joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d29e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407ccb
mov dword [ebp - 0x14], eax
cmp dword [0x813f98], esi
jne 0x40d391
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d31e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d471
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d471
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d471
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x813f98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x813f9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x813fa0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813fa8], eax
test eax, eax
je 0x40d38e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813fa4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d3b6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d3a9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push 4
pop eax
jmp 0x40d473
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push dword [0x813f98]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d3b0
mov eax, dword [0x813fa4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d429
cmp dword [0x813fa8], edi
je 0x40d429
push eax
call ebx
push dword [0x813fa8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d429
test eax, eax
je 0x40d429
call ecx
test eax, eax
je 0x40d41e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d41e
test byte [ebp - 8], 1
jne 0x40d429
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d459
mov eax, dword [0x813f9c]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
call eax
mov esi, eax
test esi, esi
je 0x40d456
mov eax, dword [0x813fa0]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x813f98]
call ebx
test eax, eax
je 0x40d471
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d473
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004043de
mov esp, ebp
pop ebp
ret
Function at 0x414a90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x4c94b0], eax
mov edx, 1
mov eax, 0x4c94b0
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4c9e6c
jl 0x414aa0
mov dword [0x4c6938], 1
mov dword [0x4cae3c], 1
pop edi
ret

Function at 0x414ae0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4cae3c], 0
push esi
mov esi, 0x4c94b0
jne 0x414afa
call dword [0x4a12f0]
call fcn.00414a90
mov dword [0x4c6938], 0x270
mov dword [0x4c94a8], esi
mov ecx, 0xe3
nop
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi + 0x634]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x414b10
mov ecx, 0x18c
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi - 0x38c]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x414b45
mov ecx, dword [esi]
mov eax, dword [0x4c94b0]
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, dword [esi]
and al, 1
movzx edx, al
shr ecx, 1
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor ecx, edx
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret

Function at 0x414bb0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c6938]
jne 0x414bbd
call fcn.00414ae0
mov eax, dword [0x4c94a8]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c94a8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x414c00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x4c6938]
jne 0x414c0e
call fcn.00414ae0
mov ecx, dword [0x4c94a8]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4c94a8], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
jns 0x414c55
fadd qword [0x4c0df8]
fmul qword [0x4c0e38]
pop ecx
ret
Function at 0x443d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
mov edi, eax
cmp word [eax], bx
je 0x443e16
nop
movzx esi, word [edi]
test esi, 0xffffff80
jne 0x443d8d
push 2
push esi
call fcn.0049129e
add esp, 8
test eax, eax
je 0x443d8d
and esi, 0xffffffdf
movzx eax, si
add eax, 0xffffffd5
cmp eax, 0x33
ja case.0x443d9f.44
movzx eax, byte [eax + 0x443e68]
jmp dword [eax*4 + 0x443e44]
movzx ebx, word [edi]
jmp case.0x443d9f.44
mov eax, 1
jmp 0x443dda
mov eax, 0x20
jmp 0x443dda
mov eax, 4
jmp 0x443dda
mov eax, 2
jmp 0x443dda
mov eax, 0x80
jmp 0x443dda
mov eax, 0x1000
jmp 0x443dda
mov eax, 0x100
mov ecx, ebx
sub ecx, 0x2b
je 0x443dfd
sub ecx, 2
je 0x443df1
sub ecx, 0x31
jne case.0x443d9f.44
xor dword [esp + 0x14], eax
jmp case.0x443d9f.44
not eax
and dword [esp + 0x10], eax
and dword [esp + 0x14], eax
jmp case.0x443d9f.44
mov ecx, eax
not ecx
and dword [esp + 0x10], ecx
or dword [esp + 0x14], eax
add edi, 2
cmp word [edi], 0
jne 0x443d70
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x24]
push 0x443ea0
push eax
push ecx
mov ecx, dword [esp + 0x34]
push edx
call fcn.00443ee0
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10

