joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483eb4
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407048
xor eax, eax
push ebp
push 0x484025
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004122a4
mov eax, dword [ebp - 0x24]
mov edx, 0x484040
call fcn.004077cc
jne 0x484002
xor ebx, ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x483f1d
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x483f1d
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406470
test eax, eax
je 0x483f26
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x483f3d
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + edx*2 - 2]
add ebx, ecx
inc edx
dec eax
jne 0x483f2f
mov ecx, 0x40
mov eax, ebx
cdq
idiv ecx
mov ebx, edx
cmp ebx, 0x20
jl 0x483f68
mov ecx, ebx
sub ecx, 0x20
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x50]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x24]
shr eax, cl
mov ebx, eax
jmp 0x483f7d
mov ecx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x50]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x28]
shr eax, cl
mov ebx, eax
and ebx, 1
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004982a8
mov eax, dword [ebp - 0x28]
mov edx, 1
call fcn.00411908
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push esi
call sub.KERNEL32.DLL_GetFileTime
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FileTimeToSystemTime
movzx eax, word [ebp - 0x14]
shr eax, 1
and eax, 1
cmp ebx, eax
je 0x483fd4
dec ebx
jne 0x483fcf
add word [ebp - 0x14], 2
jmp 0x483fd4
sub word [ebp - 0x14], 2
cmp word [ebp - 0x12], 0
jne 0x483fe1
mov word [ebp - 0x12], 0xfc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_SystemTimeToFileTime
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFileTime
push esi
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48402c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00407058
lea eax, [ebp - 4]
call fcn.00407050
ret
Function at 0x496958
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x496a0a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov eax, dword [0x4abc40]
call fcn.00408a4c
mov esi, eax
push 0xa
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, 0x496a28
call fcn.00407528
mov eax, dword [ebp - 8]
call fcn.004070ec
push eax
push esi
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
push ebx
push esi
call sub.KERNEL32.DLL_SizeofResource
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4969f4
cmp dword [ebp - 4], 0
je 0x4969f4
mov dl, 1
mov eax, dword [0x42a78c]
call fcn.00404f18
mov edi, eax
push ebx
push esi
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_LockResource
mov edx, eax
mov ecx, dword [ebp - 4]
mov eax, edi
call fcn.00436150
push 0
push 0
mov eax, edi
call fcn.00435ee4
push ebx
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496a11
lea eax, [ebp - 8]
call fcn.00407050
ret

Function at 0x497924
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x497a62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00407060
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004070b4
lea eax, [ebp - 4]
call fcn.004079cc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004070ec
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x497a44
mov eax, ebx
call fcn.0040426c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x497a3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004070ec
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x497a27
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x497a70
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x497a27
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x2c]
mov ecx, 1
mov eax, 0x497ab0
call fcn.00412908
mov eax, dword [ebp - 0x1c]
call fcn.004070ec
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x497a27
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.0040720c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497a44
mov eax, dword [ebp - 0xc]
call fcn.00404288
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497a69
lea eax, [ebp - 0x1c]
call fcn.00407050
lea eax, [ebp - 4]
call fcn.00407050
ret
Function at 0x4986f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49878c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.004070ec
push eax
mov eax, esi
call fcn.004070ec
push eax
call sub.KERNEL32.DLL_CopyFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x498776
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 0x11
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x10], 0x11
call sub.KERNEL32.DLL_GetLastError_1
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x4987a8
call fcn.00412908
mov eax, dword [ebp - 4]
movzx edx, byte [0x498804]
call fcn.00496be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498793
lea eax, [ebp - 4]
call fcn.00407050
ret

Function at 0x49894c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4989e2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, edi
call fcn.004070ec
push eax
mov eax, esi
call fcn.004070ec
push eax
call sub.KERNEL32.DLL_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4989cc
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 0x11
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x10], 0x11
call sub.KERNEL32.DLL_GetLastError_1
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x498a00
call fcn.00412908
mov eax, dword [ebp - 4]
movzx edx, byte [0x498a5c]
call fcn.00496be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4989e9
lea eax, [ebp - 4]
call fcn.00407050
ret
Function at 0x498df4
Capabilities:
Delete file
Move file

