004e6ca8
ret 0x10