Function at 0x47a310
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
out dx, eax
aaa
xor ebp, edx
mov dl, 0x99
invalid
mov ss, word [edx - 0x5e2de3cb]
adc byte [esi], al
mov ebx, 0x1a37dbb4
mov esi, 0xd128f816
mov esi, 0x63db9e39
push edx
mov cl, 0x1f
sub edx, dword [ebp - 0x34]
out dx, al
popal
jp 0x47a303
lcall 0x7b39, 0xdc7daa24
mov bh, byte [edx + 0x79]
mov eax, cs
test dword [edx], esi
bound edi, qword [ecx + 0x246834c]
lds esp, [ebx + 0x5f9fc10a]
xchg esi, eax
mov edx, 0x3c545c3
sub eax, 0xbc0e06df
fld xword [eax + 5]
jg 0x47a3c1
jge 0x47a37c
cmp eax, 0x9fce218e
add dword [ebx*2 + 0x4ebd9e6c], ebp
cmc
shl dword [0x732f9382], cl
sub ah, cl
pushfd
insb byte es:[edi], dx
sub ebp, edx
in eax, 0x44
int3
outsd dx, dword [esi]
je 0x47a374
je 0x47a374
cmpsb byte [esi], byte es:[edi]
fidivr dword [ebx + edi*8 - 0x23]
add eax, 0xc6b811bd
fstp st(4)
out dx, eax
adc eax, ebx
fcom st(4)
lodsb al, byte [esi]
sbb dword [eax - 0x244c32e3], eax
wait
inc esp
stc
push esp
sub dword [esi + 0x2f], edx
push esi
das
or byte [eax - 0x16], ch
stosd dword es:[edi], eax
outsd dx, dword [esi]
stc
sub dh, byte [ecx - 0x39]
sahf
and byte [esi + 0x2409bb99], cl
xchg ebx, eax
inc edi
mov word [ecx + edx*4 + 0x3b], fs
int1
loope 0x47a39e
in al, 0x8c
mov eax, 0xcfefcc49
call 0xa6ac7b3b
jbe 0x47a39a
cmpsb byte fs:[esi], byte es:[edi]
xor eax, 0xc378e32a
out dx, al
pop eax
push esi
xchg dl, al
xchg byte [eax], dl
add dh, byte [ecx - 0x37542879]
fiadd dword [edi - 0x5f]
add dh, cl
or esp, dword [ebp + 0x175b6ff6]
loopne 0x47a37e
mov ecx, 0x87760d9f
ljmp 0x494

Function at 0x490625
Capabilities:
Encode data using xor

Disassembly:
sub edi, dword [esi + 0x69d91fbd]
cmp al, 0x40
invalid
Function at 0x490936
Capabilities:
Encode data using xor

Disassembly:
invalid
pop esi
pop ebx
sar byte [edx], cl
sbb bh, bl
or dword [edx - 0x53], esp
sub esi, dword [esp + esi*4 - 0x36]
inc edx
salc
sbb eax, esp
cmp edx, esi
nop
mov al, 0xc9
jne 0x4908c7
sub dl, dh
inc ebp
adc al, ch
invalid
scasb al, byte es:[edi]
ja 0x490925
enter 0x5f39, 0x50

