joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f1bc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045fe74
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045f31c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f306
test ebx, ebx
jl 0x45f2aa
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd15620
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45f2cb
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45f2bd
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00460c8c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00460c8c
add esp, 8
mov ebx, 0x80070057
jmp 0x45f2aa
Function at 0x475fbc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00476c74
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0047611c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x476106
test ebx, ebx
jl 0x4760aa
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c420
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4760cb
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4760bd
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00477a8c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00477a8c
add esp, 8
mov ebx, 0x80070057
jmp 0x4760aa
Function at 0x48d26c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048df24
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048d3cc
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48d3b6
test ebx, ebx
jl 0x48d35a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd436d0
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48d37b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48d36d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048ed3c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048ed3c
add esp, 8
mov ebx, 0x80070057
jmp 0x48d35a
Function at 0x4a412c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a4de4
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a428c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a4276
test ebx, ebx
jl 0x4a421a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5a590
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a423b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a422d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a5bfc
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a5bfc
add esp, 8
mov ebx, 0x80070057
jmp 0x4a421a
Function at 0x4b9071
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1338
cmp edx, dword [eax]
je 0x4b9093
add eax, 8
inc ecx
cmp eax, 0x4c13c8
jl 0x4b9084
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1338]
jne 0x4b91c1
mov eax, dword [0x4c5cc0]
cmp eax, 1
je 0x4b919b
test eax, eax
jne 0x4b90c4
cmp dword [0x4c1264], 1
je 0x4b919b
cmp edx, 0xfc
je 0x4b91c1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b90fb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9a50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9ee0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b913e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9ee0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be7d4
push edi
call fcn.004bbdb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9a50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9a60
lea eax, [ebp - 0xa0]
push 0x4be7b4
push eax
call fcn.004b9a60
push dword [esi + 0x4c133c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9a60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bbd24
add esp, 0x2c
pop edi
jmp 0x4b91c1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c133c]
push 0
push eax
push dword [esi]
call fcn.004b9ee0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000bb8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000bb9a
pop dword [ebp - 0x40]
mov eax, 0xaa4378f2
sub eax, 0x9a42bd58
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x36d16
push 0
mov eax, 0xa2589342
sub eax, 0x9257c23a
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x386067e5
sub ecx, 0x38602220
mov esi, eax
mov edi, 0x10021400
add edi, dword [ebp - 0x40]
mov ebx, 0xf162f1fb
sub ebx, 0x85289505
add dword [ebp - 0x20], esi
mov edx, dword [edi]
xor dword [ebp - 0x18], ebx
sub edx, ebx
sub dword [ebp - 0x14], ecx
mov dword [esi], edx
add esi, 4
add edi, 0x21b61c91
sub edi, 0x21b61c8d
loop 0x1000bbf3
add eax, 0x109e7
mov ebx, eax
add eax, 0x862e5d6a
add eax, 0x79d1a29b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x774510
inc ebp
ja 0x401005
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
mov ecx, 0xd4e4027f
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
mov ebx, 0xa4e81020
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [edi], edx
stosd dword es:[edi], eax
loop 0x4010a6
shr byte [edx - 0x45d61c4d], 1
arpl word [edi - 0x278de9a], dx
sub dword [edx + 0x21669763], edi
xchg ebp, edi
jo 0x4010b7
adc byte [ebx - 0x7b], dh
jae 0x40102e
xlatb
in al, dx
scasd eax, dword es:[edi]
rol dword [0xffffd0cf], 1
fisub dword [edx + 0x3d]
xchg edi, eax
xchg ebp, eax
push 0xa7e35ce0
iretd
loopne 0x401115
jecxz 0x401062
jmp 0x4010fb
inc edi
inc ebp
invalid
test byte [edi + 0x73], al
fsub dword [edx + 0x3d]
enter 0x419d, 0xffffffffffffff8b
pop es
mov eax, dword [edi]
jmp 0x4010de
push es
aas
dec esp
sbb al, 0xb2
or ecx, esi
pushal
jp 0x40110e
xchg dword [edi], edi
push ebp
arpl word [edx], bx
xchg ebp, eax
and dword [ecx + 0x73], 0x27
push esi
leave
adc bh, byte [0xf1cfcb47]
