joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44739a
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x546f0d
call fcn.0054565c
sub esp, 0x3c
push esi
push edi
mov esi, ecx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x52
ja 0x4475bf
mul byte [edx + 0x4b]
jns 0x4473a4
leave
ljmp 0x3cf2
mov ecx, esi
call fcn.00447167
test al, al
je 0x447629
call fcn.004ae8cf
call fcn.004ae8cf
lea edx, [ebp + 0x20]
lea ecx, [ebp - 0x44]
call fcn.004ae369
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00401824
lea edx, [ebp + 8]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004ae369
sub esp, 0x18
mov ecx, esp
push eax
mov byte [ebp - 4], 4
call fcn.00401824
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.0044764d
add esp, 0x30
lea ecx, [ebp - 0x2c]
call fcn.0040187f
lea ecx, [ebp - 0x44]
call fcn.0040187f
push 0
push edi
lea ecx, [ebp + 8]
call fcn.004023ba
push 0
push edi
lea ecx, [ebp + 0x20]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x44764d
Capabilities:
Write file on windows

Disassembly:
or al, ch
xchg byte [ebp + 0x6afffb], ch
mov eax, 0x546f3f
call fcn.0054565c
sub esp, 0x6c
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5f
ja 0x447873
xchg edi, eax
cdq
and byte [eax], bl
clc
stosb byte es:[edi], al
xchg ecx, eax
sbb byte [eax + ebx*2], bh
pop esp
jp 0x447693
and edx, dword [ecx - 0x26]
ja 0x44762e
out 0xe4, al
xor al, 0x19
invalid
sbb dword [ebx - 0x1e], esp
int3
xor edi, edi
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.00447167
test al, al
je 0x44795a
cmp dword [0x576794], 8
push edi
push 0x80
push 4
push edi
push 3
mov eax, 0x576780
cmovae eax, dword [0x576780]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x44795a
cmp esi, 0xffffffff
je 0x44795a
push 2
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x74]
call fcn.004052e0
mov byte [ebp - 4], 2
mov edx, eax
lea ecx, [ebp - 0x5c]
mov dword [esp], str.__:___r_n
call fcn.0040535c
lea ecx, [ebp + 0x20]
push ecx
mov edx, eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.0040538c
push str._r_n__r_n_r_n_r_n
mov edx, eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0040535c
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.0040187f
lea ecx, [ebp - 0x5c]
call fcn.0040187f
lea ecx, [ebp - 0x74]
call fcn.0040187f
cmp dword [ebp - 0x18], 0x10
push edi
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.0040187f
lea ecx, [ebp + 8]
call fcn.0040187f
lea ecx, [ebp + 0x20]
call fcn.0040187f
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x451146
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
call esi
cmp eax, 0x29
ja 0x45135a
aam 0xf7
retf 0xbecd
mov eax, dword [0x5789e0]
test al, 1
jne 0x451372
or eax, 1
mov dword [0x5789e0], eax
call esi
mov dword [0x5789dc], eax
call esi
sub eax, dword [0x5789dc]
cmp eax, 0xc8
jb 0x451397
call esi
push ecx
push ecx
push edi
mov dword [0x5789dc], eax
call fcn.0043f300
mov ecx, eax
call fcn.0043de7d
pop edi
pop esi
ret
Function at 0x4515bd
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x547112
call fcn.0054565c
sub esp, 0x14
push esi
push edi
mov dword [ebp - 4], 2
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp eax, 8
ja 0x45163b
and al, 0x97
xchg edi, eax
cmp eax, 0x43bc6846
sbb al, byte [ecx - 0x2effad0b]
inc ecx
cld
cdq
test ah, ch
in eax, dx
sub al, 0xd7
adc dword [esi + 0x49], esp
sub bl, byte [esi - 0x12]
lodsb al, byte [esi]
push esi
pop ss
inc esp
arpl word [edx + 0x5d], ax
xchg edi, eax
xor al, 0xb1
mov cl, 0xf9
cmp dword [esi - 0x4c], ebx
adc cl, ch
dec ebx
xor byte [ecx], dl
lodsb al, byte [esi]
push esi
pop esp
call 0xb9a1236d
mov bl, 0xc3
or byte [ebx + 0x42eee4fd], cl
fild dword [ebp + 0x3fcace9a]
adc eax, 0xab3ec1a2
push 0xf3f19515
lcall 0x1bdd, 0xb7507d4
repne stosd dword es:[edi], eax
call edi
call edi
cmp eax, 0xd
ja 0x451845
hlt
push 0x553ec0
lea ecx, [ebp - 0x10]
call fcn.00401a3b
mov byte [ebp - 4], 3
call edi
cmp eax, 0x13
ja 0x451a60
and ah, dl
or eax, dword [edx - 0x6c590d48]
sbb eax, 0x862cae38
stosb byte es:[edi], al
xchg ebx, eax
or dword [ecx + 0x23714314], ecx
or cl, byte [esi - 0x39]
jmp dword [ecx]
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Content_Length:
call fcn.00401a3b
push ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.00402beb
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov dword [ebp - 0x1c], esp
mov esi, esp
call fcn.00402beb
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 8]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.00402beb
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
call fcn.0045704b
mov esi, eax
test esi, esi
jne 0x451cf4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
jle 0x451cf7
push eax
call fcn.0041bf02
pop ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
call edi
cmp eax, 0x1c
ja 0x451cf4
jl 0x451b5c
loopne 0x451ab2
and dword [ebp - 0x49d1b58d], 0x6c2c5b36
dec edx
mov dh, 0x36
pop ebx
sub al, 0x6c
inc eax
sti
pop edx
invalid
insb byte es:[edi], dx
add ecx, dword [edx + 0x5857b2be]
cmp edx, edx
jle 0x451afc
stosd dword es:[edi], eax
inc esi
adc al, 0x3f
stosd dword es:[edi], eax
invalid
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0x10]
call fcn.004013c0
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004013c0
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret 0x10
Function at 0x45ffa2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3f
ja 0x4601bc
lds ebx, [edi + ecx]
add byte [edi + 0x3c6c3200], bh
test eax, ebp
mov ah, 0x65
inc ebp
cmp al, 0x49
cmp byte [esi + esi*4 + 0x1f], dl
sub esp, dword [eax + 0x24]
pop esi
adc bh, ch
cdq
pop ebx
inc edx
cmp dh, byte [edi + 0x2a78f7c6]
and eax, 0x80757cf3
push 0x185ef1c2
adc al, 0x12
int1
mov ebx, 0xa18eed5c
mov bh, 0xf7
pushal
cwde
retf 0x5c10
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [eax], ebx
call fcn.004ae8cf
cmp dword [eax + 0x278], ebx
je 0x46027e
call fcn.004ae8cf
cmp dword [eax + 0x374], ebx
je 0x46027e
call fcn.004ae8cf
cmp dword [eax + 0x280], ebx
je 0x46027e
test esi, esi
je 0x46027e
test edi, edi
je 0x46027e
mov dword [edi], ebx
call fcn.004ae8cf
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [eax + 0x278]
mov esi, eax
test esi, esi
je 0x46027e
cmp esi, 0xffffffff
je 0x46027e
call fcn.004ae8cf
push ebx
push esi
call dword [eax + 0x374]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x460277
inc eax
push eax
call fcn.00417f6a
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x460277
mov dword [ebp - 8], ebx
call fcn.004ae8cf
push ebx
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
push dword [ecx]
push dword [ebp - 4]
push esi
call dword [eax + 0x280]
test eax, eax
je 0x460277
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x460285
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, 0x547257
call fcn.0054565c
sub esp, 0x20c
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x25
ja 0x4604b0
rcr byte [edi], cl
pop ss
push es
mov ebx, 0xad29e193
cmp esi, dword [eax + 0x1fc6bda4]
mov byte [si + 0x57], ch
and dword [esi], 0xfffffff8
les eax, [ecx + ecx + 0x1f]
sbb al, 0x1b
sub byte [eax], dl
popfd
fcomp qword [ebp + 0x4c]
xchg esi, eax
sub dword [eax + edi*4], ecx
sub byte [esi], ch
push es
invalid
mov eax, dword [0x5789e8]
mov edi, 0x5789e4
test al, 1
jne 0x4604e4
or eax, 1
mov dword [0x5789e8], eax
push 0x553ec0
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00401a3b
push 0x54c213
call fcn.0041b67b
pop ecx
mov byte [ebp - 4], bl
mov eax, dword [0x5789e4]
cmp dword [eax - 0xc], ebx
je 0x4604f6
lea ecx, [eax - 0x10]
jmp 0x460581
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.0041b930
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x558300
push edi
call fcn.0040326a
add esp, 0x10
push ebx
push dword [0x5789e4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x460578
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x460578
lea eax, [ebp - 0x218]
push eax
call fcn.0041b53d
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.00402590
mov ecx, dword [0x5789e4]
lea ecx, [ecx - 0x10]
call fcn.00402beb
mov ecx, dword [ebp + 8]
add eax, 0x10
lea ecx, [ecx - 0x10]
mov dword [esi], eax
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x46221a
Capabilities:
Encode data using xor

Disassembly:
lock adc edx, dword [ecx + 0x16]
clc
stosd dword es:[edi], eax
mov eax, 0x57ebc38f
fisubr dword [edx + edx - 0x49632584]
js 0x462215
jge 0x46220d
scasb al, byte es:[edi]
inc edx
invalid
invalid
aaa
jae 0x4621aa
out dx, al
mov al, byte [0x81d6976b]
cmp dword [eax], ebx
aam 0x48
out 0x49, al
dec ecx
fsub qword [ebp + esi*4 + 0x63be770]
jg 0x4621e3
pushfd
jp 0x462191
push esp
je 0x46224b
adc ebx, dword [esp + eax]
xor byte [0xe1bed2fc], dh
cmp byte [edi - 0x650d04f0], bl
jmp 0x46224d
add al, ch
sub al, bh
stc
dec dword [ebx - 0x3d36f7bb]
add al, 0
or cl, cl
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x1b
ja 0x462433
add dword [eax], eax
add byte [ebp + eax*4 - 2], ch
insb byte es:[edi], dx
test esi, edi
bnd jmp 0x4621eb
push ss
pop ds
jbe 0x4621d5
leave
lcall 0x4d9d, 0x8cf4e48f
inc ecx
dec edx
mov bl, 0x57
sub dword [edx + 0x66eb2062], 0xffffff89
salc
add dl, 0x6e
jge 0x462231
outsd dx, dword [esi]
push cs
in al, dx
int3
mov ecx, esi
call fcn.00405d43
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00402beb
lea ecx, [eax + 0x10]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
leave
ret 4
Function at 0x4684e3
Capabilities:
Encode data using base64

Disassembly:
jle 0x4684bb
adc byte [edx + 4], dh
mov ecx, dword [esi]
jmp 0x4684b0
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ecx + 1], al
cmp dword [esi + 0x14], 0x10
jb 0x4684c6
add dword [ebx + 0x7210147e], eax
add al, 0x8b
push es
mov eax, dword [esi]
jmp 0x4684c8
mov eax, esi
shr ebx, 0x12
and bl, 7
or bl, 0xf0
push esi
push edi
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x20
ja 0x468704
xchg edx, eax
dec ebp
fxch st(2)
lcall 0x9790, 0x6034a0ad
lodsd eax, dword [esi]
pop ss
dec ebx
or al, 0xa0
mov word [eax + 0x65], es
sub byte [ebp + 0x10], bh
push ebp
jns 0x468575
push ss
push esi
jl 0x4684a5
xor eax, 0xd478b953
movsb byte es:[edi], byte [esi]
jp 0x468572
inc eax
sub eax, 0xb2eafe5
xchg esi, eax
add al, 0x3d
test esi, 0x64a9f5d2
and ebp, ecx
or edi, dword [edx + ebx*8 - 0x786f1c61]
pop eax
mov bl, 0x6b
pop ebx
hlt
sbb bh, cl
cwde
mov dword [0x473f70bd], eax
inc ebp
shl al, 0xfc
mov al, byte [0x707e9678]
inc edi
cmpsd dword [esi], dword es:[edi]
or cl, cl
and byte [edi - 0x47], 0x35
sbb byte [ecx + 0xc], bl
cld
les ebx, [eax + 0x7586a2c8]
add al, 0xb0
push ebx
bound eax, qword [eax + 0x380f0cb8]
xchg ebx, eax
lodsd eax, dword [esi]
sar byte [ecx], cl
in eax, dx
invalid
mov al, byte [esi]
cmp al, 0xa
je 0x46870d
cmp al, 0xd
je 0x46870d
inc esi
cmp esi, edi
jb 0x4686f9
xor al, al
pop edi
pop esi
ret
mov al, 1
jmp 0x46870a

Function at 0x46c55b
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [ecx], vtable.Json::ValueAllocator.0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 6
ja 0x46c5b3
fstp qword [eax - 0x4d]
insd dword es:[edi], dx
dec esi
repe cmpsd dword cs:[esi], dword es:[edi]
invalid
ret
Function at 0x46ccbd
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
rcr dword [ebx], 0xba
invalid
xchg ebx, eax
add al, 0x36
jle 0x46cc49
mov al, byte [0x16630b3f]
clc
into
mov byte [ebx + 0x5d384ad2], bl
push eax
ret
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
movsd qword [ebp - 8], xmm1
adc dword [ebp - 8], ecx
and dword [esi + 0xc], 0
mov byte [esi + 8], 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x31
ja 0x46cee0
sub byte [ebx], dh
cdq
inc ebp
pop esp
mov ch, 1
xchg dword [eax + 0x5d], ebp
loop 0x46cc85
pop edx
push ebx
aad 0x7a
mov edi, 0x14dee645
push es
mov byte [0x717b7de7], al
xor dword [edx + 0x561226b7], edi
aad 0x1f
and dword [esi - 0x1c], esp
loope 0x46ccc7
sub eax, dword gs:[ebp - 0x59]
mov dword [0xfb0d1ab5], eax
dec ebx
rcr dword [edi], 0xee
cmp ah, cl
cmp dh, byte [eax + ebp*2 + 0x59]
or edx, dword [edx + 0x2ef77995]
loope 0x46cd97
mov edx, 0x4e098e23
xchg ecx, eax
or byte [ebx + 0x1e22760e], dl
sbb eax, dword [ebx + 0x28ffeda3]
add dword [eax], ebp
nop
repne insb byte es:[edi], dx
rcl byte [edi]
push ss
push cs
clc
mov dl, 0x4e
dec esi
xchg edx, eax
xor esi, edi
jecxz 0x46cd2c
dec ecx
fimul dword [ebx]
sal dword cs:[esi + 0x4a], 1
xor al, 0x36
and al, 0xee
jg 0x46cd43
jns 0x46cd1e
mov ecx, 0x8469345
and ebx, ebx
push es
cmp eax, 0x4f3ada5e
dec di
ja 0x46cd71
sub bh, byte [esi - 0x43]
cld
cmp dl, cl
mov ah, 0xc2
and eax, 0x2f5f3586
or dword [esi + edi*8], ecx
and dword [eax], eax
std
call 0xaf4bd6f9
ret
ret 0x8625
jmp dword [ecx + 0x5e]
movsd xmm0, qword [ebp - 8]
movsd qword [esi], xmm0
mov eax, esi
pop esi
leave
ret

Function at 0x46f462
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
and dword [esi + 0xc], 0
mov byte [esi + 8], 4
or dword [esi + 8], 0x100
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x41
ja 0x46f685
dec ebp
xor al, 0x47
and eax, 0x70df23f9
and eax, edx
test eax, 0x56b1b8dd
sub edx, dword [eax]
and ch, ah
sub cl, byte [esi]
mov ebp, 0xf9a31a7a
xchg ebp, eax
wait
jmp 0x46f4a8
sbb eax, 0x55da6225
invalid
call fcn.0046c321
mov ecx, dword [eax]
push 0xffffffffffffffff
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax + 0xc]
mov dword [esi], eax
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x4704c4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x69
ja 0x4706d5
cmp ch, ch
jne 0x470500
movsd dword es:[edi], dword [esi]
daa
xchg ecx, eax
mov cl, 0xae
dec ebp
popfd
push esp
cmpsd dword [esi], dword es:[edi]
neg byte [edi]
xchg esi, eax
iretd
inc ebx
cmp dword [ecx - 0x21612019], 0x5b
sbb ch, byte [edx + 0x47]
idiv esi
aam 0xff
sub al, 0x87
add dword [esi + 0x68], esp
mov esp, 0x1f467ae3
or dl, byte [edx + eax + 0x47]
mov ebp, 0x4acc2ff5
inc ebx
lodsb al, byte [esi]
arpl word [edx + 0x84ad44f], bx
fprem1
out 0x73, eax
push ss
add ebp, dword [edx + edx*4 - 0x77c2714f]
pslld mm2, mm5
mov ecx, 0xdbe6ced7
mov dl, 0xb7
call dword [eax + 0x4f]
sub eax, 0xcdabb3f3
cmp byte [ecx + 0x1a8dc98f], dh
pop edx
xchg esi, eax
fbstp tbyte [edi]
add ah, ah
outsb dx, byte [esi]
pop edi
push ebx
shr dword [eax*8 - 0x6b9a9b7f], cl
fisubr word [0x52e43ea5]
xlatb
adc byte [eax - 0x50], bh
stosb byte es:[edi], al
or ebp, dword [edi + 0x5b]
cmp edi, ebp
push ecx
dec ebx
ljmp 0xcd8d
mov eax, dword [esi + 0x38]
sub eax, dword [esi + 0x44]
push 0
push eax
lea ecx, [esi + 0x28]
call fcn.004067e3
pop esi
ret

Function at 0x4736b1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
xor ecx, ecx
mov dword [esi], vtable.Json::StyledWriter.0
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x20], ecx
push 0xf
pop eax
mov dword [esi + 0x24], eax
mov byte [esi + 0x10], cl
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], ecx
mov byte [esi + 0x28], cl
mov dword [esi + 0x40], 0x4a
mov dword [esi + 0x44], 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x49
ja 0x4738f6
cmpsb byte [esi], byte es:[edi]
dec ecx
imul eax, dword [bx + di], 0xbef2534e
push eax
call 0x6a2ea6b2
xchg esi, eax
mov al, byte [0xd4fe9bd]
sbb byte [edx - 0x3a140ee], dl
bound ebx, qword [edx + 0x26]
push ss
cld
sbb bh, byte [ebp - 0x71]
pop ebx
invalid
mov eax, esi
pop esi
ret

Function at 0x473d6b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov dword [esi], vtable.Json::FastWriter.0
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov byte [esi + 0x1c], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x4c
ja 0x473f94
or eax, 0xe49a98c7
pop es
in al, 7
lds eax, [edi + 0x616c4eff]
dec ecx
sub al, bh
mov cl, 0xb5
or al, 0x10
pop ecx
xor byte [esi - 0x692b2adc], al
inc esi
rcr byte [esi + 0x53], 0x3c
lcall 0x4fbd, 0xc8d3d3e2
jbe 0x473d99
int3
mov eax, esi
pop esi
ret
Function at 0x476077
Capabilities:
Delete file
Move file

Disassembly:
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x29
ja 0x476288
aaa
inc esi
mov byte [eax + 0x30], ah
sub al, 0xa3
in al, dx
push edx
rcr dword [edi], 0x38
mov edi, 0xa4c0ce60
jge 0x4760f5
enter 0x4e1, 0x40
iretd
mov edx, ebp
invalid
mov ecx, edi
call fcn.00477631
test al, al
jne 0x47629a
mov eax, 0x80070002
pop edi
ret
push esi
push 4
pop esi
mov ecx, edi
call fcn.004773e9
push 5
Function at 0x4762c6
Capabilities:
Check for time delay via gettickcount

Disassembly:
inc esp
adc dword [eax], eax
add byte [edx + 5], ch
pop ecx
test al, al
cmove esi, ecx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
test eax, eax
jne 0x4762c2
pop edi
jmp fcn.0040b3ee
xor eax, eax
pop edi
ret
mov eax, 0x547de2
call fcn.0054565c
sub esp, 0x18
push edi
mov edi, ecx
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x60
ja 0x4764e7
dec ebx
and eax, 0xc4317ae3
push esi
insb byte es:[edi], dx
mov eax, 0x379b4c5b
imul dword [ebx - 0x5a]
and eax, 0x7fa78343
pop ecx
push ss
scasb al, byte es:[edi]
push 0xffffffffffffffd8
sbb byte [edi + 0x1a], ch
aaa
aaa
pop ecx
into
and eax, 0x960f61ed
cmp al, 0xc7
push ds
loope 0x476346
lodsb al, byte [esi]
insb byte es:[edi], dx
inc ebp
pop ebx
push 0xffffffffffffffb5
pop ds
jo 0x4762a1
pushal
jbe 0x47636f
int1
aas
xchg esp, eax
or bh, byte [eax + 0x68bd492b]
add al, 0x4a
pop ebx
out dx, eax
mov ah, byte [edx - 0x62e99e32]
inc edi
clc
mov ch, ah
salc
pop ecx
sub bl, 0x38
sbb cl, dl
mov al, dh
jg 0x476376
in eax, 0x99
mov esi, dword [edi]
cwde
jp 0x476383
or byte [edi], 0x5b
invalid
jno 0x4763a5
dec ebx
push edi
in al, dx
out dx, al
salc
retf 0x149a
and ch, byte [edx]
mov byte [ecx + 0x37], bh
cmp al, 0x9d
wait
invalid
cmp ah, byte [ebx + edi*8 - 0x4cc1abde]
movsd dword es:[edi], dword [esi]
or ebx, dword [ecx + 0x6e12ac60]
pop edi
push 0xffffffffffffffe2
and bl, byte [edx + esi*8]
push edx
invalid
mov ecx, edi
call fcn.00477631
test al, al
je 0x4765f1
push ebx
push esi
push 0x571258
lea ecx, [ebp - 0x10]
call fcn.004024e8
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00477b0c
mov edx, dword [eax]
push ecx
mov ecx, edi
call fcn.0047c9e0
mov bl, al
pop ecx
mov ecx, dword [ebp - 0x18]
neg bl
sbb bl, bl
add ecx, 0xfffffff0
call fcn.004013c0
inc bl
je 0x4765d2
lea ecx, [ebp - 0x1c]
call fcn.00477b0c
push ecx
mov byte [ebp - 4], 1
mov edx, dword [eax]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0047cc4b
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004013c0
push edi
lea ecx, [ebp - 0x14]
call fcn.00401a3b
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00476600
mov esi, eax
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push dword [esi]
lea eax, [ebp - 0x10]
push dword [ebp - 0x18]
push str._s_s_x
push eax
call fcn.0040326a
mov ecx, dword [ebp - 0x20]
add esp, 0x14
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004013c0
mov esi, dword [ebp - 0x10]
push ecx
mov edx, esi
mov ecx, edi
call fcn.0047687b
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov edi, eax
call fcn.004013c0
test edi, edi
js 0x4765d7
mov ecx, esi
jmp 0x4765dc
mov esi, dword [ebp - 0x10]
jmp 0x4765da
mov edi, dword [ebp - 0x24]
mov ecx, edi
call int.00476077
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.004013c0
pop esi
mov eax, edi
pop ebx
jmp 0x4765f3
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x477b0c
Capabilities:
Encode data using xor
Get common file path

Disassembly:
call fcn.0040b3ee
jmp 0x477b08
test dword [eax + 0x50fffffd], esi
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
lea edx, [ebp - 0x240]
test eax, eax
lea ecx, [ebp - 0x250]
cmovle ecx, edx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x477ab4
xor eax, eax
pop edi
pop esi
leave
ret
mov eax, 0x547e1f
call fcn.0054565c
fisttp dword [eax + eax]
sub esp, 0xc
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3d
ja 0x477d36
jb 0x477add
popfd
jl 0x477b68
and byte [ebp + 0x7b], ch
and ch, byte [eax + 0x1bcf74d7]
dec esi
loop 0x477b99
test al, 0xd7
je 0x477b13
sbb ecx, dword [esi - 0x1e]
push ecx
jb 0x477b40
and al, 0x1a
mov dword [0xc4e982fd], eax
imul edi, eax, 0x74
ret
mov ebx, 0xf199e413
mov dl, 0x80
xchg ecx, eax
fbld tbyte [esi + 0x7b5c49a9]
mov ebx, edx
mov cl, ah
fld qword [ebx - 0x1304fe51]
jo 0x477b93
adc ecx, dword [edx]
push ds
mov ch, 0xc1
dec dx
xchg ebx, eax
xchg byte [edx], dh
iretd
add ecx, dword [ecx + 0x64]
mov ebp, 0x18f51f6c
jo 0x477bb1
cmc
sbb byte [eax + 0x14], dh
push ecx
mov eax, ecx
arpl di, bx
mov al, 0x20
sbb byte [edi - 0x3a442f5f], al
mov ebx, 0xa2fb2e4b
xor eax, 0x8e850cd8
add al, 0x26
or al, 0x85
mov es, word [esi]
movsb byte es:[edi], byte [esi]
sub eax, dword [ebx - 0x6698f021]
test byte [eax - 0x7452e8ea], dh
mov edx, 0xfa4515c4
add dword [ecx - 0x2052b01d], ebp
aad 1
inc edi
dec ecx
xor edx, dword [edx + 0x52]
push 0x46
clc
dec al
dec edx
rol dword [edx + eax*2], 1
jb 0x477bb3
shl byte [ebp + ebp - 0x578617be], cl
and eax, 0xfa942182
ja 0x477c11
sub dword [ecx - 0x48943b9f], ebp
invalid
mov byte [0x17ce25b5], al
fstp qword [ebp + 0x54]
scasb al, byte es:[edi]
lahf
scasd eax, dword es:[edi]
add ebp, edi
and eax, 0xb8e3ac80
mov ebx, 0x5022cc61
scasb al, byte es:[di]
in eax, 0xb
push 0xeb82d55
cdq
add al, 0x8c
shl cl, 1
invalid
push ebx
push 0x571258
mov ecx, esi
call fcn.004024e8
mov ebx, 0x1000
mov dword [ebp - 4], edi
push ebx
mov ecx, esi
mov dword [ebp - 0x10], 1
call fcn.00402558
mov ecx, dword [esi]
mov edx, eax
cmp dword [ecx - 8], ebx
jge 0x477d6d
push 0x80070057
call fcn.00401278
mov dword [ecx - 0xc], ebx
mov eax, dword [esi]
push edx
xor ecx, ecx
push ebx
mov word [eax + 0x2000], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
mov ecx, esi
call fcn.0040b493
mov edx, dword [esi]
pop ebx
mov eax, dword [edx - 0xc]
test eax, eax
jle 0x477dce
lea ecx, [eax - 1]
test ecx, ecx
js 0x477d63
cmp ecx, eax
jg 0x477d63
cmp word [edx + ecx*2], 0x5c
jne 0x477dce
push ecx
push edi
lea eax, [ebp - 0x14]
push eax
mov ecx, esi