joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496bc0
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0xc], 0x20
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x9e3779b9
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
shr eax, 2
and eax, 3
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
jmp 0x496c00
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x496c6f
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4 - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
shr edx, 5
mov eax, dword [ebp - 8]
shl eax, 2
xor edx, eax
mov ecx, dword [ebp - 8]
shr ecx, 3
mov eax, dword [ebp - 0x14]
shl eax, 4
xor ecx, eax
add edx, ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
and eax, 3
xor eax, dword [ebp - 0x18]
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + eax*4]
xor eax, dword [ebp - 0x14]
add ecx, eax
xor edx, ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
sub ecx, edx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 8], eax
jmp 0x496bf7
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
shr eax, 5
mov ecx, dword [ebp - 8]
shl ecx, 2
xor eax, ecx
mov edx, dword [ebp - 8]
shr edx, 3
mov ecx, dword [ebp - 0x14]
shl ecx, 4
xor edx, ecx
add eax, edx
mov edx, dword [ebp - 0x10]
xor edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
and ecx, 3
xor ecx, dword [ebp - 0x18]
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + ecx*4]
xor ecx, dword [ebp - 0x14]
add edx, ecx
xor eax, edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
sub ecx, eax
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x61c88647
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
jne 0x496be2
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49bf10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx + 0x46c4]
cmp eax, 0x61a80
jbe 0x49c063
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 8]
mov dword [edx + 0x46c4], eax
mov dword [ebp - 4], 2
jmp 0x49bf55
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jge 0x49c063
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x928], 0
je 0x49bf73
jmp 0x49c063
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4690]
mov ecx, dword [ebp - 4]
cmp dword [eax + ecx*4], 0
jle 0x49c05e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp dword [eax + edx*4 + 0x46c8], 0
jle 0x49c025
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4690]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov eax, dword [ecx + eax*4 + 0x46c8]
cmp eax, dword [edx + esi*4]
jne 0x49c025
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4690]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov eax, dword [ecx + eax*4 + 0x46cc]
cmp eax, dword [edx + esi*4 + 4]
jne 0x49c025
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x46c8], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4 + 0x46cc], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4690]
mov ecx, dword [ebp - 4]
mov dword [eax + ecx*4], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4690]
mov ecx, dword [ebp - 4]
mov dword [eax + ecx*4 + 4], 0
jmp 0x49c05e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4690]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov eax, dword [eax + esi*4]
mov dword [edx + ecx*4 + 0x46c8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4690]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edx, dword [edx + esi*4 + 4]
mov dword [ecx + eax*4 + 0x46cc], edx
jmp 0x49bf4c
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a4e60
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd916
mov eax, dword fs:[0]
push eax
sub esp, 0xdd8
mov eax, dword [0x4e5b00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x9c0], ecx
mov dword [ebp - 0x9bc], 0
mov dword [ebp - 4], 1
jmp fcn.006ea5f9
Function at 0x4ab100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bdd68
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4e5b00]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x4ab140
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x4ab14c
mov al, 1
jmp 0x4ab2ef
mov dword [ebp - 0x10], 8
call fcn.004252f0
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.004252f0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.004252d0
add esp, 8
movzx eax, al
test eax, eax
je 0x4ab18f
xor al, al
jmp 0x4ab2ef
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.004319c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.004aad80
mov ecx, eax
call fcn.004ab470
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00423b50
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.004aad80
mov ecx, eax
call fcn.004ab470
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.004ab5a0
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x4ab20a
cmp dword [ebp - 0x6c], 1
je 0x4ab211
cmp dword [ebp - 0x6c], 3
je 0x4ab2ab
jmp 0x4ab2c3
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.004aad80
mov ecx, eax
call fcn.004ab470
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x4ab274
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.004aad80
mov ecx, eax
call fcn.004ab470
push eax
call fcn.0046359b
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4ab274
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401750
mov al, byte [ebp - 0x61]
jmp 0x4ab2ef
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x4ab297
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401750
mov al, byte [ebp - 0x62]
jmp 0x4ab2ef
cmp dword [ebp - 0x38], 0
jne 0x4ab2a9
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0041b700
jmp 0x4ab2db
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401750
mov al, byte [ebp - 0x63]
jmp 0x4ab2ef