Function at 0x490941
Capabilities:
Encode data using xor

Disassembly:
call 0xc92980f4
cmp dword [edi + 0x50], ebx
cmpsb byte [esi], byte es:[edi]
mov bh, al
dec ebp
sub bl, byte [edi + 0x2bd54447]
push 0x1c
mov fs, word [eax - 0x34]
mov bl, 0x43
in al, dx
sar byte [ecx], cl
dec ebp
in al, dx
outsb dx, byte [esi]
in eax, dx
pop edx
add dword [esi], esi
mov byte [0x8f04e5ae], al
inc edx
xor dl, dh
jb 0x49098d
fcom dword [eax + 0x94a19b8]
movsd dword es:[edi], dword [esi]
std
jns 0x4909c7
inc esp
pushal
mov dh, 0x81
fcmovbe st(0), st(5)
fcmovbe st(0), st(5)
test eax, 0x37c15188
sub al, 0x76
jno 0x4909a4
xor al, 0x18
xchg edx, eax
in eax, dx
mov ebp, 0xb22b679f
rol byte [edi + eax*4], 1
jns 0x49097d
lahf
sub esi, dword [bp + si + 0x4d0]
xchg dword [ecx - 0x19], edi
sbb al, byte [ebp - 0x58fe45b8]
add dword [ecx + ebp], 0x4854b96a
push ss
dec edx
sub byte [eax], dl
add eax, 0xfa7bb8c4
mov eax, dword [0xe4c71429]
xor dword [esi], 0xffffffc9
pop esp
sub bl, ch
sub ah, byte [eax]
jae 0x4909ff
mov dl, 0x2c
xchg dword [ecx - 0x4528dfbb], esi
mov edx, 0xc35f5d7e
inc edi
jge 0x4909b4
ret
invalid
mov edx, 0x390784ae
int1
out dx, al
cmp edi, dword [ebx - 0x3168b31f]
inc edi
int 0x8b
retf

Function at 0x491458
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x4c91da18
inc edx
jg 0x491466
call 0xfe892c9e
invalid

Function at 0x491e05
Capabilities:
Encode data using xor

Disassembly:
sub dl, byte [edx - 0x32]
aad 0xe
invalid
mov bl, 0x53
push 0xd762d399
add edi, dword [eax + 0x2da0af8b]
stc
cmp bh, byte [eax + 0x6d]
xchg edi, eax
cmp dword [ecx + 0x7a], ebp
mov dword cs:[ebx], 0xb2d9e26b
loop 0x491e87
bnd jnp 0x491dc2
sahf
add ah, bl
mov dword [eax + ebp*2 + 0x79], ecx
imul edi, dword [edi + 4], 0x4f094fdd
xchg ebx, eax
mov word [eax + 0x5386ffd], gs
call 0x8b216122
fmul dword [edx + 0x6a650ace]
Function at 0x6d4fd7d5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d506878]
jne 0x6d4fd7df
repz ret
jmp fcn.6d4fde74
Function at 0x4053b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
push esi
push edi
test al, 1
je 0x406949
mov edi, dword [ebp + 0x10]
xor eax, eax
push 8
mov word [esp + 0x54], 1
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], 1
call fcn.00420f16
mov edx, eax
mov dword [esp + 0x30], eax
add esp, 4
test edx, edx
je 0x406ac1
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x4c], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x48], 1
mov dword [esp + 0x14], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x58], eax
jmp 0x4054bd
or eax, 1
mov dword [0x4c7488], 0
push 0x43b74c
mov dword [0x4c7480], eax
mov dword [0x4c7490], 0
mov dword [0x4c7494], 1
call fcn.00422ea0
add esp, 4
jmp 0x4053cf
xor edx, edx
mov dword [esp + 0x2c], edx
jmp 0x405414
Function at 0x41453d
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x414565
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x414557
pop edi
pop esi
pop ebp
ret 4

Function at 0x414ab2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x4508c5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425732
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov edx, dword [ecx]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x414ad8
Function at 0x420aeb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c6283]
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], al
push 0x8000
push esi
mov edi, edx
call fcn.00424836
pop ecx
push eax
call fcn.00424664
invalid
cmp dword [edi + 0xc], 0xb
or al, 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x456703
lea ecx, [ebp - 0x18]
call fcn.004140cd
mov ecx, edi
call fcn.00404d37
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.0041402a
push dword [ebp - 0x18]
push 0x492ca8
push esi
call fcn.00424a35
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x456723
lea ecx, [ebp - 0x18]
call fcn.00411cb6
mov edi, dword [ebp - 8]
push esi
call fcn.00424bfa
pop ecx
cmp ebx, 0xffffffff
je 0x420b89
push ebx
push esi
call fcn.00424836
pop ecx
push eax
call fcn.00424664
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
jmp 0x420b71
push esi
mov ecx, edi
call fcn.00468b80
push eax
push 1
call fcn.00468b3d
push eax
call fcn.004249b3
add esp, 0x10
mov edi, eax
jmp 0x420b64
mov ecx, edi
call fcn.00404d37
mov eax, dword [edi + 8]
push dword [eax]
call dword [0x490244]
jmp 0x420b59

