joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19d450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, edx
mov ebx, ecx
xor cl, cl
mov dword [ebp - 0x14], eax
mov byte [ebp - 1], cl
test eax, eax
je 0x19d62c
test ebx, ebx
je 0x19d62c
push esi
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x19d480
sub esi, ecx
sar esi, 1
push edi
lea eax, [esi*2 + 2]
push eax
call fcn.001a23ca
mov edi, eax
add esp, 4
test edi, edi
je 0x19d622
lea eax, [esi*2 + 2]
push eax
push 0
push edi
call fcn.001a48b0
add esp, 0xc
lea eax, [esi*2 + 1]
push 0
push 0
push eax
push edi
push esi
push ebx
push 0
push 0
call dword [0x1cd098]
mov ebx, edi
lea ecx, [ebx + 1]
nop dword [eax + eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x19d4e0
sub ebx, ecx
mov ecx, 0
je 0x19d55f
cmp ebx, 0x40
jb 0x19d553
movsx eax, bl
mov edx, ebx
and edx, 0xffffffc0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [edi + ecx]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + ecx], xmm1
movups xmm0, xmmword [edi + ecx + 0x10]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [edi + ecx + 0x10], xmm0
movups xmm0, xmmword [edi + ecx + 0x20]
pxor xmm0, xmm2
movups xmmword [edi + ecx + 0x20], xmm0
movups xmm0, xmmword [edi + ecx + 0x30]
pxor xmm1, xmm0
movups xmmword [edi + ecx + 0x30], xmm1
add ecx, 0x40
cmp ecx, edx
jb 0x19d510
cmp ecx, ebx
jae 0x19d55f
xor byte [ecx + edi], bl
inc ecx
cmp ecx, ebx
jb 0x19d557
lea eax, [ebx + ebx]
mov dword [ebp - 0x10], eax
inc eax
push eax
mov dword [ebp - 0xc], eax
call fcn.001a23ca
mov esi, eax
add esp, 4
test esi, esi
je 0x19d60e
push dword [ebp - 0xc]
push 0
push esi
call fcn.001a48b0
lea eax, [ebx + ebx]
push eax
push 0
push esi
call fcn.001a48b0
xor ecx, ecx
add esp, 0x18
mov dword [ebp - 0xc], ecx
test ebx, ebx
je 0x19d5f2
nop
movzx ecx, byte [ecx + edi]
xor eax, eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
mov eax, ecx
and eax, 0xf
shr ecx, 4
movsx eax, byte [eax + 0x1d971c]
push eax
movsx eax, byte [ecx + 0x1d971c]
push eax
push 0x1da2c4
lea eax, [ebp - 8]
push 3
push eax
call fcn.0017ec50
mov ecx, dword [ebp - 0xc]
add esp, 0x14
movzx eax, byte [ebp - 8]
mov byte [esi + ecx*2], al
movzx eax, byte [ebp - 7]
mov byte [esi + ecx*2 + 1], al
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
jb 0x19d5a0
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push eax
push esi
push 0
push 0
call dword [0x1cd08c]
push esi
call fcn.001a2387
add esp, 4
push edi
mov bl, 1
call fcn.001a2387
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1a0c35
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x1cc6ce
call fcn.001a2c50
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x1a0d6a
cmp byte [edi + 0x3e], bl
je 0x1a0d6a
mov eax, dword [edi]
mov ecx, 0xffff
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1cd2d4]
mov ecx, edi
call esi
mov ecx, 0xffff
cmp cx, ax
jne 0x1a0c82
xor al, al
jmp 0x1a0d6c
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0017b090
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x1a0cb7
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1a0cc1
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call dword [0x1cd2d4]
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x1a0cf1
sub eax, 1
jne 0x1a0d4f
mov edi, dword [ebp - 0x30]
jmp 0x1a0cf7
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3e], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x1a0d07
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x1a0d31
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x1a0d18
