joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001399
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
push ebp
mov esp, esp
xor ebp, dword [esp + 0x20]
or ebp, esi
inc ebp
sub ebp, ebx
rol ebp, cl
mov ebp, esp
sub esp, 0x24
xchg cx, cx
lea eax, [ebp - 0x24]
jmp 0x100013c2
push eax
xchg al, al
jmp 0x10001483
mov dword [ebp - 0x20], 0x7b
mov bl, bl
push edx
sub al, 0x7e
mov ax, 0x63aa
or ax, 0x16f7
and eax, dword [esp + 0x1c]
push 0x1f
and ax, 0x38b5
add al, 0
shl ax, cl
sub al, cl
xor ax, 0x4483
pop eax
ror dl, cl
or dl, 8
xor edx, dword [esp + 4]
mov edx, dword [esp + 8]
dec eax
test eax, eax
jne 0x100014b5
pop edx
xor al, cl
and eax, edx
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call eax
push edx
pop edx
cmp dword [ebp - 0x20], 0x7b
xchg esp, esp
jne 0x100016d0
jmp 0x100016aa
sub esp, 0xc
nop
ret
push 0x5e
jmp 0x100016db
xor dword [esp], 0x5e
jmp 0x1000191e
push ebx
mov eax, ebp
xor eax, 0x3970062c
inc al
xor al, bl
or eax, 0x400b7536
push 0x17
add al, dl
ror eax, cl
and eax, dword [esp + 0x24]
and al, 0xcc
mov al, al
pop eax
mov ebx, 0x299f02a2
and bl, 0x14
and bx, 0x7c3
xor ebx, ecx
dec eax
test eax, eax
jne 0x10001944
pop ebx
dec ax
dec eax
mov eax, dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call eax
mov al, al
test eax, eax
jmp 0x10001987
je 0x10001b76
xor esp, 7
xchg al, al
ret
push 0x52
jmp 0x10001b7b
sub dword [esp], 0x52
push dword [sym.imp.comdlg32.dll_PrintDlgExA]
or al, 0x84
xor al, cl
dec ax
add ax, dx
push edx
sub ax, 0x3914
sub eax, 0x34ad221f
push 0
add ax, 0x44e2
shr al, cl
pop eax
add eax, 0x1b
mov dx, dx
and dx, cx
and edx, 0x2504381c
dec eax
test eax, eax
jne 0x10001bb1
pop edx
pop eax
call eax
mov ebx, ebx
test eax, eax
jmp 0x10001be8
jne 0x10001e0d
sub esp, 4
mov eax, eax
jmp 0x10001dfd
ret
push 0x19
jmp 0x10001e1d
add dword [esp], 0xfffffffc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xchg dx, dx
jmp 0x10001fd1
cmp eax, 2
mov al, al
jge 0x10002000
xor esp, 7
nop
ret
push 0x72
jmp 0x1000200e
sub dword [esp], 0x6f
push 0x10
jmp 0x10002027
add dword [esp], 0xfffffffc
push edx
and al, dl
and al, 0xaa
and eax, 0x26323811
or al, cl
and eax, dword [esp + 0x10]
add al, 0x9d
rol ax, cl
mov eax, 0x23
add dx, cx
and edx, 0x20800f48
dec eax
test eax, eax
jne 0x1000204b
pop edx
or eax, esp
rol al, cl
inc ax
or al, al
and eax, 0
add eax, dword [sym.imp.GDI32.dll_SelectClipPath]
call eax
mov ebp, ebp
test eax, eax
jmp 0x10002094
jmp 0x1000218d
je 0x100021b8
sub esp, 4
nop
ret
leave
jmp 0x100021ca
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x503b10d0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1aa648d6
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x6fd70a43
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5df56f11
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40105e
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x569a9a
call fcn.0055a6a0
sub esp, 0xc
push ebx
push esi
push str.D1A41C06_CECA_45b0_A3C0_347271EED100
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x621ea4], eax
cmp eax, ebx
jne 0x40108d
xor eax, eax
jmp 0x401128
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401125
push 0x5b0bd0
push ecx
call fcn.004032e1
pop ecx
mov esi, eax
call fcn.0040582a
push eax
lea ecx, [ebp - 0x14]
call fcn.00403311
mov dword [ebp - 4], ebx
push str.ALREADY_RUNNING
push ecx
call fcn.004032e1
pop ecx
mov esi, eax
call fcn.0040582a
push eax
lea ecx, [ebp - 0x10]
call fcn.00403311
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00489b40
add esp, 0x18
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00401017
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401017
push dword [0x621ea4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x621ea4], ebx
jmp 0x401086
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x407353
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push 0
push 0x80
push 3
push 0
xor ebx, ebx
inc ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x407383