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401750
mov al, byte [ebp - 0x64]
jmp 0x4ab2ef
jmp 0x4ab1a2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004606fe
mov esp, ebp
pop ebp
ret
Function at 0x4ad940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bdedf
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x5c
mov eax, dword [0x4e5b00]
xor eax, ebp
mov dword [ebp - 0x24], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0
push 0x4c9437
lea ecx, [ebp - 0x40]
call fcn.00401710
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4adaa0
lea eax, [ebp - 0x18]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004419e3
add esp, 4
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x44]
push edx
call fcn.00465660
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ada8e
mov byte [ebp - 0x54], 0
xor edx, edx
mov dword [ebp - 0x53], edx
mov dword [ebp - 0x4f], edx
mov dword [ebp - 0x4b], edx
mov word [ebp - 0x47], dx
mov byte [ebp - 0x45], dl
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
je 0x4ada5c
cmp dword [ebp - 0x6c], 4
je 0x4ada6a
jmp 0x4ada8e
mov ecx, dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x40]
call fcn.004028f0
jmp 0x4ada8e
mov edx, dword [ebp - 0x44]
movsx eax, byte [edx]
push eax
push 0x4c9448
lea ecx, [ebp - 0x54]
push ecx
call fcn.00460c94
add esp, 0xc
lea edx, [ebp - 0x54]
push edx
lea ecx, [ebp - 0x40]
call fcn.004028f0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.004419ee
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4adad5
mov dword [ebp - 4], 1
jmp 0x4adaef
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404680
mov edx, dword [ebp - 0x60]
or edx, 1
mov dword [ebp - 0x60], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00401750
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.004606fe
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ae230
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
jmp 0x4ae24b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jge 0x4ae2b8
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + ecx*4 + 0x80], eax
jmp 0x4ae276
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 8
jge 0x4ae2b6
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4 + 0x80]
shr ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + edx*4 + 0x80]
and edx, 1
neg edx
sbb edx, edx
and edx, 0xedb88320
xor ecx, edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + eax*4 + 0x80], ecx
jmp 0x4ae26d
jmp 0x4ae242
mov esp, ebp
pop ebp
ret
Function at 0x4b18c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be280
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x4e5b00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.004b6b60
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x28], 0
lea ecx, [ebp + 0xc]
call fcn.00401780
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x48]
mov dword [ebp - 0x20], ecx
push 0x4c946f
lea edx, [ebp + 0x28]
push edx
call fcn.00404720
add esp, 8
movzx eax, al
test eax, eax
je 0x4b194f
lea ecx, [ebp + 0x28]
call fcn.00401780
mov dword [ebp - 0x7c], eax
jmp 0x4b1956
mov dword [ebp - 0x7c], 0
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
push 0x4c9472
lea ecx, [ebp - 0x70]
call fcn.00401710
mov byte [ebp - 4], 4
push 0
push str.q1
lea ecx, [ebp + 0xc]
call fcn.0041b630
cmp eax, dword [0x4d0ec8]
je 0x4b19f0
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x78]
call fcn.004b10f0
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x70]
call fcn.004028f0
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404680
mov edx, dword [ebp - 0x74]
or edx, 1
mov dword [ebp - 0x74], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.00401750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.004b6bc0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401750
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x28]
call fcn.00401750
mov eax, dword [ebp + 8]
jmp 0x4b1abc
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push 0x4b18a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0
push 0x4ff
push 0x64
push 0
lea ecx, [ebp - 0x54]
push ecx
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x4b1a31
jmp 0x4b1a56
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x4c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, 1
test ecx, ecx
jne 0x4b1a11
mov edx, dword [ebp + 0x44]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x70]
call fcn.004028f0
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404680
mov ecx, dword [ebp - 0x74]
or ecx, 1
mov dword [ebp - 0x74], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.00401750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.004b6bc0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00401750
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x28]
call fcn.00401750
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004606fe
mov esp, ebp
pop ebp
ret 0x44
Function at 0x4b21d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be3cb
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4e5b00]
xor eax, ebp
mov dword [ebp - 0x54], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], ecx
push 0x4c9487
lea ecx, [ebp - 0x70]
call fcn.00401710
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004b6b60
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x1c], 0x4c94c9
mov dword [ebp - 0x10], 1
push 0
push 0
lea edx, [ebp - 0x2c]
push edx
push 0x4b18a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0
push 0x4ff
push 0x64
push 0
lea eax, [ebp - 0x50]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x4b2287
jmp 0x4b22ac
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, 1
test eax, eax
jne 0x4b2267