Disassembly:
push ebx
mov ebx, eax
push 4
push 0
mov eax, ebx
call fcn.004070ec
push eax
call sub.KERNEL32.DLL_MoveFileExW
pop ebx
ret

Function at 0x498e0c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x498fe8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4294d0]
call fcn.00435e64
mov dword [ebp - 0x10], eax
push 0x101
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40bef0]
call fcn.00408988
add esp, 4
lea eax, [ebp - 8]
xor edx, edx
call fcn.004070b4
call sub.KERNEL32.DLL_GetConsoleOutputCP
call fcn.00419b10
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x498fb0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x1c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x498f90
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.00419b44
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.00407468
lea eax, [ebp - 0x2c]
mov ecx, 0x499004
mov edx, dword [ebp - 8]
call fcn.00407528
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x498e86
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
sub ebx, 2
test ebx, ebx
jl 0x498f26
inc ebx
xor esi, esi
lea ecx, [ebp - 0x30]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x30]
mov al, 8
call fcn.00496f24
inc esi
dec ebx
jne 0x498f0b
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x498f62
mov eax, dword [ebp - 0x20]
sub eax, 0xa
cmp word [eax], 2
je 0x498f62
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00406470
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x498f79
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x24]
dec ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00407834
jmp 0x498e86
mov edx, dword [ebp - 8]
mov al, 8
call fcn.00496f24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498fb7
mov eax, dword [ebp - 0x10]
call fcn.00404f48
ret
Function at 0x49953c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x68], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4996fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
xor edx, edx
push ebp
push 0x499695
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x78], ebx
mov byte [ebp - 0x74], 0x11
mov dword [ebp - 0x70], esi
mov byte [ebp - 0x6c], 0x11
lea edx, [ebp - 0x78]
mov ecx, 1
mov eax, 0x499718
call fcn.00412908
mov edx, dword [ebp - 0x68]
mov al, 8
call fcn.00496f24
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00404914
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], pe_nt_image_headers32
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x8000020
push 0xffffffffffffffff
push 0
push 0
push 0x499748
push ebx
push 0x499758
push esi
lea eax, [ebp - 0x7c]
mov edx, 4
call fcn.0040760c
mov eax, dword [ebp - 0x7c]
call fcn.004070ec
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x499679
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.DLL_GetLastError_1
mov dword [ebp - 0x88], eax
mov byte [ebp - 0x84], 0
lea edx, [ebp - 0x88]
xor ecx, ecx
mov eax, 0x49976c
call fcn.00412908
mov edx, dword [ebp - 0x80]
mov al, 8
call fcn.00496f24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4996cd
mov edx, 0x4997ac
mov al, 6
call fcn.00496f24
mov eax, dword [ebp - 0x64]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4996cd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499702
lea eax, [ebp - 0x8c]
call fcn.00407050
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.00407058
lea eax, [ebp - 0x68]
call fcn.00407050
ret