Function at 0x420b14
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c6283]
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], al
push 0x8000
push esi
mov edi, edx
call fcn.00424836
pop ecx
push eax
call fcn.00424664
invalid
cmp dword [edi + 0xc], 0xb
or al, 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x456703
lea ecx, [ebp - 0x18]
call fcn.004140cd
mov ecx, edi
call fcn.00404d37
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.0041402a
push dword [ebp - 0x18]
push 0x492ca8
push esi
call fcn.00424a35
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x456723
lea ecx, [ebp - 0x18]
call fcn.00411cb6
mov edi, dword [ebp - 8]
push esi
call fcn.00424bfa
pop ecx
cmp ebx, 0xffffffff
je 0x420b89
push ebx
push esi
call fcn.00424836
pop ecx
push eax
call fcn.00424664
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
jmp 0x420b71
push esi
mov ecx, edi
call fcn.00468b80
push eax
push 1
call fcn.00468b3d
push eax
call fcn.004249b3
add esp, 0x10
mov edi, eax
jmp 0x420b64
mov ecx, edi
call fcn.00404d37
mov eax, dword [edi + 8]
push dword [eax]
call dword [0x490244]
jmp 0x420b59
Function at 0x47acbc
Capabilities:
Encode data using xor

Disassembly:
sbb byte [edi + 0x17866242], dl
push eax
pop ebx
cmp ecx, dword fs:[edx - 0x41]
jno 0x47acd3
dec esp
mov al, byte [0xea299542]
mov esp, 0x8d7a1216
xor byte [ecx], al
pop edx
out dx, al
mov bl, 0x9c
jecxz 0x47ad0d
push esi
arpl word [ecx], bp
dec ebx
mov bh, bl
lea ebp, [ecx - 0x1a48d8b1]
invalid
ljmp 0x212c:0x1057aac7
adc byte [ecx], ch
enter 0xffffffffffffcac8, 0xffffffffffffffbe
xlatb
add cl, cl
inc esp
xchg esp, eax
jmp 0x47ace2
int 0x67
pop ds
sal dword [edi - 0x3525ddcc], cl
xor al, byte [edx - 0x2f]
pushfd
test eax, 0x8595e0c2
inc esp
sub dword [esi + 0x11], edi
xchg ebx, eax
sahf
cmp byte [0x60a405cb], ah
loope 0x47ad12
loopne 0x47ac79
test dword [ecx + ebp + 0x7e], eax
adc dword [ebx - 0x34dac762], edx
add eax, 0x1fe160a4
fidivr word [ebx + 0x69]
add al, 0x83
sub eax, 0x2e976d04
xchg ecx, eax
imul ebp, dword [edi], 0x61c6c5bf
scasb al, byte es:[edi]
sub edi, dword [edi]
lodsb al, byte [esi]
call [ebp - 0x57c2c468]
test al, 0x32
pop edx
inc edx
xor bl, byte [edx + 0x42]
sar dword [ebx + 0xf], 0xe5
imul ebx, dword [ecx - 0x56], 0xfffffff1
jnp 0x47ad23
in eax, 0x6b
pop ecx
stosb byte es:[edi], al
int1
sub dword [ebp - 0x59], edi
aas
jo 0x47ad0e
adc dword [ebx + 0x7908182b], edi
xchg ecx, eax
sbb byte [eax], cl
jns 0x47acb8
int1
fcom dword [eax]
mov dl, 0x36
adc dword [ebx], esp
xor dl, cl
lahf
pop esi
invalid
Function at 0x40159c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4015ae
mov eax, dword [0x52908b]
shl eax, 2
mov dword [0x52908f], eax
push edx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov edx, eax
call fcn.0050844c
pop edx
call fcn.005083b0
call fcn.0050848c
push 0
call fcn.005099ac
pop ecx
push 0x529034
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x529093], eax
push 0
jmp fcn.005102c0
Function at 0x42a65c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov byte [0x547138], 0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetTickCount
mov dword [0x547b40], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], edx
xor eax, eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0xc]
mov dl, byte [eax]
mov byte [ebp - 0xd], dl
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov al, byte [ebp - 0xd]