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x24]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x74], eax
lea ecx, [ebp - 0x2c]
call fcn.004b6bc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00401750
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x54]
xor ecx, ebp
call fcn.004606fe
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b8151
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0046b4d1
and dword [ebp - 4], 0
cmp dword [0x517700], 0
mov ebx, eax
jne 0x4b8202
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4b82b3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x4b82b3
push eax
call fcn.0046b45f
mov dword [esp], 0x4c85d8
push edi
mov dword [0x517700], eax
call esi
push eax
call fcn.0046b45f
mov dword [esp], 0x4c85c4
push edi
mov dword [0x517704], eax
call esi
push eax
call fcn.0046b45f
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x517708], eax
call esi
push eax
call fcn.0046b45f
pop ecx
mov dword [0x517710], eax
test eax, eax
je 0x4b8202
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046b45f
pop ecx
mov dword [0x51770c], eax
mov eax, dword [0x51770c]
cmp eax, ebx
je 0x4b825a
cmp dword [0x517710], ebx
je 0x4b825a
push eax
call fcn.0046b4da
push dword [0x517710]
mov esi, eax
call fcn.0046b4da
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4b825a
test edi, edi
je 0x4b825a
call esi
test eax, eax
je 0x4b8251
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b8251
test byte [ebp - 0xc], 1
jne 0x4b825a
or dword [ebp + 0x10], 0x200000
jmp 0x4b8293
mov eax, dword [0x517704]
cmp eax, ebx
je 0x4b8293
push eax
call fcn.0046b4da
pop ecx
test eax, eax
je 0x4b8293
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4b8293
mov eax, dword [0x517708]
cmp eax, ebx
je 0x4b8293
push eax
call fcn.0046b4da
pop ecx
test eax, eax
je 0x4b8293
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x517700]
call fcn.0046b4da
pop ecx
test eax, eax
je 0x4b82b3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b82b5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x728c01
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cld
sub eax, 0xc329e802
call 0x5e4f2f
call 0x5e4f2f
lea edi, [edx - 0x637f3eec]
dec dword [ebp - 0x7f3eeb46]
pushfd
ficomp dword [edi + 6]
push ecx
in al, 0x3a
mov byte [ecx - 0x31], bh
add edi, esp
mov eax, 0xe90ac850
fist word [ebp + 0x221bdd78]
enter 0xffffffffffffe90a, 0xffffffffffffffdf
xchg ebp, eax
js 0x728bfe
sbb esp, dword [edx]
push edx
sub al, 0x9b
mov ch, 0xf5
salc
push es
add al, 0xa2
and dword [esi + 0x5d], esp
push eax
and edx, esp
cmp eax, 0xaccaf073
pop ebp
push ebp
fmul dword [0x596b60d4]
xor al, 0x6d
pop edi
pop ebp
cmp ebx, dword [ebp - 0x28]
push ecx
test al, 0x75
or eax, 0xb9d5ae9a
or al, 0xb4
aam 0xea
dec ebp
adc edi, esi
jne 0x728c1a
push edi
add edx, dword [ecx + 0x17]
xor eax, 0x895023fa
inc esi
out 0x1f, al
dec ebp
daa
add al, 0xfa
sub ah, cl
xchg esi, eax
invalid
Function at 0x401687
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, esp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4050aa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405198], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x40512c], eax
mov dword [0x4050a2], eax
mov dword [0x405118], 0x30
mov dword [0x40511c], 2
jmp 0x4016cc
mov dword [0x405120], 0x403270
mov dword [0x405124], 0
mov dword [0x405128], 0
mov dword [0x405140], 0x404179
mov dword [0x405138], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x405130], eax
mov dword [0x405144], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x405134], eax
push 0x405118
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4050a2]
push 0
push 0
push 0x1e0
push 0x1fe
push 0xfffff862
push 0xfffff8f8
push 0xcf0000
push str.5_minutes
push str.return
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405190], eax
push 5
push dword [0x405190]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405190]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x405148]
jmp 0x4017a0
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x401792
mov eax, dword [0x405150]
jmp 0x4017bb
call 0x402ccb
ret
Function at 0x40bcb0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40be7b
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40bcd9
mov eax, 0x7000000
jmp 0x40bce1
test eax, eax
je 0x40be56
mov dword [esp + 0x14], eax
mov ecx, dword [0x5caff0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
lea edx, [ebp + ebx]
shr edx, 6
inc edx
mov dword [ecx + 0x94], ebx
mov dword [ecx + 0x98], ebp
mov dword [esp], edx
call fcn.00463170
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0x14
and ecx, 0x7ff
mov edx, eax
shr edx, 0xf
and edx, 0x1f
shl eax, 5
mov ebx, dword [esp + 0x28]
shr ebx, 0x1b
or ebx, eax
lea eax, [0x583ee0]
movsd xmm0, qword [eax + edx*8]
mov ebp, ecx
add ecx, 0xfffffc01
add edx, 1
mov esi, 0
adc esi, 0
test esi, esi
jne 0x40be6e
cmp edx, 0x21
jae 0x40be62
movsd qword [esp + 0x18], xmm0
add ebp, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
and ebx, 0xfffff
mov dword [esp + 0x10], ebx
movsd xmm0, qword [eax + edx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], ebp
mov dword [esp], ecx
call fcn.0045c120
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0045c1f0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x5062e8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x506340]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40be31
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x506388]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, edx
mov ecx, 0x21
call fcn.00463230
mov eax, edx
mov ecx, 0x21
call fcn.004632d0
nop
call fcn.00461dc0
jmp fcn.0040bcb0