xor al, al
jmp 0x4073d1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x4073a3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40737f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4073c8
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x40927a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x5bbdb4
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.005079fd
add esp, 0xc
test eax, eax
je 0x4092c9
cmp dword [ebp + 0x10], 0
je 0x4092c5
push esi
push dword [ebp + 0xc]
push str._WFOPEN_S_ERROR
push ecx
call fcn.004032e1
pop ecx
mov esi, eax
call fcn.0040582a
mov ecx, dword [ebp + 0x10]
push eax
push 2
pop esi
call fcn.00420490
add esp, 0xc
xor al, al
jmp 0x40931d
push 2
xor esi, esi
push esi
push dword [ebp - 4]
call fcn.00507ada
add esp, 0xc
push dword [ebp - 4]
call fcn.00507cfc
pop ecx
push esi
push esi
push dword [ebp - 4]
mov edi, eax
call fcn.00507ada
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, edi
call fcn.0040944b
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
push 1
push edi
push esi
call fcn.00405584
push eax
call fcn.0050800a
push dword [ebp - 4]
call fcn.0050537f
add esp, 0x14
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x409ce3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 4
xor eax, eax
pop edi
push 2
push eax
push eax
push dword [ebx + 0x20c]
mov esi, 0xffff
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.0050833f
push dword [ebx + 0x20c]
call fcn.005086da
add esp, 0x14
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
test edx, edx
ja 0x409d5c
jb 0x409d38
cmp eax, esi
jae 0x409d5c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
test edx, edx
jb 0x409e49
ja 0x409d5c
cmp eax, 4
jbe 0x409e49
jmp 0x409d5c
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 4]
add edi, 0x400
adc esi, 0
cmp esi, dword [ebp - 0xc]
jb 0x409d82
ja 0x409d74
cmp edi, dword [ebp - 0x10]
jbe 0x409d82
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jmp 0x409d88
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov esi, eax
sub esi, dword [ebp - 8]
mov ecx, eax
mov edi, edx
sbb edi, dword [ebp - 4]
sub ecx, esi
mov eax, edx
sbb eax, edi
test eax, eax
jb 0x409db5
ja 0x409da8
cmp ecx, 0x404
jbe 0x409db5
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0x404
jmp 0x409dbb
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
push 0
push edi
push esi
push dword [ebx + 0x20c]
call fcn.0050833f
push dword [ebx + 0x20c]
lea eax, [ebp - 0x430]
push 1
push dword [ebp - 0x20]
push eax
call fcn.0050800a
add esp, 0x20
cmp eax, 1
jne 0x409e49
mov eax, dword [ebp - 0x20]
add eax, 0xfffffffd
jmp 0x409e1a
dec eax
cmp byte [ebp + eax - 0x430], 0x50
jne 0x409e1a
cmp byte [ebp + eax - 0x42f], 0x4b
jne 0x409e1a
cmp byte [ebp + eax - 0x42e], 5
jne 0x409e1a
cmp byte [ebp + eax - 0x42d], 6
je 0x409e20
test eax, eax
jg 0x409df1
jmp 0x409e2f
cdq
add eax, esi
adc edx, edi
mov dword [ebp - 0x18], eax
or eax, edx
mov dword [ebp - 0x14], edx
jne 0x409e49
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jb 0x409d53
ja 0x409e49
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jb 0x409d53
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
test ecx, ecx
je 0x409e5b
mov edx, dword [ebp - 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], edx
or eax, dword [ebp - 0x14]
je 0x409e65
xor eax, eax
inc eax
jmp 0x409e67
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x409e6e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x20c]
sub esp, 0x20
push ebx
push edi
test eax, eax
jne 0x409e87
xor eax, eax
jmp 0x409ff8
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push eax
call fcn.0050833f
push dword [esi + 0x20c]
call fcn.005086da
add esp, 0x14
push dword [esi + 0x20c]
mov ebx, eax
push 1
lea eax, [ebp - 0x20]
mov edi, edx
push 0x16
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call fcn.0050800a
add esp, 0x10
cmp dword [ebp - 0x20], 0x6054b50
je 0x409f10
lea eax, [ebp - 8]
push eax
push esi
call fcn.00409ce3
test eax, eax
je 0x409e80
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push 0
push edi
push ebx
push dword [esi + 0x20c]
call fcn.0050833f
push dword [esi + 0x20c]
lea eax, [ebp - 0x20]
push 1
push 0x16
push eax
call fcn.0050800a
add esp, 0x20
cmp dword [ebp - 0x20], 0x6054b50
jne 0x409e80
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add ecx, eax
xor eax, eax
mov edx, ebx
sub edx, ecx
mov ecx, edi
sbb ecx, eax
movzx eax, word [ebp - 0x18]
mov dword [esi + 0x218], eax
xor eax, eax
sub ebx, dword [ebp - 0x14]
push 0
sbb edi, eax
push edi
push ebx
push dword [esi + 0x20c]
mov dword [esi + 0x220], edx
mov dword [esi + 0x224], ecx
call fcn.0050833f
movzx eax, word [ebp - 0x18]
imul eax, eax, 0x2e
add eax, dword [ebp - 0x14]
push eax
call fcn.00503d0c
add esp, 0x14
mov dword [esi + 0x210], eax
test eax, eax
je 0x409e80
push dword [esi + 0x20c]
push 1
push dword [ebp - 0x14]
push eax
call fcn.0050800a
mov eax, dword [esi + 0x210]
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [esi + 0x214], ecx
xor edx, edx
add esp, 0x10
xor ecx, ecx
cmp dx, word [ebp - 0x18]
jae 0x409fcc
mov edx, dword [esi + 0x214]
mov dword [edx + ecx*4], eax
cmp dword [eax], 0x2014b50
jne 0x409fcc
movzx edi, word [eax + 0x1e]
movzx edx, word [eax + 0x20]
add edx, edi
movzx edi, word [eax + 0x1c]
add edi, eax
lea eax, [edi + edx + 0x2e]
movzx edx, word [ebp - 0x18]
inc ecx
cmp ecx, edx
jl 0x409f9e
movzx eax, word [ebp - 0x18]
cmp ecx, eax
je 0x409ff5
mov eax, dword [esi + 0x210]
test eax, eax
je 0x409e80
push eax
call fcn.00504754
and dword [esi + 0x210], 0
pop ecx
jmp 0x409e80
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret
Function at 0x40a0da
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x210], ebx
je 0x40a25e
cmp eax, dword [esi + 0x218]
jae 0x40a25e
mov ecx, dword [esi + 0x214]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x2a]
xor edi, edi
xor ecx, ecx
inc edi
add eax, dword [esi + 0x220]
push ebx
adc ecx, dword [esi + 0x224]
mov dword [ebp - 8], edi
push ecx
push eax
push dword [esi + 0x20c]
call fcn.0050833f
push dword [esi + 0x20c]
lea eax, [ebp - 0x28]
push edi
push 0x1e
push eax
call fcn.0050800a
add esp, 0x20
cmp dword [ebp - 0x28], 0x4034b50
jne 0x40a25e
cmp dword [ebp - 0x16], ebx
je 0x40a25e
movzx eax, word [ebp - 0xc]
cdq
mov ecx, eax
movzx eax, word [ebp - 0xe]
mov ebx, edx
cdq
add ecx, eax
push edi
adc ebx, edx
push ebx
push ecx
push dword [esi + 0x20c]
call fcn.0050833f
movzx eax, word [ebp - 0x20]
add esp, 0x10
test eax, eax
je 0x40a241
jle 0x40a25e
cmp eax, 7
jle 0x40a25e
cmp eax, 8
jne 0x40a25e
push dword [ebp - 0x16]
call fcn.00503d0c
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40a25e
push dword [esi + 0x20c]
push edi
push dword [ebp - 0x16]
push ebx
call fcn.0050800a
add esp, 0x10
cmp eax, edi
je 0x40a1dc
and dword [ebp - 8], 0
push ebx
call fcn.00504754
pop ecx
mov eax, dword [ebp - 8]
jmp 0x40a260
mov eax, dword [ebp - 0x16]
and dword [ebp - 0x40], 0
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x12]
push 0x38
push str.1.2.3
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x60]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x60], ebx
call fcn.00553290
add esp, 0x10
test eax, eax
jne 0x40a1c9
lea eax, [ebp - 0x60]
push 4
push eax
call fcn.00538050
mov esi, eax
lea eax, [ebp - 0x60]
push eax
call fcn.00539560
add esp, 0xc
cmp esi, edi
jne 0x40a231
xor esi, esi
lea eax, [ebp - 0x60]
push eax
call fcn.00539560
pop ecx
test esi, esi
je 0x40a1cd
jmp 0x40a1c9
push dword [esi + 0x20c]
push edi
push dword [ebp - 0x16]
push dword [ebp + 8]
call fcn.0050800a
add esp, 0x10
cmp eax, edi
je 0x40a1d4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c26e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x569952
call fcn.0055a6a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.wxObject.0
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.wxDCBase.0
call fcn.004b4df0
fld1
mov cl, byte [esi + 8]
fst qword [esi + 0x20]
and cl, 0xe2
fst qword [esi + 0x28]
and al, 1
fst qword [esi + 0x30]
or cl, al
fst qword [esi + 0x38]
or cl, 2
fst qword [esi + 0x40]
xor eax, eax
fstp qword [esi + 0x48]
inc eax
mov byte [esi + 8], cl
lea ecx, [esi + 0x84]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], 5
mov dword [esi + 0x7c], 0x6a
mov dword [esi + 0x80], eax
call fcn.004b4240
mov byte [ebp - 4], 1
lea ecx, [esi + 0x8c]
call fcn.004b3d60
mov byte [ebp - 4], 2
push 8
call fcn.0049ade0
pop ecx
push eax
lea ecx, [esi + 0x94]
call fcn.0040c0d8
mov byte [ebp - 4], 3
push 0xa
call fcn.0049a5b0
pop ecx
push eax
lea ecx, [esi + 0x9c]
call fcn.0040c1a9
mov byte [ebp - 4], 4
push 0x10
call fcn.0049a5b0
pop ecx
push eax
lea ecx, [esi + 0xb0]
call fcn.0040c1a9
mov byte [ebp - 4], 5
lea ecx, [esi + 0xc4]
call fcn.0040c23b
mov byte [ebp - 4], 6
lea ecx, [esi + 0xcc]
call fcn.004b3900
mov byte [ebp - 4], 7
and byte [esi + 8], 0xeb
mov byte [esi + 0xd4], bl
mov dword [esi + 0x64], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x68], ebx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40e802
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x56a9ce
call fcn.0055a6a0
sub esp, 0x488
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], edi
call fcn.0041888a
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28c]
mov byte [ebp - 0x11], 0
call fcn.00409c0f
mov byte [ebp - 4], 2
push 0x104
lea eax, [ebp - 0x494]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x28c]
call fcn.00409c41
test eax, eax
je 0x40e8c1
push dword [ebp + 0xc]
lea esi, [ebp - 0x28c]
call fcn.00409fff
mov esi, eax
cmp esi, 0xffffffff
je 0x40e8aa
mov ecx, esi
lea eax, [ebp - 0x28c]
call fcn.0040a0b9
push edi
push eax
lea ecx, [ebp - 0x38]
call fcn.0040ef93
push edi
lea ecx, [ebp - 0x38]
call fcn.0040eded
push eax
mov eax, esi
lea ecx, [ebp - 0x28c]
call fcn.0040a0da
mov byte [ebp - 0x11], bl
lea edi, [ebp - 0x28c]
call fcn.00409cb4
cmp byte [ebp - 0x11], 0
jne 0x40e94d
xor edi, edi
push 0x5bbdb4
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.005079fd
add esp, 0xc
test eax, eax
je 0x40e8f0
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push 0x5eb02c
call fcn.0040b6fb
mov dword [ebp - 0x18], ebx
jmp 0x40e9c8
push 2
push edi
push dword [ebp + 0xc]
call fcn.00507ada
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00507cfc
pop ecx
push edi
push edi
push dword [ebp + 0xc]
mov esi, eax
call fcn.00507ada
add esp, 0xc
push edi
push esi
lea ecx, [ebp - 0x38]
call fcn.0040ef93
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.00407d61
push dword [ebp + 0xc]
push ebx
push esi
lea esi, [ebp - 0x40]
call fcn.004171db
push eax
call fcn.0050800a
push dword [ebp + 0xc]
call fcn.0050537f
add esp, 0x14
mov esi, dword [ebp - 0x28]
sub esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.00407d61
push esi
lea esi, [ebp - 0x40]
call fcn.004171db
push eax
lea ecx, [ebp - 0x60]
call fcn.00466a30
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push 0x32
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x20]
call fcn.0048e760
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.0048b090
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
test al, al
jne 0x40e9a4
push 0x5eb02c
jmp 0x40e9a8
lea eax, [ebp - 0x20]
push eax
call fcn.0040b6fb
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.0040b8a7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x60]
call fcn.00466960
mov byte [ebp - 4], bl
lea edi, [ebp - 0x28c]
call fcn.00409cb4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0040edbe
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x40e9f6
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x56a988
call fcn.0055a6a0
sub esp, 0x488
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], edi
call fcn.0041888a
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28c]
mov byte [ebp - 0x11], 0
call fcn.00409c0f
mov byte [ebp - 4], 2
push 0x104
lea eax, [ebp - 0x494]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x28c]
call fcn.00409c41
test eax, eax
je 0x40eab5
push dword [ebp + 0xc]
lea esi, [ebp - 0x28c]
call fcn.00409fff
mov esi, eax
cmp esi, 0xffffffff
je 0x40ea9e
mov ecx, esi
lea eax, [ebp - 0x28c]
call fcn.0040a0b9
push edi
push eax
lea ecx, [ebp - 0x38]
call fcn.0040ef93
push edi
lea ecx, [ebp - 0x38]
call fcn.0040eded
push eax
mov eax, esi
lea ecx, [ebp - 0x28c]
call fcn.0040a0da
mov byte [ebp - 0x11], bl
lea edi, [ebp - 0x28c]
call fcn.00409cb4
cmp byte [ebp - 0x11], 0
jne 0x40eb3f
xor edi, edi
push 0x5bbdb4
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.005079fd
add esp, 0xc
test eax, eax
je 0x40eae2
mov ecx, dword [ebp + 8]
push 0x5eb02c
call fcn.0040cd87
mov dword [ebp - 0x18], ebx
jmp 0x40ebb8
push 2
push edi
push dword [ebp + 0xc]
call fcn.00507ada
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00507cfc
pop ecx
push edi
push edi
push dword [ebp + 0xc]
mov esi, eax
call fcn.00507ada
add esp, 0xc
push edi
push esi
lea ecx, [ebp - 0x38]
call fcn.0040ef93
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.00407d61
push dword [ebp + 0xc]
push ebx
push esi
lea esi, [ebp - 0x40]
call fcn.004171db
push eax
call fcn.0050800a
push dword [ebp + 0xc]
call fcn.0050537f
add esp, 0x14
mov esi, dword [ebp - 0x28]
sub esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.00407d61
push esi
lea esi, [ebp - 0x40]
call fcn.004171db
push eax
lea ecx, [ebp - 0x60]
call fcn.00466a30
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push 0x32
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x20]
call fcn.0048e760
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.0048b090
mov ecx, dword [ebp + 8]
test al, al
jne 0x40eb94
push 0x5eb02c
jmp 0x40eb98
lea eax, [ebp - 0x20]
push eax
call fcn.0040cd87
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.0040b8a7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x60]
call fcn.00466960
mov byte [ebp - 4], bl
lea edi, [ebp - 0x28c]
call fcn.00409cb4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0040edbe
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x410463
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56985e
call fcn.0055a6a0
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
lea ecx, [esi + 0x40]
mov dword [esi], vtable.EL_CrcPatcher.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
call fcn.00402809
mov dword [ebp - 4], edi
mov dword [esi + 0x5c], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x41186f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x56a903
call fcn.0055a6a0
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp dword [esi + 0x5c], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x41189c
call edi
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
test byte [0x6227e8], 1
jne 0x4118bb
or dword [0x6227e8], 1
and dword [ebp - 4], 0
call edi
mov dword [0x6227e4], eax
or dword [ebp - 4], 0xffffffff
call edi
mov dword [ebp - 0x10], eax
sub eax, dword [0x6227e4]
cmp eax, 0x3e8
mov eax, dword [ebp + 8]
jae 0x4118da
cmp eax, dword [ebp + 0x10]
jne 0x41194d
cmp ebx, dword [ebp + 0x14]
jne 0x41194d
sub eax, dword [esi + 0x38]
sbb ebx, dword [esi + 0x3c]
js 0x411945
jg 0x4118e8
test eax, eax
jbe 0x411945
and dword [ebp + 8], 0
mov edi, dword [esi + 8]
mov dword [ebp + 0xc], ebx
and dword [ebp + 0xc], 0x80000000
and ebx, 0x7fffffff
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [esi + 0x5c]
mov dword [ebp + 0x14], ebx
fild qword [ebp + 0x10]
fild qword [ebp + 8]
mov dword [ebp + 0xc], eax
fchs
faddp st(1)
fild dword [ebp + 0xc]
test eax, eax
jge 0x411925
fadd dword [0x5c0c68]
fdiv qword [0x5c0c60]
fdivp st(1)
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
call fcn.0050e3a0
or dword [edi + 0x22c], 0xffffffff
mov dword [edi + 0x228], eax
mov eax, dword [ebp - 0x10]
mov dword [0x6227e4], eax
call fcn.004119cf
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10