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.001ac6a2
add esp, 0x10
cmp esi, eax
jne 0x1a0d5a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3e], 0
je 0x1a0d58
test esi, esi
jne 0x1a0ca9
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.00174000
jmp 0x1a0ca3
dec eax
sub eax, 1
jne 0x1a0d5e
inc eax
jmp 0x1a0d5c
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00173bc0
mov al, bl
jmp 0x1a0d6c
mov al, 1
call fcn.001a2c0b
ret

Function at 0x1bc850
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.001bc513

Function at 0x1bc85b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.001bc694
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x442063]
shl eax, 2
mov dword [0x442067], eax
push edi
push ecx
xor eax, eax
mov edi, 0xb0f5f0
mov ecx, 0x1049d4c
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.00435f43
pop ecx
push 0x44202c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x44206b], eax
push 0
jmp fcn.00440660

Function at 0x404334
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp + 8]
push edx
call fcn.00433cb4
pop ecx
push 0x101
push 0
lea ecx, [ebp - 0x120]
push ecx
call fcn.00435974
add esp, 0xc
push dword [ebp + 8]
call fcn.00403ce4
pop ecx
mov dword [ebp - 0x10], eax
push eax
lea edx, [ebp - 8]
push edx
call fcn.00433e96
add esp, 8
lea ecx, [ebp - 0x10]
push ecx
call fcn.00433d9e
pop ecx
push dword [ebp + 8]
call fcn.00403dd4
pop ecx
mov dword [ebp - 0x10], eax
push eax
lea edx, [ebp - 0xc]
push edx
call fcn.00433e96
add esp, 8
lea ecx, [ebp - 0x10]
push ecx
call fcn.00433d9e
pop ecx
mov dword [ebp - 0x1c], 0x101
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
cmp dword [ebp - 8], 0
jne 0x4043d6
mov edx, 0xb0231a
jmp 0x404400
mov ecx, dword [ebp - 8]
and ecx, 0xff000000
cmp ecx, 0xff000000
jne 0x4043fd
mov eax, dword [ebp - 8]
and eax, 0xffffff
lea edx, [eax + eax*8]
mov ecx, dword [0x10465c4]
mov edx, dword [ecx + edx]
jmp 0x404400
mov edx, dword [ebp - 8]
push edx
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x404479
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 0x18]
push eax
push 0
cmp dword [ebp - 0xc], 0
jne 0x40442d
mov edx, 0xb0231b
jmp 0x404457
mov ecx, dword [ebp - 0xc]
and ecx, 0xff000000
cmp ecx, 0xff000000
jne 0x404454
mov eax, dword [ebp - 0xc]
and eax, 0xffffff
lea edx, [eax + eax*8]
mov ecx, dword [0x10465c4]
mov edx, dword [ecx + edx]
jmp 0x404457
mov edx, dword [ebp - 0xc]
push edx
push dword [ebp - 0x14]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x404471
mov eax, dword [ebp - 0x18]
dec eax
je 0x404471
mov byte [ebp - 0x120], 0
push dword [ebp - 0x14]
call sub.ADVAPI32.dll_RegCloseKey
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 4]
push eax
call fcn.00433e96
add esp, 8
lea edx, [ebp + 8]
push edx
call fcn.00433d90
pop ecx
lea ecx, [ebp - 0xc]
push ecx
call fcn.00433d9e
pop ecx
lea eax, [ebp - 8]
push eax
call fcn.00433d9e
pop ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x407093
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x4070a9
mov eax, 0xb02547
jmp 0x4070d1
mov edx, esi
and edx, 0xff000000
cmp edx, 0xff000000
jne 0x4070cf
mov ecx, esi
and ecx, 0xffffff
lea eax, [ecx + ecx*8]
mov edx, dword [0x10465c4]
mov eax, dword [edx + eax]
jmp 0x4070d1
mov eax, esi
push eax
test ebx, ebx
jne 0x4070dd
mov edx, 0xb02546
jmp 0x407104
mov ecx, ebx
and ecx, 0xff000000
cmp ecx, 0xff000000
jne 0x407102
mov eax, ebx
and eax, 0xffffff
lea edx, [eax + eax*8]
mov ecx, dword [0x10465c4]
mov edx, dword [ecx + edx]
jmp 0x407104
mov edx, ebx
push edx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x40719b
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x20
jne 0x40719b
push 0
push 0x3e8
call sub.KERNEL32.dll_SleepEx
test esi, esi
jne 0x407133
mov eax, 0xb02549
jmp 0x40715a
mov ecx, esi
and ecx, 0xff000000
cmp ecx, 0xff000000
jne 0x407158
mov eax, esi
and eax, 0xffffff
lea edx, [eax + eax*8]
mov ecx, dword [0x10465c4]
mov eax, dword [ecx + edx]
jmp 0x40715a
mov eax, esi
push eax
test ebx, ebx
jne 0x407166
mov edx, 0xb02548
jmp 0x40718d
mov ecx, ebx
and ecx, 0xff000000
cmp ecx, 0xff000000
jne 0x40718b
mov eax, ebx
and eax, 0xffffff
lea edx, [eax + eax*8]
mov ecx, dword [0x10465c4]
mov edx, dword [ecx + edx]
jmp 0x40718d
mov edx, ebx
push edx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x40719b
xor eax, eax
jmp 0x40719d
mov al, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x4076ce
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 8]
push eax
call fcn.00433cb4
pop ecx
push 0x12
push 1
call fcn.0043e16c
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x4076f3
or ebx, 0xffffffff
jmp 0x407731
mov byte [ebx + 0x11], 0
lea eax, [ebx + 4]
push eax
push dword [ebp + 8]
call fcn.00407563
add esp, 8
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x407731
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x40772d
lea edx, [ebx + 4]
push edx
call fcn.00433d9e
pop ecx
push ebx
call fcn.0043e7f4
pop ecx
or ebx, 0xffffffff
jmp 0x407731
mov byte [ebx + 0x11], 1
lea eax, [ebp + 8]
push eax
call fcn.00433d90
pop ecx
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x40e3ec
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x10], eax
jmp 0x40e5af
mov eax, dword [ebx + 0x1200e]
cmp eax, dword [ebx + 0x12012]
je 0x40e442
push 0
push ebx
call fcn.0040dea9
add esp, 8
inc eax
jne 0x40e442
mov dword [ebp - 4], 0xffffffff
jmp 0x40e5d2
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.00435974
add esp, 0xc
push 0
push 0
push 1
push 0
call sub.KERNEL32.dll_CreateEventA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40e470
or eax, 0xffffffff
jmp 0x40e5d5
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0x24]
push ecx
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push dword [ebx]
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x40e56b
call sub.KERNEL32.dll_GetLastError
sub eax, 0x26
je 0x40e4e5
sub eax, 0x3bf
jne 0x40e4ec
push 1
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x24]
push ecx
push dword [ebx]
call sub.KERNEL32.dll_GetOverlappedResult
test eax, eax
jne 0x40e56b
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x26
jne 0x40e4d4
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x40e56b
call fcn.0040dbab
mov dword [ebp - 0xc], 0xffffffff
jmp 0x40e56b
xor edx, edx
mov dword [ebp - 0xc], edx
jmp 0x40e56b
call fcn.0040dbab
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebx]
call sub.KERNEL32.dll_ClearCommError
test eax, eax
jne 0x40e507
call fcn.0040dbab
test byte [ebp - 8], 8
je 0x40e51a
push 0xb0282b
call fcn.0040db93
pop ecx
jmp 0x40e564
test byte [ebp - 8], 2
je 0x40e52d
push 0xb02843
call fcn.0040db93
pop ecx
jmp 0x40e564
test byte [ebp - 8], 4
je 0x40e540
push 0xb02855
call fcn.0040db93
pop ecx
jmp 0x40e564
test byte [ebp - 8], 0x10
je 0x40e553
push 0xb0286c
call fcn.0040db93
pop ecx
jmp 0x40e564
cmp dword [ebp - 8], 0
je 0x40e564
push 0xb0287c
call fcn.0040db93
pop ecx
mov dword [ebp - 0xc], 0xffffffff
push dword [ebp - 0x14]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40e587
mov dword [ebp - 4], 0xffffffff