Function at 0x499800
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 1
push 0
push 0
mov eax, ebx
call fcn.004070ec
push eax
push 0x499824
push 0
call sub.shell32.dll_ShellExecuteW
test eax, eax
sete al
pop ebx
ret
Function at 0x499a80
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x25c], ebx
mov byte [ebp - 0x251], cl
mov esi, edx
mov edi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x499c6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00411c58
test al, al
je 0x499afd
lea edx, [ebp - 0x258]
mov eax, edi
call fcn.0041778c
lea eax, [ebp - 0x25c]
mov ecx, 0x499c8c
mov edx, dword [ebp - 0x258]
call fcn.00407528
jmp 0x499b17
lea edx, [ebp - 0x258]
mov eax, edi
call fcn.00411f90
lea eax, [ebp - 0x25c]
mov edx, edi
call fcn.004070b4
lea eax, [ebp - 0x250]
push eax
mov eax, dword [ebp - 0x25c]
call fcn.004070ec
push eax
call sub.KERNEL32.DLL_FindFirstFileW_1
mov dword [ebp - 0x260], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x260], 0xffffffff
je 0x499c41
xor eax, eax
push ebp
push 0x499c3a
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x499bb3
push ebp
call fcn.004998bc
pop ecx
test al, al
je 0x499bb3
movzx eax, byte [ebp + 0xc]
push eax
push ebx
lea eax, [ebp - 0x26c]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.00407260
mov ecx, dword [ebp - 0x26c]
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 0x258]
call fcn.00407528
mov eax, dword [ebp - 0x268]
movzx ecx, byte [ebp - 0x251]
mov edx, esi
call fcn.00499a80
push ebp
call fcn.00499a04
pop ecx
test al, al
je 0x499c05
push ebp
call fcn.00499960
pop ecx
test al, al
je 0x499beb
push ebp
lea eax, [ebp - 0x270]
call fcn.00499a44
pop ecx
mov ecx, dword [ebp - 0x270]
mov edx, dword [ebp - 0x264]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x60]
jmp 0x499c05
push ebp
lea eax, [ebp - 0x274]
call fcn.00499a44
pop ecx
mov edx, dword [ebp - 0x274]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x250]
push eax
mov eax, dword [ebp - 0x260]
push eax
call sub.KERNEL32.DLL_FindNextFileW
test eax, eax
jne 0x499b5d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499c41
mov eax, dword [ebp - 0x260]
push eax
call sub.KERNEL32.DLL_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499c76
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.00407058
lea eax, [ebp - 0x25c]
mov edx, 2
call fcn.00407058
ret

Function at 0x499ccc
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
mov edx, 0x104
call fcn.004073d0
mov eax, dword [ebx]
call fcn.004070ec
push eax
push 0
push 0
push 0x26
push 0
call sub.SHFolder.dll_SHGetFolderPathW
mov eax, dword [ebx]
call fcn.004070ec
mov edx, eax
mov eax, ebx
call fcn.0040720c
pop ebx
ret
Function at 0x49a5dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49a70e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.00407060
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.004070ec
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
lea eax, [ebx + 1]
call fcn.0040426c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49a6f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.004070ec
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
jne 0x49a653
call fcn.00405bd0
jmp 0x49a6f8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x49a71c
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
jne 0x49a677
call fcn.00405bd0
jmp 0x49a6f8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x49a75c
call fcn.00412908
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004070ec
push eax
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
jne 0x49a6d1
call fcn.00405bd0
jmp 0x49a6f8
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004127e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a6f8
mov eax, dword [ebp - 8]
call fcn.00404288
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a715
lea eax, [ebp - 4]
call fcn.00407050
ret
Function at 0x5df835ca
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 4], esi
jne 0x5df835e5
mov eax, 0x8000002b
jmp 0x5df83652
mov eax, dword [edi + 8]
cmp eax, esi
jne 0x5df835f3
mov eax, 0x80000018
jmp 0x5df83652
push esi
push esi
push eax
call sub.TAPI32.dll_lineDrop
cmp eax, esi
jl 0x5df83652
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov dword [edi + 0x24], eax
call esi
mov ebx, eax
add ebx, 0x1388
jmp 0x5df83649
xor eax, eax
cmp dword [edi + 0x24], eax
jne 0x5df83622
cmp dword [edi + 0x20], 1
je 0x5df8364f
push 1
push eax
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x5df83649
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
call esi
cmp eax, ebx
jb 0x5df83615
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x6f635b7b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x65ed1855
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x405980
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
call dword [sym.imp.MSVCRT.dll_rand]
test al, 3
jne 0x405a00
mov eax, dword [esp + 8]
push 0x40870c
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x405a00
push ebx
push esi
push edi
mov ecx, 0x40d
mov esi, 0x408820
mov edi, 0x42e058
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x54321cba
mov bl, byte [eax + 0x42e058]
mov edx, ecx
sar edx, 0x17
xor bl, dl
add ecx, 0x1234567f
mov byte [eax + 0x42e058], bl
inc eax
cmp eax, 0x1034
jb 0x4059bf
push ebp
push 0x1034
push 1
push 0x42e058
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x411c5e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x411c5e
lcall 0x5de5, 0x8b10c483
jmp int.00849fdc
Function at 0x4146c3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x414702
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x414702
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414702
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x414702
cmp dword [ecx + 0x74], 0xe
jbe 0x414702
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x426ae0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426b0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426b0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219