mov byte [ecx], al
cmp byte [ebp - 0xd], 0
je 0x42a6b7
movsx edx, byte [ebp - 0xd]
cmp edx, 0x2c
jne 0x42a6bf
mov ecx, dword [ebp - 0x24]
mov byte [ecx], 0
jmp 0x42a6cb
inc dword [ebp - 0x14]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x14], 0x20
jl 0x42a695
movsx eax, byte [ebp - 0xd]
cmp eax, 0x2c
jne 0x42a6fb
mov edx, dword [ebp - 0xc]
push edx
call fcn.00408748
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
mov al, byte [ecx]
mov byte [ebp - 0xd], al
inc dword [ebp - 0xc]
cmp byte [ebp - 0xd], 0
je 0x42a6fb
movsx edx, byte [ebp - 0xd]
cmp edx, 0x2c
jne 0x42a6e1
movsx ecx, byte [ebp - 0xd]
cmp ecx, 0x2c
jne 0x42a72b
mov eax, dword [ebp - 0xc]
push eax
call fcn.00408748
pop ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebp - 0xd], cl
inc dword [ebp - 0xc]
cmp byte [ebp - 0xd], 0
je 0x42a72b
movsx eax, byte [ebp - 0xd]
cmp eax, 0x2c
jne 0x42a711
movsx edx, byte [ebp - 0xd]
cmp edx, 0x2c
jne 0x42a741
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00408748
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x660]
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.00443d60
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x660]
push ecx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2f8]
mov eax, dword [edx + 0x160]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.004c2150
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x88]
jmp 0x42a799
mov ecx, dword [0x543010]
mov eax, dword [ecx]
call fcn.004d525c
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x547b40]
cmp eax, dword [ebp - 0x20]
jb 0x42a78c
mov byte [0x547138], 1
mov esp, ebp
pop ebp
ret
Function at 0x438ac8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov ecx, edx
mov dword [ebp - 0x14], ecx
jmp 0x438b0e
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [eax]
mov eax, dword [ebp + 8]
xor edx, dword [ebp + 8]
and edx, 0xff
shr eax, 8
mov ecx, dword [edx*4 + 0x531ea0]
xor ecx, eax
mov dword [ebp + 8], ecx
inc dword [ebp - 0x10]
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
jb 0x438ae6
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x46282c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, 0x53c2f8
call fcn.00508d0c
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call fcn.005082c0
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4628a1
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.kernel32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x100
jbe 0x4628a1
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.005082e0
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x4628a1
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.kernel32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
cmp dword [ebp - 0x30], 0
je 0x4628be
cmp dword [ebp - 0x34], 0
je 0x4628be
mov edx, dword [ebp - 0x34]
jmp 0x4628c3
mov edx, 0x53bf6c
lea eax, [ebp - 4]
call fcn.005145e8
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x20
push dword [ebp - 0x34]
call fcn.005082d0
pop ecx
mov word [ebp - 0x18], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00514778
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x38
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00514748
pop eax
mov word [ebp - 0x18], 0x20
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x462941
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret