joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40effc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
dec ecx
test ecx, ecx
jl 0x40f024
inc ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
xor esi, eax
and esi, 0xff
mov esi, dword [esi*4 + 0x4ab26c]
shr eax, 8
xor esi, eax
mov eax, esi
inc ebx
dec ecx
jne 0x40f006
pop esi
pop ebx
ret

Function at 0x4134a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4134d5
dec al
je 0x413510
dec al
je 0x413555
dec al
je 0x4135be
jmp 0x413648
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x413648
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4134e5
jmp 0x413648
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x413648
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x413520
jmp 0x413648
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x413648
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x413584
xor ebp, ebp
jmp 0x413594
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x41359d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x413565
jmp 0x413648
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x413648
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x413617
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0040f028
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4135d2
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41da9f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push ebx
jmp 0x41daab
xor ebx, 0x258c
add ebx, 0xdfaa
sub ebx, 0x17d4
pop ebx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x41dae1
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x41db44
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x41da00
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x41da00
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x41db2e
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x41db38
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x41db8d
push edx
and edx, 0xe44a
jmp 0x41db59
and edx, 0x13728
jmp 0x41db64
pop edx
push esi
and esi, 0x7746
and esi, 0x5e57
add esi, 0x1bb1
xor esi, 0xbf90
pop esi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x41dbf5
push edx
sub edx, 0x40a0
pop edx
push ecx
push ecx
add esp, 4
and ecx, 0xb8bf
add ecx, 0xb1df
and ecx, 0x397d
xor ecx, 0x10531
pop ecx
push ecx
push edi
add esp, 4
and ecx, 0x10897
pop ecx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x41dbeb
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x41d9a1
mov dword [ebp - 0x2e0], 0
Function at 0x41ec44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lock add dword [esi + 0x50580000], eax
push ebx
add esp, 4
or eax, 0x11588
xor eax, 0x2287
pop eax
mov ecx, dword [ebp - 0x3cc]
add ecx, 0xe
mov dword [ebp - 0x1918], ecx
push esi
push eax
add esp, 4
xor esi, 0x4f44
and esi, 0xa995
sub esi, 0xca6f
pop esi
push esi
and esi, 0x18170
jmp 0x41ec90
pop esi
push ecx
push ecx
add esp, 4
or ecx, 0x75b1
pop ecx
cmp dword [ebp - 0x3cc], 0
je 0x41ecaf
cmp dword [ebp - 0xa5c], 0
jne 0x41ecf5
push eax
and eax, 0x16d5c
pop eax
push edi
push eax
add esp, 4
and edi, 0x140f5
sub edi, 0x2a66
xor edi, 0xaa44
pop edi
push ebx
push eax
add esp, 4
add ebx, 0xb30d
or ebx, 0x1303b
pop ebx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push eax
push esi
add esp, 4
sub eax, 0x1b10
and eax, 0x14d0d
or eax, 0x7249
pop eax
push eax
push ecx
add esp, 4
or eax, 0x1854e
and eax, 0x519c
jmp 0x41ed30
pop eax
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push ebx
push eax
add esp, 4
or ebx, 0x10f18
xor ebx, 0x1517f
pop ebx
push edi
push esi
add esp, 4
jmp 0x41ed7b
sub edi, 0x35b6
pop edi
push edi
push eax
add esp, 4
xor edi, 0x2011
pop edi
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push esi
sub esi, 0x8948
add esi, 0x5805
pop esi
push ecx
push ecx
add esp, 4
call 0x41ee19
add byte [ebx], dh
inc eax
cmp al, 0x4b
inc ebx
cmp dword [eax + 0x3b], ecx
xor eax, 0x8104c483
jmp 0x433357
pop es
mov eax, dword [edx - 0x72e8f7c8]
mov esi, 0xcf070705
lea esi, [eax]
add eax, 0x8080707
or byte [eax], cl
pop esi
or ecx, dword [ebx + 0x46]
push edx
pop cx
pop esi
mov ecx, esp
or al, 0xf3
push cs
inc edx
inc esp
dec edi
dec eax
inc esp
mov ecx, ecx
sti
insb byte es:[edi], dx
or byte [eax], cl
popal
pop ebx
pop eax
mov ecx, esp
or al, 0xf3
or edx, dword [ecx + 0x48]
dec eax
mov ebx, edi
lea edx, [eax + 8]
or byte [ecx + 0x82109f3], cl
or byte [ebx - 0x6d], ah
lea esi, [eax]
add eax, 0x50930707
and byte [ecx + 0x704a895], dl
pop es
pop edi
pop ecx
mov ecx, esp
or al, 0x89
neg eax
cmp al, 9
or bl, dh
or al, 0x44
dec ebp
push esi
inc ecx
mov edi, esi
in eax, 0x3d
or dword [eax], ecx
mov edi, edx
insb byte es:[edi], dx
imul ecx, dword [ecx], 8
pop ebx
lock adc cl, byte [eax]
or byte [eax], cl
or byte [eax + 0x53], al
dec edi
cmp al, byte [ebx + eax*2 + 0x46]
push edi
cmp al, 0x8b
int3
Function at 0x41f154
Capabilities:
Get number of processors

Disassembly:
add esp, 4
or ecx, 0x175bf
pop ecx
push ecx
push edx
add esp, 4
call 0x41eeda
add byte [eax + 0x4e], cl
dec ebp
xor edx, dword [eax + 0x50]
cmp eax, dword [ebx - 0x7ca6fb3c]
mov ebp, 0xfffff3b4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2a8], 0
jmp 0x41f141
push esi
push eax
add esp, 4
call 0x41f154
add byte [ebp + 0x4a], al
push eax
xor eax, 0x444b4c45
add esp, 4
pop esi
push esi
xor esi, 0xd847
jmp 0x41f166
xor esi, 0xe5e
sub esi, 0x69fe
pop esi
cmp dword [ebp - 0x2a8], 0
jne 0x41fa78
mov eax, 0x6b
mov word [ebp - 0x16e8], ax
mov ecx, 0x65
mov word [ebp - 0x16e6], cx
mov edx, 0x72
mov word [ebp - 0x16e4], dx
mov eax, 0x6e
mov word [ebp - 0x16e2], ax
mov ecx, 0x65
mov word [ebp - 0x16e0], cx
mov edx, 0x6c
mov word [ebp - 0x16de], dx
mov eax, 0x33
mov word [ebp - 0x16dc], ax
mov ecx, 0x32
mov word [ebp - 0x16da], cx
mov edx, 0x2e
mov word [ebp - 0x16d8], dx
mov eax, 0x64
mov word [ebp - 0x16d6], ax
mov ecx, 0x6c
mov word [ebp - 0x16d4], cx
mov edx, 0x6c
mov word [ebp - 0x16d2], dx
xor eax, eax
mov word [ebp - 0x16d0], ax
push ebx
push eax
add esp, 4
add ebx, 0x3385
call 0x41f232
add byte [ebp + 0x45], al
cmp dword ss:[edi + ecx*2], esi
inc ebp
dec ebp
add esp, 4
pop ebx
push ecx
xor ecx, 0x3735
sub ecx, 0x11c23
pop ecx
push eax
jmp 0x41f24a
pop eax
mov byte [ebp - 0x830], 0x4c
mov byte [ebp - 0x82f], 0x6f
mov byte [ebp - 0x82e], 0x61
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push edi
push eax
add esp, 4
xor edi, 0x1d86
pop edi
push ebx
push esi
add esp, 4
sub ebx, 0x17883
xor ebx, 0x13f15
xor ebx, 0x121ac
jmp 0x41f2f7
pop ebx
push esi
or esi, 0xa7de
pop esi
cmp dword [ebp - 0x1518], 0
jne 0x41f318
mov dword [ebp - 0x710], 0
jmp 0x41f5bf
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
invalid
invalid
test al, 0xf3
Function at 0x41f232
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
or ecx, 0x175bf
pop ecx
push ecx
push edx
add esp, 4
call 0x41eeda
add byte [eax + 0x4e], cl
dec ebp
xor edx, dword [eax + 0x50]
cmp eax, dword [ebx - 0x7ca6fb3c]
mov ebp, 0xfffff3b4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2a8], 0
jmp 0x41f141
push esi
push eax
add esp, 4
call 0x41f154
add byte [ebp + 0x4a], al
push eax
xor eax, 0x444b4c45
add esp, 4
pop esi
push esi
xor esi, 0xd847
jmp 0x41f166
xor esi, 0xe5e
sub esi, 0x69fe
pop esi
cmp dword [ebp - 0x2a8], 0
jne 0x41fa78
mov eax, 0x6b
mov word [ebp - 0x16e8], ax
mov ecx, 0x65
mov word [ebp - 0x16e6], cx
mov edx, 0x72
mov word [ebp - 0x16e4], dx
mov eax, 0x6e
mov word [ebp - 0x16e2], ax
mov ecx, 0x65
mov word [ebp - 0x16e0], cx
mov edx, 0x6c
mov word [ebp - 0x16de], dx
mov eax, 0x33
mov word [ebp - 0x16dc], ax
mov ecx, 0x32
mov word [ebp - 0x16da], cx
mov edx, 0x2e
mov word [ebp - 0x16d8], dx
mov eax, 0x64
mov word [ebp - 0x16d6], ax
mov ecx, 0x6c
mov word [ebp - 0x16d4], cx
mov edx, 0x6c
mov word [ebp - 0x16d2], dx
xor eax, eax
mov word [ebp - 0x16d0], ax
push ebx
push eax
add esp, 4
add ebx, 0x3385
call 0x41f232
add byte [ebp + 0x45], al
cmp dword ss:[edi + ecx*2], esi
inc ebp
dec ebp
add esp, 4
pop ebx
push ecx
xor ecx, 0x3735
sub ecx, 0x11c23
pop ecx
push eax
jmp 0x41f24a
pop eax
mov byte [ebp - 0x830], 0x4c
mov byte [ebp - 0x82f], 0x6f
mov byte [ebp - 0x82e], 0x61
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push edi
push eax
add esp, 4
xor edi, 0x1d86
pop edi
push ebx
push esi
add esp, 4
sub ebx, 0x17883
xor ebx, 0x13f15
xor ebx, 0x121ac
jmp 0x41f2f7
pop ebx
push esi
or esi, 0xa7de
pop esi
cmp dword [ebp - 0x1518], 0
jne 0x41f318
