joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46364c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405848
mov eax, dword [ebp - 8]
call fcn.00405848
xor eax, eax
push ebp
push 0x463756
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 1
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403aec
push 1
call sub.kernel32.dll_Sleep_2
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], 0x540
cmp byte [0x48dc14], 0
je 0x4636c2
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x4636ca
mov eax, 0x463768
mov dword [ebp - 0x38], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004635c4
mov eax, dword [ebp - 0x48]
call fcn.00405d34
mov dword [ebp - 0x34], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004635c4
mov eax, dword [ebp - 0x4c]
call fcn.00405d34
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x46372e
push 1
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcessId
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46375d
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00405bbc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret

Function at 0x463780
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x463824
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x463809
mov eax, dword [ebp - 0xc]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x463834
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x463809
mov eax, edi
mov edx, dword [ebp - 0x14]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46382b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x463944
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x463af8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x134]
mov eax, 0x463b10
call fcn.00463780
mov eax, dword [ebp - 0x134]
mov edx, 0x463b28
call fcn.004057f0
setne byte [ebp - 5]
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x463ac4
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.0046385c
cmp dword [ebp - 4], 0
je 0x463ab7
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040e22c
mov eax, dword [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
call fcn.00463774
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0040e22c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
jne 0x463a96
lea eax, [ebp - 0x14c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00465070
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004095d0
mov eax, dword [ebp - 0x144]
mov edx, 0x463b40
call fcn.004057f0
sete al
and al, byte [ebp - 5]
je 0x463a96
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
lea eax, [ebp - 0x150]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 4]
call fcn.00405694
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4639e0
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463aff
lea eax, [ebp - 0x150]
mov edx, 8
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x463c38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x463c6d
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x48ddf4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x463c4d
pop edi
pop esi
pop ebx
ret
Function at 0x463ca0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463d2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
jne 0x463d04
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x110]
call fcn.0040ccd0
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x408900]
call fcn.0040d4e4
call fcn.00404d34
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a5d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463d31
lea eax, [ebp - 0x110]
call fcn.004053c8
ret

Function at 0x463f18
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x46409e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x46406a
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a28c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409548
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409548
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
je 0x46403d
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409548
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409548
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004057f0
jne 0x464057
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x463f98
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4640a5
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x464384
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4644e8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4644b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
nop
add eax, 0
add eax, 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x10]
call fcn.00409f58
test al, al
je 0x4643ef
nop
add eax, 0
add eax, 0
push ebx
call sub.kernel32.dll_DeleteFileA
nop
add eax, 0
add eax, 0
nop
add eax, 0
add eax, 0
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
xor edx, edx
call fcn.004635c4
mov eax, dword [ebp - 0x14]
call fcn.00405d34
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4644a7
push dword fs:[eax]
mov dword fs:[eax], esp
nop
add eax, 0
add eax, 0
cmp dword [ebp - 8], 0
je 0x464489
nop
add eax, 0
add eax, 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
nop
add eax, 0
add eax, 0
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
nop
add eax, 0
add eax, 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4644ae
nop
add eax, 0
add eax, 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x4649a4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464a3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x90]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x90]
call fcn.00409f58
test al, al
je 0x464a25
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x8c]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464a25
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00425684
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425710
mov eax, ebx
call fcn.00425550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464a45
lea eax, [ebp - 0x90]
call fcn.004053c8
ret
Function at 0x464a50
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464ae9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8c]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x8c]
call fcn.00409f58
test al, al
je 0x464ad0
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x88]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464ad0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00425684
mov edx, edi
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425710
mov eax, ebx
call fcn.00425550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464af0
lea eax, [ebp - 0x8c]
call fcn.004053c8
ret
Function at 0x4650ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov eax, ebp
mov edx, esi
call fcn.0040541c
mov eax, esi
test eax, eax
je 0x4650c8
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jbe 0x4650fd
mov ebx, 1
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 4
mov byte [eax + ebx - 1], dl
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 0xc
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x4650d3
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x466684
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x46674d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x466732
mov eax, dword [ebp - 0x10]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x46675c
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x466711
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004055c0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x466784
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x466732
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466754
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret

Function at 0x4667a8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x46684c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x466831
mov eax, dword [ebp - 0xc]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x46685c
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x466831
mov eax, edi
mov edx, dword [ebp - 0x14]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466853
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x467060
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x467172
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
call fcn.00466590
test al, al
je 0x4670a7
mov byte [ebp - 5], 1
jmp 0x46714c
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x467142
mov eax, dword [edi + 8]
call fcn.00466b74
test al, al
je 0x4670d9
mov byte [ebp - 5], 1
jmp 0x467146
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.004669cc
cmp dword [ebp - 4], 0
je 0x467135
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov ecx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x134]
call fcn.00466880
test al, al
je 0x467135
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4670c7
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467179
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x467248
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
xor ecx, ecx
mov eax, dword [0x6377f8]
test eax, eax
je 0x46728b
movzx edx, word [eax]
not dx
cmp dx, 0x5a4d
je 0x46728b
mov esi, eax
mov edx, esi
mov ebx, dword [eax + 0x3c]
add edx, ebx
mov edx, dword [edx]
not edx
cmp edx, 0x4550
je 0x46728b
mov edx, ebx
add edx, 0x18
add edx, 0x34
sub edx, 8
add edx, 0x14
add edx, esi
mov eax, edx
mov ecx, dword [eax]
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x46b0bc
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov edi, eax
mov eax, dword [0x63b3a8]
lea esi, [0x48e204]
mov ecx, edx
or ecx, ecx
je 0x46b0e5
xor ebx, ebx
mov bl, al
shr eax, 8
xor bl, byte [edi]
inc edi
shl ebx, 2
xor eax, dword [ebx + esi]
dec ecx
jne 0x46b0d2
mov dword [0x63b3a8], eax
pop ebx
pop esi
pop edi
ret
Function at 0x46eebc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00405848
xor eax, eax
push ebp
push 0x46ef61
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebp - 8]
call fcn.00467ae0
mov esi, dword [ebx + 0x1c]
mov dword [esi + 0x53c], ebx
mov dword [esi + 0x538], 0x46ee24
mov dword [esi + 0x544], ebx
mov dword [esi + 0x540], 0x46ee84
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x46ee3c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebp - 4], eax
push ebp
call fcn.0046ee98
pop ecx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetExitCodeThread
cmp dword [ebp - 0xc], 0
je 0x46ef4b
mov eax, ebx
call fcn.0046ed20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ef68
lea eax, [ebp - 8]
call fcn.004053c8
ret