mov ecx, dword [esi + 0x2afe0d5e]
push ebx
lcall 0x58e9, 0xe192ed67
pop eax
outsb dx, byte [esi]
sub byte [eax + 0x15], ah
mov ecx, 0x775fedc3
test byte [eax + 0x35], ch
setb byte [ebx + ecx*8 + 0x4f]
jne 0x4010f2
and eax, 0x92ec4218
mov byte [edi - 0x59], 3
pop ss
shl byte [esi - 0x1d838009], 1
mov ah, byte [edx]
mov ch, 0xee
leave
or byte [esi], bh
or ch, ah
inc esp
or dword [esi - 0x672e35e7], eax
popal
pop ds
xlatb
invalid
Function at 0x403634
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406ba8
test esi, esi
jne 0x40366c
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406ce4
jmp 0x40368a
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403518
mov edi, eax
test esi, esi
je 0x40368a
cmp dword [ebx], 0
je 0x40368a
dec esi
jmp 0x403673
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404ad8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00404d8c
mov byte [esp], al
cmp byte [esp], 0
jne 0x404c61
test edi, edi
je 0x404c61
mov byte [esp + 1], 0
test ebp, ebp
jle 0x404b98
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x404b73
cmp edi, 0xffffffff
je 0x404b37
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x404b37
mov byte [esp], 0
jmp 0x404c61
mov ebx, dword [esi]
cmp ebx, 1
jg 0x404b73
test ebx, ebx
jne 0x404b6c
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.004015c4
test eax, eax
jne 0x404b6c
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x404c61
pause
dec ebp
test ebp, ebp
jg 0x404b1c
cmp edi, 0xffffffff
je 0x404b98
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x404b96
mov byte [esp], 0
jmp 0x404c61
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x404ae6
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.004015c4
cmp ebx, eax
jne 0x404b98
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00404cd4
mov edx, eax
mov ebx, dword [0x69b8cc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x404bff
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x404bfd
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x404bff
xor edi, edi
cmp byte [esp], 0
je 0x404c28
mov ebx, dword [esi]
test bl, 1
jne 0x404c41
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.004015c4
cmp ebx, eax
jne 0x404c05
mov byte [esp + 1], 1
jmp 0x404c41
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.004015c4
cmp ebx, eax
jne 0x404c28
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x404bb2
cmp byte [esp], 0
je 0x404c61
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4058c0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x69b054], 0
je 0x405921
cmp word [0x69b330], 0xd7b2
jne 0x4058e9
cmp dword [0x69b338], 0
jbe 0x4058e9
mov eax, 0x69b32c
call dword [0x69b348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push 0x686788
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40594c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x68602c], 0
jne 0x40593d
push 0
push 0x686780
push 0x686788
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405ac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x686034], 0
je 0x405ae6
mov edx, esi
mov eax, ebx
call dword [0x686034]
jmp 0x405af5
mov eax, 8
call fcn.00403230
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x69b055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405a88
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x4075c8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40760a
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x40762a
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.00406db8
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x40d6bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x40d75c
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call fcn.004064dc
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call fcn.00406270
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x40d6e6
cmp byte [esp], 0
je 0x40d72b
mov eax, edi
call fcn.00406270
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x40d768
mov eax, edi
call fcn.00406270
push eax
mov eax, edi
call fcn.00406270
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.00403418
mov edx, ebx
mov eax, edi
xor ecx, ecx
call fcn.004064dc
jmp 0x40d768
mov eax, edi
mov edx, 0x40d77c
call fcn.00405b90
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40d780
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x40d823
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.00406e74
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov ecx, 0xa
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.00407530
add bp, 0x30
mov word [eax + esi*2 - 2], bp
dec esi
test ebx, ebx
jne 0x40d7a8
cmp byte [esp], 0
je 0x40d7f1
mov eax, edi
call fcn.00407530
mov word [eax + esi*2 - 2], 0x2d
dec esi
test esi, esi
jle 0x40d82f
mov eax, edi
call fcn.00407530
push eax
mov eax, edi
call fcn.00407530
lea eax, [eax + esi*2]
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
add ecx, ecx
pop edx
call fcn.00403418
mov edx, ebx
mov eax, edi
call fcn.00406e74
jmp 0x40d82f
mov eax, edi
mov edx, 0x40d844
call fcn.00406ba8
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40e99c
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp word [0x686a98], 0
jne 0x40e9d4
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e9cb
movzx eax, word [esp]
mov word [0x686a98], ax
jmp 0x40e9d4
mov word [0x686a98], 0x2c
movzx eax, word [0x686a98]
pop edx
ret