joyce8/EMBER2024-capa huggingface dataset:
Function at 0x566890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x566a48
sub esp, 0x34
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.00567410
movzx eax, byte [esp + 0xc]
test al, al
je 0x566921
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
test ecx, ecx
je 0x566921
cmp ecx, 1
je 0x566914
movzx ebx, byte [edx]
test bl, bl
jne 0x566906
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x566921
cmp bl, 0xff
jne 0x566914
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x566921
cmp ecx, 8
jg 0x56692a
mov ebx, dword [esp + 0x3c]
xor eax, eax
jmp 0x566941
mov byte [esp + 0x40], 0
add esp, 0x34
ret
jg 0x566921
mov byte [esp + 0x40], 1
add esp, 0x34
ret
movzx esi, byte [edx + eax]
or esi, ebp
mov dword [ebx], esi
mov dword [ebx + 4], edi
inc eax
cmp eax, ecx
jge 0x566965
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
cmp eax, ecx
jb 0x566935
jmp 0x566a42
mov dword [esp + 0x14], ecx
shl ecx, 3
lea edx, [ecx - 0x40]
neg edx
mov byte [esp + 0x13], dl
cmp dl, 0x20
sbb ebp, ebp
mov dword [esp + 0x24], ebp
add ecx, 0xffffffe0
mov esi, ecx
neg ecx
mov byte [esp + 0x12], cl
cmp cl, 0x20
sbb edi, edi
mov dword [esp + 0x20], edi
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb eax, eax
mov dword [esp + 0x1c], eax
mov edi, dword [ebx]
mov dword [esp + 0x18], edi
mov ebx, dword [ebx + 4]
shl edi, cl
mov ecx, edx
shl ebx, cl
and ebx, ebp
mov ecx, esi
mov ebp, dword [esp + 0x18]
shr ebp, cl
and ebp, eax
or ebp, ebx
mov ebx, dword [esp + 0x20]
and ebx, edi
or ebp, ebx
mov ebx, dword [esp + 0x3c]
mov dword [ebx + 4], ebp
movzx edi, byte [esp + 0x12]
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ebx, ebx
shr dl, 5
movzx edx, dl
cmp edx, 1
sbb edx, edx
mov dword [esp + 0x20], edx
movzx ecx, byte [esp + 0x13]
mov edx, dword [esp + 0x18]
shl edx, cl
mov eax, dword [esp + 0x24]
and edx, eax
not ebx
or ebx, edi
mov edi, ecx
mov ecx, esi
mov esi, ebp
shl ebp, cl
mov ecx, edi
shr edx, cl
and edx, eax
mov eax, dword [esp + 0x1c]
and ebp, eax
or edx, ebp
mov ecx, ebx
mov eax, esi
sar esi, cl
mov ebx, dword [esp + 0x20]
xor ebx, 0xffffffff
and ebx, esi
or ebx, edx
mov edx, dword [esp + 0x3c]
mov dword [edx], ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb ecx, ecx
not ecx
or ecx, edi
sar eax, cl
mov dword [edx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x56692a
call fcn.00461150
nop
call fcn.0045fcc0
jmp fcn.00566890
Function at 0x5697b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x569994
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.004617fc
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.00568d50
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.00461346
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x569862
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x569935
mov dword [esp + 0x10], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
sar edx, 3
mov dword [esp + 0x1c], edx
shl edx, 3
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [esp + ecx*8 + 0x58]
mov edi, dword [esi]
mov dword [esp + 0xc], edi
mov esi, dword [esi + 4]
mov ecx, ebx
shl edi, cl
and edi, edx
mov dword [esp + 8], edi
xchg edi, eax
mov byte [esp + 0x20], al
xchg edi, eax
lea ebp, [ecx - 0x20]
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
shl esi, cl
and esi, edx
mov ecx, ebp
mov edx, dword [esp + 0xc]
mov ebx, edx
shr edx, cl
and edx, edi
or edx, esi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov ebp, dword [esp + 0x14]
and ebx, ebp
or ebx, edx
mov edx, dword [esp + 8]
mov ebp, edx
shr edx, 8
mov esi, ebx
shl ebx, 0x18
or edx, ebx
mov byte [esp + 0x21], dl
mov edx, ebp
shr ebp, 0x10
mov ebx, esi
shl esi, 0x10
or esi, ebp
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov ebp, ebx
shl ebx, 8
shr edx, 0x18
or edx, ebx
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x569966
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + ebp]
or esi, ebx
xchg esi, ebx
mov byte [eax + ebp], bl
xchg esi, ebx
inc ecx
cmp ecx, 8
jge 0x56985b
movzx ebx, byte [esp + ecx + 0x28]
lea ebp, [edx + ecx]
cmp ebp, 0x20
jge 0x56985b
test byte [eax], al
cmp ebp, 0x20
jb 0x569958
mov eax, ebp
mov ecx, 0x20
call fcn.00461150
nop
call fcn.0045fcc0
jmp fcn.005697b0
Function at 0x573200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5733c1
sub esp, 0x34
lea eax, [0x5e0b40]
mov dword [esp], eax
call fcn.0040b6c0
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x57323f
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ebp, ecx
jle 0x573368
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x573393
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x573237
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x573237
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x573237
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x573237
add esp, 0x34
ret
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov ebx, dword [esp + 0x2c]
cmp esi, edx
jge 0x573312
cmp eax, ebp
jle 0x573312
jbe 0x5733b7
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x57336c
mov eax, esi
mov ecx, edx
call fcn.00461150
mov ecx, eax
mov eax, ebp
call fcn.00461150
nop
call fcn.0045fcc0
jmp fcn.00573200
Function at 0x575ed0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x576043
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x575f03
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x575f03
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x575f09
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x575f17
cmp ecx, 4
jne 0x575f48
cmp al, 0x2c
ja 0x575f30
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x575f42
cmp al, 0x24
je 0x575f42
cmp al, 0x26
jae 0x575f42
jmp 0x575f48
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x575f42
cmp al, 0x5b
je 0x575f42
cmp al, 0x5d
jne 0x575f48
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x575f7f
cmp al, 0x26
ja 0x575f61
cmp al, 0x24
je 0x575f9e
cmp al, 0x26
je 0x575f9e
jmp 0x576025
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x575f9e
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x57601f
cmp al, 0x2f
je 0x575f9e
jmp 0x576025
cmp al, 0x3d
ja 0x575f96
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x575f9e
cmp al, 0x3d
je 0x575f9e
jmp 0x576025
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x576015
cmp ecx, 2
jg 0x575fd9
cmp ecx, 1
je 0x575fce
cmp ecx, 2
jne 0x576025
cmp al, 0x2f
je 0x575fbc
cmp al, 0x3b
je 0x575fbc
cmp al, 0x2c
jne 0x575fc3
mov eax, 1
jmp 0x575fc9
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x575fff
cmp al, 0x40
je 0x575fed
cmp al, 0x2f
je 0x575fed
cmp al, 0x3f
jne 0x575ff4
mov eax, 1
jmp 0x575ffa
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x57600f
cmp ecx, 7
jne 0x576025
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x57601f
cmp al, 0x7e
jne 0x576025
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x57603d
cmp al, 0x21
je 0x576037
add eax, 0xffffffd8
cmp al, 2
ja 0x57603d
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.0045fcc0
jmp fcn.00575ed0
Function at 0x57d690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57d7e4
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.00567410
movzx eax, byte [esp + 0xc]
test al, al
jne 0x57d6fa
lea eax, [0x5ec160]
mov dword [esp], eax
call fcn.0040b6c0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x61a64b]
mov dword [eax], ecx
lea ecx, [0x6681f8]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x57d7d0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.00567c40
movzx eax, byte [esp + 0x10]
test al, al
je 0x57d79d
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
movzx esi, byte [esp + 0x1b]
xor esi, 0xffffff80
xchg esi, eax
movzx eax, al
xchg esi, eax
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test eax, eax
je 0x57d6fa
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
add esp, 0x28
ret
lea eax, [0x5ec160]
mov dword [esp], eax
call fcn.0040b6c0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x61a2f2]
mov dword [eax], ecx
lea ecx, [0x6681f8]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045fcc0
jmp fcn.0057d690
Function at 0x588c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x588eaf
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00461345
lea ecx, [0x588ec0]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.0057ada0
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x588da5
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x40]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x588d7c
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.0057ada0
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x588e02
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x588dd7
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x588e27
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x588eab
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x588eab
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x5fa580]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00408f00
mov eax, dword [esp + 8]
lea ecx, [0x668518]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.0045fcc0
jmp fcn.00588c80
Function at 0x43b360
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d064]
jne 0x43b36a
repz ret
jmp fcn.0043fa20
Function at 0x4499c0
Capabilities:
Copy file
Set current directory
Set thread local storage value

Disassembly:
sub esp, 0x5a4
cmp dword [0x3228e74], 0x37
jne 0x449b11
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0x4325f4
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push 0x43276c
push 0
push 0x4326e4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x10]
mov word [esp], dx
push ecx
lea edx, [esp + 4]
mov dword [esp + 6], eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov word [esp + 0x12], ax
mov word [esp + 0x14], ax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov word [esp + 0x22], ax
push edx
lea eax, [esp + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
push 0
push 0
push 0
lea ecx, [esp + 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0
push 0
push 0x4327c0
push 0x432810
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
lea edx, [esp + 0x1a4]
push edx
push 0x432820
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push 0x432830
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x432858
push 0x43278c
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0x432878
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
mov eax, dword [0x322987c]
mov edx, dword [0x3225e84]
mov cl, byte [eax + esi + 0x12336]
mov byte [edx + esi], cl
add esp, 0x5a4
ret
Function at 0x449f90
Capabilities:
Copy file
Read .ini file
Set thread local storage value
Terminate process

Disassembly:
sub esp, 0x9b0
push ebx
mov ebx, dword [0x3225e84]
push esi
mov esi, dword [0x3228e74]
push edi
cmp esi, 0x516
jne 0x449fbf
push 0
lea eax, [esp + 0x1c0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VerLanguageNameA]
shr esi, 3
xor edi, edi
test esi, esi
je 0x44a00d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileExA]
nop
cmp dword [0x3228e74], 0x29
jne 0x449fed
push 0
push 0
push 0
push 0
push 0x432548
push 0x432560
call ebp
cmp dword [0x3228e74], 0x1c
je 0x44a019
mov ecx, dword [esp + 0x9c4]
push ecx
push ebx
call fcn.00449de0
inc edi
add ebx, 8
cmp edi, esi
jb 0x449fd0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x9b0
ret 4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0x432588
push 0
lea edx, [esp + 0x1c8]
push edx
push 0x4325f8
push 0x4326b4
push 0x432710
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea ecx, [esp + 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x44a090
Capabilities:
Copy file
Create pipe
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4a78
call fcn.0043ddd0
mov dword [ebp - 4], 0
jmp 0x44a0af
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x332beaf6
jge 0x44a16a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x3228e74], 0x16
jne 0x44a10a
lea ecx, [ebp - 0x874]
push ecx
push 0
lea edx, [ebp - 0x1078]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push 0x432898
push 0
lea eax, [ebp - 0x870]
push eax
push 0x4328a4
push 0x4328c4
push 0x432910
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x3228e74], 0x9e
jne 0x44a15a
push 0
push 0
push 0
push 0
push 0x4328f4
push 0x432970
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
lea ecx, [ebp - 0x1598]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
push 0
lea edx, [ebp - 0x1998]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
cmp dword [ebp - 4], 0x3775ee
jle 0x44a165
jmp 0x44a16a
jmp 0x44a0a6
push 0x44de50
call fcn.00449f90
mov dword [ebp - 0x199c], 0
jmp 0x44a18f
mov eax, dword [ebp - 0x199c]
add eax, 1
mov dword [ebp - 0x199c], eax
cmp dword [ebp - 0x199c], 0x3e79e
jge 0x44a1d0
cmp dword [0x3228e74], 0x10
jne 0x44a1bd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4329dc
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [ebp - 0x199c], 0x1e673
jne 0x44a1ce
call fcn.004499b0
jmp 0x44a180
mov dword [ebp - 0x19a0], 0
jmp 0x44a1eb
mov ecx, dword [ebp - 0x19a0]
add ecx, 1
mov dword [ebp - 0x19a0], ecx
cmp dword [ebp - 0x19a0], 0xdd9a7
jge 0x44a251
cmp dword [0x3228e74], 0xc01
jne 0x44a24f
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0x432a0c
push 0
push 0x432a40
push 0x432a64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x432a90
push 0
lea edx, [ebp - 0x1da0]
push edx
push 0x432aa0
push 0x432acc
push 0x432b00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x44a1dc
jmp dword [0x3225e84]
Function at 0x4054b0
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x440e58], 2
jl 0x4054d5
movaps xmm0, xmmword [0x42f400]
movaps xmmword [0x439b70], xmm0
movaps xmm0, xmmword [0x42f3f0]
movaps xmmword [0x439b80], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.00405881
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x42f3d0]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x4054e3
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x405c15
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x405c47
test dl, 7
je 0x405c47
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x439b90]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x405c27
cmp esi, 8
jb 0x405cd7
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x439b90]
xor ecx, dword [eax*4 + 0x439f90]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43a390]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x43ab90]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x43af90]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43b390]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x43a790]
movzx eax, bl
xor ecx, dword [eax*4 + 0x43b790]
mov ebx, ecx
sub edi, 1
jne 0x405c56
pop edi
test esi, esi
je 0x405cf3
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x439b90]
inc edx
sub esi, 1
jne 0x405cdb
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x405e60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push 0x20
pop ebp
cmp dword [esi], 2
jne 0x405eb7
mov eax, dword [esi + 4]
push edi
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x4c]
push eax
push ebp
push dword [esp + 0x58]
call fcn.00406552
mov dword [esi + 4], ebx
mov edx, ebx
mov edi, ebx
movzx eax, byte [esp + edx + 0x10]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor edi, eax
inc edx
cmp edx, ebp
jb 0x405e9d
mov dword [esi + 4], edi
pop edi
cmp dword [esi], 3
jne 0x405ee3
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
add esi, 4
push eax
push ebp
push esi
push ebp
push dword [esp + 0x54]
call fcn.00406552
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0041d5d0
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8