joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463b28
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x463cdc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x134]
mov eax, 0x463cf4
call fcn.00463964
mov eax, dword [ebp - 0x134]
mov edx, 0x463d0c
call fcn.004057f0
setne byte [ebp - 5]
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x463ca8
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.00463a40
cmp dword [ebp - 4], 0
je 0x463c9b
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040e244
mov eax, dword [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
call fcn.00463958
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0040e244
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
jne 0x463c7a
lea eax, [ebp - 0x14c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.004654b8
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004095e8
mov eax, dword [ebp - 0x144]
mov edx, 0x463d24
call fcn.004057f0
sete al
and al, byte [ebp - 5]
je 0x463c7a
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
lea eax, [ebp - 0x150]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 4]
call fcn.00405694
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x463bc4
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463ce3
lea eax, [ebp - 0x150]
mov edx, 8
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x463e1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x463e51
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x48edf4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x463e31
pop edi
pop esi
pop ebx
ret
Function at 0x463e84
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463f0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
jne 0x463ee8
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x110]
call fcn.0040cce8
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x408918]
call fcn.0040d4fc
call fcn.00404d34
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a5e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463f15
lea eax, [ebp - 0x110]
call fcn.004053c8
ret

Function at 0x4640fc
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x464204
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4641e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004235b8
lea eax, [ebp - 8]
mov edx, 0x464218
call fcn.00405694
mov eax, dword [ebp - 8]
call fcn.00405858
mov edx, eax
lea eax, [ebp - 4]
call fcn.004055c0
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004644f8
push 0x20
lea eax, [ebp - 0xc]
call fcn.004235b8
lea eax, [ebp - 0xc]
mov edx, 0x464218
call fcn.00405694
mov eax, dword [ebp - 0xc]
call fcn.00405858
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x10]
call fcn.004235b8
lea eax, [ebp - 0x10]
mov edx, 0x464218
call fcn.00405694
mov eax, dword [ebp - 0x10]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x63b0cc]
mov edx, 0x464234
call fcn.00424b74
lea eax, [ebp - 0x14]
call fcn.004235b8
lea eax, [ebp - 0x14]
mov edx, 0x464218
call fcn.00405694
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
push 0x464240
call sub.kernel32.dll_MoveFileA
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4641e9
ret
Function at 0x464248
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x464320
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4642f5
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 4]
call fcn.004095e8
mov eax, dword [ebp - 4]
mov edx, 0x46433c
call fcn.004057f0
je 0x4642dc
mov eax, dword [ebp - 4]
mov edx, 0x464350
call fcn.004057f0
jne 0x4642e2
mov byte [ebp - 5], 1
jmp 0x4642f9
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x46429a
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464327
lea eax, [ebp - 0x134]
call fcn.004053c8
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x464360
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4644e6
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4644b2
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a2a4
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409560
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409560
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
je 0x464485
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409560
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409560
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004057f0
jne 0x46449f
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4643e0
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4644ed
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x4647cc
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x464930
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x464900
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
nop
add eax, 0
add eax, 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x10]
call fcn.00409f70
test al, al
je 0x464837
nop
add eax, 0
add eax, 0
push ebx
call sub.kernel32.dll_DeleteFileA
nop
add eax, 0
add eax, 0
nop
add eax, 0
add eax, 0
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
xor edx, edx
call fcn.004637a8
mov eax, dword [ebp - 0x14]
call fcn.00405d34
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4648ef
push dword fs:[eax]
mov dword fs:[eax], esp
nop
add eax, 0
add eax, 0
cmp dword [ebp - 8], 0
je 0x4648d1
nop
add eax, 0
add eax, 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
nop
add eax, 0
add eax, 0
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
nop
add eax, 0
add eax, 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4648f6
nop
add eax, 0
add eax, 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x464dec
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464e86
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x90]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x90]
call fcn.00409f70
test al, al
je 0x464e6d
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x8c]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464e6d
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.004257cc
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425858
mov eax, ebx
call fcn.00425698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464e8d
lea eax, [ebp - 0x90]
call fcn.004053c8
ret
Function at 0x464e98
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464f31
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8c]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x8c]
call fcn.00409f70
test al, al
je 0x464f18
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x88]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464f18
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.004257cc
mov edx, edi
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425858
mov eax, ebx
call fcn.00425698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464f38
lea eax, [ebp - 0x8c]
call fcn.004053c8
ret
Function at 0x4654fc
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
push 1
call sub.kernel32.dll_Sleep_2
push esp
push 0
push 0
push 0x4654f4
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x465520
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov eax, ebp
mov edx, esi
call fcn.0040541c
mov eax, esi
test eax, eax
je 0x46553c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jbe 0x465571
mov ebx, 1
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 4
mov byte [eax + ebx - 1], dl
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 0xc
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x465547
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x467784
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x46784d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x467832
mov eax, dword [ebp - 0x10]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x46785c
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x467811
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004055c0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x467884
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x467832
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467854
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x4678a8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x46794c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x467931
mov eax, dword [ebp - 0xc]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x46795c
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x467931
mov eax, edi
mov edx, dword [ebp - 0x14]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467953
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x468160
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x468272
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
call fcn.00467690
test al, al
je 0x4681a7
mov byte [ebp - 5], 1
jmp 0x46824c
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x468242
mov eax, dword [edi + 8]
call fcn.00467c74
test al, al
je 0x4681d9
mov byte [ebp - 5], 1
jmp 0x468246
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.00467acc
cmp dword [ebp - 4], 0
je 0x468235
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov ecx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x134]
call fcn.00467980
test al, al
je 0x468235
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4681c7
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468279
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x468348
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
xor ecx, ecx
mov eax, dword [0x6387f8]
test eax, eax
je 0x46838b
movzx edx, word [eax]
not dx
cmp dx, 0x5a4d
je 0x46838b
mov esi, eax
mov edx, esi
mov ebx, dword [eax + 0x3c]
add edx, ebx
mov edx, dword [edx]
not edx
cmp edx, 0x4550
je 0x46838b
mov edx, ebx
add edx, 0x18
add edx, 0x34
sub edx, 8
add edx, 0x14
add edx, esi
mov eax, edx
mov ecx, dword [eax]
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x46c2d4
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov edi, eax
mov eax, dword [0x63c3ac]
lea esi, [0x48f204]
mov ecx, edx
or ecx, ecx
je 0x46c2fd
xor ebx, ebx
mov bl, al
shr eax, 8
xor bl, byte [edi]
inc edi
shl ebx, 2
xor eax, dword [ebx + esi]
dec ecx
jne 0x46c2ea
mov dword [0x63c3ac], eax
pop ebx
pop esi
pop edi
ret
Function at 0x4700d4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00405848
xor eax, eax
push ebp
push 0x470179
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebp - 8]
call fcn.00468cf8
mov esi, dword [ebx + 0x1c]
mov dword [esi + 0x53c], ebx
mov dword [esi + 0x538], 0x47003c
mov dword [esi + 0x544], ebx
mov dword [esi + 0x540], 0x47009c
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x470054
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebp - 4], eax
push ebp
call fcn.004700b0
pop ecx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetExitCodeThread
cmp dword [ebp - 0xc], 0
je 0x470163
mov eax, ebx
call fcn.0046ff38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470180
lea eax, [ebp - 8]
call fcn.004053c8
ret

Function at 0x4717a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov dword [0x48fbd0], 0xffffffff
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov ebx, 0xff
jmp 0x4717ec
cmp dword [0x48fbd0], 0
je 0x4717fe
mov eax, edi
call fcn.00471714
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, ebp
jbe 0x4717ec
mov ebx, 0x102
jmp 0x4717fe
cmp ebx, 0xff
jne 0x4717fe
mov eax, dword [0x6349ec]
cmp byte [eax], 0
je 0x4717c8
xor eax, eax
mov dword [0x48fbd0], eax
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x474d98
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
or ebp, 0xffffffff
cmp dword [esp], 0x32
jne 0x474e78
mov esi, ebx
movzx eax, word [esi + 2]
cmp ax, 0x2417
jbe 0x474e78
cmp ax, 0x241d
jae 0x474e78
push 0x32
call fcn.004070d8
pop ecx
mov esi, eax
mov ecx, 0x32
mov edx, ebx
mov eax, esi
call fcn.00408390
movzx ebp, word [esi + 2]
sub ebp, 0x2012
sub ebp, 6
sub ebp, 0x400
dec ebp
cmp ebp, 0xffffffff
jne 0x474e4d
mov dword [esp + 4], 4
mov ebx, 0x63d8d0
mov eax, dword [ebx]
call fcn.00474b70
push 0x32
call fcn.004070d8
pop ecx
mov edi, eax
mov ecx, 0x32
mov edx, esi
mov eax, edi
call fcn.00408390
mov eax, dword [ebx]
mov edx, edi
call fcn.004240d0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebx]
mov dword [edx + 4], eax
add ebx, 4
dec dword [esp + 4]
jne 0x474e09
push esi
call fcn.004070e8
pop ecx
jmp 0x474e78
mov eax, ebp
sub eax, 4
jae 0x474e73
mov eax, dword [ebp*4 + 0x63d8d0]
mov edx, esi
call fcn.004240d0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp*4 + 0x63d8d0]
mov dword [edx + 4], eax
jmp 0x474e78
mov ebp, 0xfffffffe
mov eax, ebp
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x476980
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48fc58], ax
cmp byte [0x48fc54], 0
jne 0x476995
xor ebx, ebx
jmp 0x4769f8
call fcn.00476944
push esp
push 0
push 0
push 0x4764a0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x4769ec
cmp dword [0x48fc50], 0
je 0x4769cd
push 0x64
mov eax, dword [0x48fc50]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x4769b3
cmp dword [0x48fc64], 0
jbe 0x4769de
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48fc64]
jmp 0x4769f8
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.00476088
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x477d90
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48fd40], ax
cmp byte [0x48fd3c], 0
jne 0x477da5
xor ebx, ebx
jmp 0x477e08
call fcn.00477d54
push esp
push 0
push 0
push 0x4778b0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x477dfc
cmp dword [0x48fd38], 0
je 0x477ddd
push 0x64
mov eax, dword [0x48fd38]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x477dc3
cmp dword [0x48fd4c], 0
jbe 0x477dee
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48fd4c]
jmp 0x477e08
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.00477498
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x478580
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47873c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 0
xor eax, eax
push ebp
push 0x47870c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x478558]
call fcn.004068bc
add esp, 4
test esi, esi
je 0x478603
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00478ce4
jmp 0x478648
mov ebx, 0x41
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004055b0
lea eax, [ebp - 0x14]
mov edx, 0x478754
call fcn.00405694
mov esi, dword [ebp - 0x14]
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x478642
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00478ce4
inc ebx
cmp ebx, 0x5b
jne 0x478608
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 0
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x478697
inc esi
xor ebx, ebx
mov edx, dword [0x4784c0]
xor eax, eax
call fcn.00423fc8
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [eax + ebx*4], edi
mov eax, dword [ebp - 8]
mov dword [edi + 0x6c], eax
lea eax, [edi + 0x30]
push eax
push 4
push edi
push 0x4784fc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*4]
mov dword [edx + 0x20], eax
inc ebx
dec esi
jne 0x47865a
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4786b8
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.004252c8
push 1
call sub.kernel32.dll_Sleep_1
inc ebx
dec esi
jne 0x4786a2
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4786dd
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00425320
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00423fe8
inc ebx
dec esi
jne 0x4786c3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478713
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00478d4c
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 1
ret