Function at 0x470574
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov dword [0x48ebd0], 0xffffffff
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov ebx, 0xff
jmp 0x4705b8
cmp dword [0x48ebd0], 0
je 0x4705ca
mov eax, edi
call fcn.004704e0
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, ebp
jbe 0x4705b8
mov ebx, 0x102
jmp 0x4705ca
cmp ebx, 0xff
jne 0x4705ca
mov eax, dword [0x6339ec]
cmp byte [eax], 0
je 0x470594
xor eax, eax
mov dword [0x48ebd0], eax
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x473b64
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
or ebp, 0xffffffff
cmp dword [esp], 0x32
jne 0x473c44
mov esi, ebx
movzx eax, word [esi + 2]
cmp ax, 0x2417
jbe 0x473c44
cmp ax, 0x241d
jae 0x473c44
push 0x32
call fcn.004070d8
pop ecx
mov esi, eax
mov ecx, 0x32
mov edx, ebx
mov eax, esi
call fcn.00408378
movzx ebp, word [esi + 2]
sub ebp, 0x2012
sub ebp, 6
sub ebp, 0x400
dec ebp
cmp ebp, 0xffffffff
jne 0x473c19
mov dword [esp + 4], 4
mov ebx, 0x63c8cc
mov eax, dword [ebx]
call fcn.0047393c
push 0x32
call fcn.004070d8
pop ecx
mov edi, eax
mov ecx, 0x32
mov edx, esi
mov eax, edi
call fcn.00408378
mov eax, dword [ebx]
mov edx, edi
call fcn.00423fa4
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebx]
mov dword [edx + 4], eax
add ebx, 4
dec dword [esp + 4]
jne 0x473bd5
push esi
call fcn.004070e8
pop ecx
jmp 0x473c44
mov eax, ebp
sub eax, 4
jae 0x473c3f
mov eax, dword [ebp*4 + 0x63c8cc]
mov edx, esi
call fcn.00423fa4
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp*4 + 0x63c8cc]
mov dword [edx + 4], eax
jmp 0x473c44
mov ebp, 0xfffffffe
mov eax, ebp
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47574c
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48ec58], ax
cmp byte [0x48ec54], 0
jne 0x475761
xor ebx, ebx
jmp 0x4757c4
call fcn.00475710
push esp
push 0
push 0
push 0x47526c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x4757b8
cmp dword [0x48ec50], 0
je 0x475799
push 0x64
mov eax, dword [0x48ec50]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x47577f
cmp dword [0x48ec64], 0
jbe 0x4757aa
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48ec64]
jmp 0x4757c4
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.00474e54
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x476b5c
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48ed40], ax
cmp byte [0x48ed3c], 0
jne 0x476b71
xor ebx, ebx
jmp 0x476bd4
call fcn.00476b20
push esp
push 0
push 0
push 0x47667c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x476bc8
cmp dword [0x48ed38], 0
je 0x476ba9
push 0x64
mov eax, dword [0x48ed38]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x476b8f
cmp dword [0x48ed4c], 0
jbe 0x476bba
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48ed4c]
jmp 0x476bd4
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.00476264
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x47734c
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x477508
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 0
xor eax, eax
push ebp
push 0x4774d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x477324]
call fcn.004068bc
add esp, 4
test esi, esi
je 0x4773cf
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00477ab0
jmp 0x477414
mov ebx, 0x41
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004055b0
lea eax, [ebp - 0x14]
mov edx, 0x477520
call fcn.00405694
mov esi, dword [ebp - 0x14]
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x47740e
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00477ab0
inc ebx
cmp ebx, 0x5b
jne 0x4773d4
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 0
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x477463
inc esi
xor ebx, ebx
mov edx, dword [0x47728c]
xor eax, eax
call fcn.00423e9c
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [eax + ebx*4], edi
mov eax, dword [ebp - 8]
mov dword [edi + 0x6c], eax
lea eax, [edi + 0x30]
push eax
push 4
push edi
push 0x4772c8
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*4]
mov dword [edx + 0x20], eax
inc ebx
dec esi
jne 0x477426
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x477484
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.0042519c
push 1
call sub.kernel32.dll_Sleep_1
inc ebx
dec esi
jne 0x47746e
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4774a9
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.004251f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00423ebc
inc ebx
dec esi
jne 0x47748f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4774df
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00477b18
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 1
ret