mov dword [ebp - 0x710], 0
jmp 0x41f5bf
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
invalid
invalid
test al, 0xf3
Function at 0x443ef4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd20
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.004012a0
xor eax, eax
push ebp
push 0x444112
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00401078
mov esi, eax
lea eax, [ebp - 0x2d0]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00401070
cmp dword [ebp + 0x20], 0
je 0x443faf
cmp dword [ebp - 0x10], 0
je 0x443faf
mov eax, dword [ebp + 0x20]
call fcn.00406fa8
test al, al
jne 0x443f65
mov eax, dword [ebp + 0x20]
call fcn.00406fb0
test al, al
je 0x443f88
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.004012c8
push eax
call sub.shell32.dll_SHGetFileInfoW
jmp 0x443fa9
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.004012c8
push eax
call sub.shell32.dll_SHGetFileInfoW
mov esi, dword [ebp - 0x2cc]
cmp byte [ebp + 0x1c], 0
je 0x443fd6
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x444124
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
jmp 0x443ff5
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x444124
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00401edc
test bl, bl
je 0x44403d
cmp byte [ebp + 0x14], 0
jne 0x44403d
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00407460
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 4]
call fcn.004449f4
test byte [ebp + 0x14], bl
je 0x4440fc
mov dl, 1
mov eax, dword [0x4f30e0]
call fcn.00407588
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4440f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
call fcn.00407598
call fcn.00407460
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2dc], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00401050
add eax, dword [ebp - 8]
mov dword [ebp - 0x2d8], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00401050
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x2e0]
mov eax, dword [ebp - 4]
call fcn.00443e14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4440fc
mov eax, dword [ebp - 0x1c]
call fcn.004010c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444119
lea eax, [ebp + 0x20]
call fcn.004012a8
ret
Function at 0x44f5a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, edx
mov esi, eax
movzx edi, byte [esi + 0x296]
xor ebp, ebp
mov eax, dword [esi + 0x270]
test eax, eax
je 0x44f5c6
movzx ecx, byte [eax + 0x5e]
jmp 0x44f5cb
mov ecx, 0xff
movzx eax, byte [esi + 0x29c]
push eax
mov eax, ecx
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [esp], eax
cmp dword [esp], 0
jne 0x44f5eb
mov dword [esp], 1
call sub.kernel32.dll_GetTickCount
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [esi + 0x298]
jl 0x44f625
call sub.kernel32.dll_GetTickCount
mov ebp, eax
sub edi, dword [esp]
cmp edi, dword [esp]
jge 0x44f610
xor edi, edi
mov eax, edi
mov byte [esi + 0x296], al
push esi
push fcn.0044f034
mov eax, ebx
call fcn.00406de0
mov eax, dword [ebx + 0x44]
mov edx, 2
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, ebx
cmp byte [eax + 0xd], 0
jne 0x44f672
mov edx, dword [0x4f2830]
mov edx, dword [edx]
cmp byte [edx + 0xa0], 0
jne 0x44f672
mov edx, dword [0x4f2830]
mov edx, dword [edx]
test byte [edx + 0x1c], 8
jne 0x44f672
cmp dword [eax + 0x4c], 1
je 0x44f672
test edi, edi
jg 0x44f5eb
push esi
mov edx, dword [esi]
mov edx, dword [edx + 0xf8]
push edx
call fcn.00406dd8
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x457fa0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45801c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
mov edx, dword [ebp - 8]
inc edx
lea eax, [ebp - 4]
call fcn.00401298
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00401288
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x457ffd
mov edx, dword [ebp - 8]
dec edx
lea eax, [ebp - 4]
call fcn.00401298
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00401308
jmp 0x458006
mov eax, ebx
xor edx, edx
call fcn.004012b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458023
lea eax, [ebp - 4]
call fcn.00401270
ret
Function at 0x458028
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x458252
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
xor edx, edx
call fcn.004012c0
lea eax, [ebp - 0x120]
mov edx, 0x11c
call fcn.00401e00
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
mov edx, 0x24
call fcn.00401e00
push 0x458260
push 0x458288
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.004016e0
test eax, eax
je 0x4580ae
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x4580ba
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo
cmp dword [ebp - 0x110], 2
jne 0x458232
test bl, bl
je 0x4580ea
call fcn.004583dc
mov edx, dword [eax]
mov dword [ebp - 0x11c], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x118], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x458105
lea eax, [ebp - 4]
mov edx, 0x4582b0
call fcn.004012c0
cmp dword [ebp - 0x11c], 5
jne 0x458129
cmp dword [ebp - 0x118], 0
jne 0x458129
lea eax, [ebp - 4]
mov edx, 0x4582d4
call fcn.004012c0
jmp 0x458232
cmp dword [ebp - 0x11c], 5
jne 0x45814d
cmp dword [ebp - 0x118], 1
jne 0x45814d
lea eax, [ebp - 4]
mov edx, 0x4582fc
call fcn.004012c0
jmp 0x458232
cmp dword [ebp - 0x11c], 5
jne 0x458193
cmp dword [ebp - 0x118], 2
jne 0x458193
cmp byte [ebp - 6], 1
jne 0x458181
cmp word [ebp - 0x144], 9
jne 0x458181
lea eax, [ebp - 4]
mov edx, 0x4582fc
call fcn.004012c0
jmp 0x458232
lea eax, [ebp - 4]
mov edx, 0x458320
call fcn.004012c0
jmp 0x458232
cmp dword [ebp - 0x11c], 6
jne 0x4581b4
cmp dword [ebp - 0x118], 0
jne 0x4581b4
lea eax, [ebp - 4]
mov edx, 0x458354
call fcn.004012c0
jmp 0x458232
cmp dword [ebp - 0x11c], 6
jne 0x4581d5
cmp dword [ebp - 0x118], 1
jne 0x4581d5
lea eax, [ebp - 4]
mov edx, 0x45837c
call fcn.004012c0
jmp 0x458232
cmp dword [ebp - 0x11c], 6
jne 0x4581fb
mov eax, dword [ebp - 0x118]
add eax, 0xfffffffe
sub eax, 2
jae 0x4581fb
lea eax, [ebp - 4]
mov edx, 0x45839c
call fcn.004012c0
jmp 0x458232
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x458220
mov edx, dword [ebp - 0x118]
sub edx, 4
jne 0x458220
lea eax, [ebp - 4]
mov edx, 0x4583bc
call fcn.004012c0
jmp 0x458232
cmp eax, 0xa
jne 0x458232
lea eax, [ebp - 4]
mov edx, 0x4583bc
call fcn.004012c0
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004012b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458259
lea eax, [ebp - 4]
call fcn.004012a8
ret
Function at 0x45c59c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x45c5ca
mov eax, ebx
call fcn.0045d050
cmp dword [ebx + 0x40], 0
je 0x45c5c3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x45c63b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x45c62d
cmp dword [ebx + 8], 0
je 0x45c5ec
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45c5fe
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45c62d
cmp dword [ebx + 8], 0
je 0x45c5df
cmp eax, 3
je 0x45c611
dec eax
jne 0x45c5df
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45c5df
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45c5df
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x45c659
cmp dword [ebx + 0x14], 0xcc
je 0x45c659
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045c664
pop ebx
ret

Function at 0x471150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call fcn.004012b8
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004012f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x471198
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004012f0
add esp, 0x200
pop ebx
ret

Function at 0x4711c8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004012f0
add esp, 0x200
pop ebx
ret

Function at 0x4711f4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004012f0
add esp, 0x200
pop ebx
ret

Function at 0x471224
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.004012b8
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x471261
mov eax, ebx
lea edx, [ebp - 0x20c]
call fcn.004012e0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471268
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4712e4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x4712cb
push ebx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.004012f0
mov eax, dword [ebp - 0x20c]
mov ecx, 2
mov edx, 1
call fcn.00401350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4712eb
lea eax, [ebp - 0x20c]
call fcn.004012a8
ret