jmp 0x40e5d2
cmp dword [ebp - 0xc], 0
je 0x40e5d2
push 0xb028a4
push dword [ebp - 0xc]
push esi
push 0xb0288c
call fcn.0040dbda
add esp, 0x10
mov edx, dword [ebp - 0xc]
add dword [ebp - 4], edx
add esi, dword [ebp - 0xc]
sub edi, dword [ebp - 0xc]
test edi, edi
jle 0x40e5d2
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 0x10]
movsx ecx, word [ebx + 4]
cmp eax, ecx
jb 0x40e41a
cmp word [ebx + 4], 0
je 0x40e41a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4102ab
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xor esi, esi
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 4], eax
jmp 0x4102ea
push 1
push 1
call sub.KERNEL32.dll_SleepEx
push ebx
push edi
push dword [ebp + 8]
call fcn.0040e3ec
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4102e4
or esi, 0xffffffff
jmp 0x4102fe
add edi, eax
sub ebx, eax
add esi, eax
test ebx, ebx
jle 0x4102fe
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, dword [0xf255d8]
jb 0x4102c4
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x410925
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, 0x10000
sub esi, dword [0xf45608]
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
push esi
mov eax, 0xf35608
add eax, dword [0xf45608]
push eax
push dword [ebp + 8]
call fcn.0040e3ec
add esp, 0xc
mov ebx, eax
cmp byte [0xb135a3], 0
jle 0x4109f9
test ebx, ebx
je 0x4109f9
mov dword [ebp - 8], 0x402d62
mov dword [ebp - 4], 0x40f4e3
push 0xb02e34
lea eax, [ebp - 8]
push eax
call fcn.0040208a
add esp, 8
mov eax, esi
cdq
push edx
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00402141
add esp, 0xc
push 0xb02e4c
lea eax, [ebp - 8]
push eax
call fcn.0040208a
add esp, 8
mov eax, ebx
cdq
push edx
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00402141
add esp, 0xc
push 0xb02e5a
lea eax, [ebp - 8]
push eax
call fcn.0040208a
add esp, 8
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00402141
add esp, 0xc
push 0xb02e64
lea eax, [ebp - 8]
push eax
call fcn.0040208a
add esp, 8
cmp ebx, 0xffffffff
jne 0x410a1f
mov dword [ebp - 0x10], 0x402d62
mov dword [ebp - 0xc], 0x40f4e3
push 0xb02e67
lea edx, [ebp - 0x10]
push edx
call fcn.0040208a
add esp, 8
jmp 0x410a2b
add dword [0xf255f0], ebx
add dword [0xf45608], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410a32
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
call sub.KERNEL32.dll_GetTickCount
mov esi, eax
cmp byte [0xb135a3], 0
jle 0x410b0f
mov dword [ebp - 8], 0x402d62
mov dword [ebp - 4], 0x40f4e3
push 0xb02e78
lea eax, [ebp - 8]
push eax
call fcn.0040208a
add esp, 8
mov eax, ebx
cdq
push edx
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00402141
add esp, 0xc
push 0xb02e86
lea eax, [ebp - 8]
push eax
call fcn.0040208a
add esp, 8
jmp 0x410b0f
call sub.KERNEL32.dll_GetTickCount
sub eax, esi
cmp eax, dword [0xf255d8]
jbe 0x410aff
cmp byte [0xb135a3], 0
jle 0x410af7
mov dword [ebp - 0x10], 0x402d62
mov dword [ebp - 0xc], 0x40f4e3
push 0xb02e8a
lea edx, [ebp - 0x10]
push edx
call fcn.0040208a
add esp, 8
mov eax, ebx
sub eax, dword [0xf45608]
cdq
push edx
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00402141
add esp, 0xc
push 0xb02eac
lea eax, [ebp - 0x10]
push eax
call fcn.0040208a
add esp, 8
mov ebx, dword [0xf45608]
jmp 0x410b17
push 1
push 1
call sub.KERNEL32.dll_SleepEx
push edi
call fcn.00410925
pop ecx
cmp ebx, dword [0xf45608]
jg 0x410a98
test ebx, ebx
jle 0x410b2c
push ebx
push 0xf35608
push dword [ebp + 0xc]
call fcn.00435928
add esp, 0xc
mov eax, dword [0xf45608]
sub eax, ebx
test eax, eax
jle 0x410b55
mov edx, dword [0xf45608]
sub edx, ebx
push edx
mov ecx, 0xf35608
add ecx, ebx
push ecx
push 0xf35608
call fcn.00435928
add esp, 0xc
sub dword [0xf45608], ebx
mov esi, ebx
cmp byte [0xb135a3], 0
jle 0x410bcc
mov dword [ebp - 0x18], 0x402d62
mov dword [ebp - 0x14], 0x40f4e3
push 0xb02eba
lea eax, [ebp - 0x18]
push eax
call fcn.0040208a
add esp, 8
mov eax, ebx
cdq
push edx
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00402141
add esp, 0xc
push 0xb02ed2
lea eax, [ebp - 0x18]
push eax
call fcn.0040208a
add esp, 8
mov eax, dword [0xf45608]
cdq
push edx
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00402141
add esp, 0xc
push 0xb02edb
lea eax, [ebp - 0x18]
push eax
call fcn.0040208a
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41928c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov esi, 0xf135c0
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov word [ebp - 4], 0
mov byte [ebp - 5], 0
mov ebx, dword [ebp + 8]
cmp byte [ebx], 1
jne 0x41943a
cmp word [ebx + 0xb], 0x258
jl 0x41943a
mov dword [ebp - 0x10], 0x402d62
mov dword [ebp - 0xc], 0x40f4a5
push 0xb051ca
lea eax, [ebp - 0x10]
push eax
call fcn.0040208a
add esp, 8
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
cmp eax, 0x2710
jbe 0x41931c
mov dword [ebp - 0x18], 0x402d62
mov dword [ebp - 0x14], 0x40f4e3
push 0xb051e0
lea edx, [ebp - 0x18]
push edx
call fcn.0040208a
add esp, 8
jmp 0x41943a
push esi
call fcn.00410ea7
pop ecx
mov dword [ebp - 0x20], 0x402d72
mov dword [ebp - 0x1c], fcn.00410eb3
mov cl, byte [ebx + 1]
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.004029d3
add esp, 8
push 0x45
lea edx, [ebp - 0x20]
push edx
call fcn.004029d3
add esp, 8
push 0x1033
lea ecx, [ebp - 0x20]
push ecx
call fcn.004029e7
add esp, 8
push 4
push esi
call fcn.00411703
add esp, 8
push 5
push esi
call fcn.00411be1
add esp, 8
mov dword [ebp - 0x28], 0x402d55
mov dword [ebp - 0x24], fcn.00411e08
lea eax, [ebp - 1]
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.00402683
add esp, 8
lea ecx, [ebp - 2]
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00402683
add esp, 8
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x28]
push ecx
call fcn.0040269a
add esp, 8
lea eax, [ebp - 5]
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.004025c4
add esp, 8
push esi
call fcn.00411e2f
pop ecx
test al, al
je 0x4193eb
mov cl, byte [ebp - 1]
cmp cl, byte [ebx + 1]
jne 0x4193eb
cmp byte [ebp - 2], 0x45
jne 0x4193eb
cmp word [ebp - 4], 0x1033
jne 0x4193eb
cmp byte [ebp - 5], 0
jne 0x41941b
push 0
push 0xc8
call sub.KERNEL32.dll_SleepEx
mov dword [ebp - 0x30], 0x402d62
mov dword [ebp - 0x2c], 0x40f4a5
push 0xb051e9
lea eax, [ebp - 0x30]
push eax
call fcn.0040208a
add esp, 8
jmp 0x4192ea
mov dword [ebp - 0x38], 0x402d62
mov dword [ebp - 0x34], 0x40f4a5
push 0xb051eb
lea edx, [ebp - 0x38]
push edx
call fcn.0040208a
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41baab
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
call sub.KERNEL32.dll_GetTickCount
mov esi, eax
cmp byte [0xb135a6], 0
jne 0x41bb09
jmp 0x41bafa
call sub.KERNEL32.dll_GetTickCount
sub eax, esi
movsx edx, word [0xb0207c]
cmp eax, edx
jbe 0x41bafa
mov dword [ebp - 8], 0x402d62
mov dword [ebp - 4], 0x40f4a5
push 0xb05c4e
lea eax, [ebp - 8]
push eax
call fcn.0040208a
add esp, 8
jmp 0x41bb2a
push 0xf135c0
call fcn.0040e3dc
pop ecx
test al, al
je 0x41bac7
mov dword [ebp - 0x10], 0x402d62
mov dword [ebp - 0xc], 0x40f4a5
push 0xb05c8e
lea ecx, [ebp - 0x10]
push ecx
call fcn.0040208a
add esp, 8
mov bl, 1
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f527
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
lea ebx, [ebp - 0x18]
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov byte [ebp - 3], 0
mov byte [ebp - 4], 0
mov word [ebp - 6], 0
mov byte [ebp - 7], 0
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
jmp 0x41f646
push 0xc
push 0xf135c0
call fcn.00411be1
add esp, 8
test al, al
jne 0x41f593
mov dword [ebp - 0x10], 0x402d62
mov dword [ebp - 0xc], 0x40f4e3
push 0xb06981
lea eax, [ebp - 0x10]
push eax
call fcn.0040208a
add esp, 8
jmp 0x41f659
mov dword [ebx], 0x402d55
mov dword [ebx + 4], fcn.00411e08
lea edx, [ebp - 2]
push edx
push ebx
call fcn.00402683
add esp, 8
lea ecx, [ebp - 3]
push ecx
push ebx
call fcn.00402683
add esp, 8
push esi
push ebx
call fcn.00402683
add esp, 8
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00402683
add esp, 8
lea edx, [ebp - 6]
push edx
push ebx
call fcn.0040269a
add esp, 8
push dword [ebp + 0x18]
push ebx
call fcn.004026cb
add esp, 8
lea ecx, [ebp - 7]
push ecx
push ebx
call fcn.00402683
add esp, 8
push dword [ebp + 0x1c]
push ebx
call fcn.00402683
add esp, 8
push 0xf135c0
call fcn.00411e2f
pop ecx
test al, al
je 0x41f646
cmp byte [ebp - 3], 0x47
jne 0x41f640
mov al, byte [ebp - 4]
cmp al, byte [ebp + 0xc]
jne 0x41f640
mov dx, word [ebp - 6]
cmp dx, word [ebp + 0x10]
jne 0x41f640
mov al, byte [esi]
cmp al, 0x33
jne 0x41f636
mov byte [ebp - 1], 1
jmp 0x41f659
cmp al, 0x34
jne 0x41f646
mov byte [ebp - 1], 1
jmp 0x41f659
cmp byte [ebp - 3], 0x47
je 0x41f646
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
cmp eax, dword [0xf255d8]
jb 0x41f55c
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434ff0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 8], 0
je 0x435058
mov ax, word [ebx + 8]
mov word [ebp - 4], ax
mov word [ebp - 2], 1
mov word [ebp - 8], 0
mov word [ebp - 6], 0
mov dx, word [ebx]
mov ecx, edx
sub cx, ax
dec edx
mov word [ebp - 0x10], cx
mov word [ebp - 0xc], dx
lea edx, [ebp - 0x10]
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov word [ebp - 0xe], ax
push edx
mov ecx, dword [ebp - 8]
lea edx, [ebx + 0x10]
push ecx
mov ecx, dword [0x10466a4]
mov eax, dword [ebp - 4]
push eax
push edx
push ecx
call sub.KERNEL32.dll_WriteConsoleOutputA
xor eax, eax
mov dword [ebx + 8], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a004
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x43a020
call fcn.0043a834
jmp 0x43a08f
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x43a03c
call fcn.0043a834
jmp 0x43a08f
cmp dword [0x1046c48], 1
je 0x43a08d
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0043e150
pop ecx
cmp al, 0x41
jl 0x43a08d
cmp al, 0x5a
jg 0x43a08d
cmp byte [ebp - 0x107], 0x3a
jne 0x43a08d
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x43a08d
call fcn.0043a834
jmp 0x43a08f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43a094
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x43a0b0
call fcn.0043a834
jmp 0x43a0d1
test byte [ebp + 0xc], 0x80
jne 0x43a0bb
or ebx, 1
jmp 0x43a0be
and ebx, 0xfffffffe
push ebx
push esi
call sub.KERNEL32.dll_SetFileAttributesA
dec eax
je 0x43a0cf
call fcn.0043a834
jmp 0x43a0d1
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x43a0d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x43a107
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffa0
jmp 0x43a111
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffc0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret