joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4178a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call ebx
mov edi, dword [esp + 0x38]
mov ebp, eax
mov ecx, dword [edi]
lea eax, [esp + 0x10]
push eax
push edi
call dword [ecx + 0x48]
test eax, eax
js 0x4178d7
cmp dword [esp + 0x10], 0
jne 0x41791f
call ebx
sub eax, ebp
cmp eax, 0x7d0
ja 0x41791f
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4178c1
xor eax, eax
push eax
push eax
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4178c1
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [eax + 0x48]
mov ebx, eax
test ebx, ebx
js 0x41798d
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x417985
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
push 0x4317ac
push ecx
call dword [eax]
mov ebx, eax
test ebx, ebx
js 0x417977
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov ebx, eax
test ebx, ebx
js 0x41796d
mov eax, dword [esp + 0x14]
push dword [esp + 0x3c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esp + 0x10]
test ebx, ebx
js 0x41798d
test ecx, ecx
jne 0x4179de
xor ebp, ebp
cmp dword [esi + 8], ebp
je 0x4179de
cmp dword [esi + 0x18], ebp
jne 0x4179de
cmp dword [esi + 0x14], ebp
je 0x4179de
push dword [esi + 0x14]
mov ecx, esi
call fcn.00417ed1
mov edi, eax
test edi, edi
je 0x4179de
push 0x204
push ebp
push ebp
push ebp
push ebp
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
call fcn.00421860
pop ecx
pop edi
not ebx
pop esi
shr ebx, 0x1f
pop ebp
mov al, bl
pop ebx
add esp, 0x24
ret 8
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x405570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x44d5b4]
push esi
fadd qword [0x446c18]
fstp dword [0x44d5b4]
fld dword [0x44d5b4]
fsubr qword [0x446dc8]
fsub qword [0x446dc0]
call fcn.00419940
mov word [0x44d5a8], ax
inc dword [0x44d698]
mov ecx, dword [0x44d698]
mov edx, dword [0x44d2dc]
mov eax, 0xd4f65c11
sub eax, ecx
mov ecx, dword [ebp + 8]
add edx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
lea esi, [ecx + eax*4]
mov eax, dword [ebp + 0x10]
fmul dword [0x44d2c0]
fstp dword [0x44d2c0]
cmp ecx, esi
je 0x405602
xor dword [ecx], eax
ror eax, 1
mov dword [ebp + 8], eax
mov dl, byte [ebp + 8]
shr eax, 8
add al, dl
add dl, al
add ecx, 4
mov byte [ebp + 9], al
mov byte [ebp + 8], dl
mov eax, dword [ebp + 8]
cmp ecx, esi
jne 0x4055e1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407090
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ax, word [0x44d08c]
movsx edx, ax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fsub dword [0x44d638]
mov eax, dword [0x44d448]
cvtsi2sd xmm0, eax
fstp qword [ebp - 8]
addsd xmm0, qword [ebp - 8]
cvttsd2si edx, xmm0
mov dword [0x44d448], edx
dec word [0x44d08c]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x412470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ax, word [0x44d1c8]
movzx ecx, word [0x44d220]
cwde
sub ecx, eax
mov word [0x44d220], cx
inc word [0x44d1c8]
sub esp, 8
cmp dword [0x44f560], 0
jne 0x4124a7
call fcn.004050c0
mov dword [0x44f560], eax
mov dx, word [0x44d168]
mov ecx, dword [0x44d218]
push ebx
push esi
movsx eax, dx
push edi
add eax, 0x9bbe522a
add ecx, eax
push 3
mov word [0x44d168], cx
push 0x20d9
call fcn.00413610
mov ebx, dword [ebp + 8]
mov edi, eax
push edi
push ebx
call fcn.0041ae9d
fld qword [0x44d370]
mov edx, dword [0x44d014]
fadd qword [0x447350]
cvtsi2sd xmm0, edx
mov esi, eax
push edi
fstp qword [ebp - 8]
push 3
addsd xmm0, qword [ebp - 8]
cvttsd2si eax, xmm0
mov dword [0x44d014], eax
call fcn.00417c50
add esp, 0x18
test esi, esi
jne 0x4125ce
push 0x3e8
call dword [0x44ed00]
inc word [0x44d174]
fld dword [0x44d350]
fsub qword [0x447348]
fld dword [0x44d5e4]
mov cx, word [0x44d174]
movsx edx, cx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fsubp st(1)
fadd qword [0x447340]
fld dword [0x44d5e4]
fadd qword [0x446c18]
fstp dword [0x44d5e4]
fcompi st(1)
fstp st(0)
jbe 0x4125a8
mov eax, dword [0x44d308]
fld dword [0x44d0ac]
mov cx, word [0x44d618]
fadd qword [0x447338]
movsx edx, cx
cvtsi2sd xmm0, eax
fstp qword [ebp - 8]
cvtsi2sd xmm1, edx
addsd xmm1, qword [ebp - 8]
subsd xmm0, xmm1
cvttsd2si eax, xmm0
mov dword [0x44d308], eax
push 3
push 0x20d9
call fcn.00413610
mov edi, eax
push edi
push ebx
call fcn.0041ae9d
push edi
push 3
mov esi, eax
call fcn.00417c50
add esp, 0x18
test esi, esi
je 0x4125fa
movzx ecx, word [0x44d4a0]
imul ecx, ecx, 0xfdcb9e2e
push esi
push 1
push 4
push 0x44f560
mov word [0x44d4a0], cx
call fcn.0041b319
push esi
call fcn.0041b13b
add esp, 0x14
mov edx, dword [0x44d29c]
pop edi
pop esi
mov dword [0x44d5d8], edx
dec dword [0x44d29c]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ax, word [0x44d458]
mov ecx, dword [0x44d0cc]
push ebx
cwde
mov ebx, 1
add dword [0x44d0cc], ebx
add eax, 0x1726c7f1
cmp ecx, eax
push esi
push edi
jge 0x413654
fld qword [0x44d600]
fld qword [0x44d130]
fsub qword [0x446fd0]
fsubp st(1)
fstp qword [0x44d600]
jmp 0x41366b
mov dx, word [0x44d090]
movsx eax, dx
sub dword [0x44d00c], eax
add word [0x44d090], bx
add dword [0x44d0c8], ebx
fld qword [0x44d2f8]
fld1
fsub st(1), st(0)
fxch st(1)
fstp qword [0x44d2f8]
mov ax, word [0x44d150]
mov edx, dword [0x44d0c8]
movsx ecx, ax
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fadd dword [0x44d2c4]
fadd qword [0x44d2f8]
fsubp st(1)
call fcn.00419940
mov word [0x44d150], ax
fsubr dword [0x44d2c4]
mov eax, dword [ebp + 0xc]
add eax, 4
fstp dword [0x44d2c4]
push eax
call fcn.00419f9d
movss xmm0, dword [0x446fc8]
mov edi, dword [ebp + 8]
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
movss dword [0x44d254], xmm0
lea ebx, [ebx]
mov al, byte [edi + 0x443288]
mov byte [esi], al
mov ecx, dword [0x44f0b0]
movzx edx, byte [ecx + edi]
xor dl, al
mov byte [esi], dl
mov al, byte [edi + ebx + 0x443288]
mov byte [esi + ebx], al
mov ecx, dword [0x44f0b0]
add edi, ebx
movzx edx, byte [ecx + edi]
add esi, ebx
xor dl, al
mov byte [esi], dl
add dword [0x44d574], ebx
mov ecx, dword [0x44d084]
mov edx, dword [0x44d044]
mov eax, 0xaee5bbda
sub eax, ecx
mov ecx, dword [0x44d574]
dec dword [0x44d044]
add eax, edx
mov edx, 0xf4c6ce21
sub edx, ecx
sub esi, ebx
cmp edx, eax
jne 0x413782
fld qword [0x44d258]
fld qword [0x44d3a8]
fadd qword [0x446fc0]
fsubp st(1)
fstp qword [0x44d258]
fld qword [0x44d3a8]
fsub qword [0x446c18]
fstp qword [0x44d3a8]
movzx eax, word [esi]
add edi, ebx
movzx ebx, ax
lea eax, [ebx + 3]
push eax
lea ecx, [edi + 0x443288]
push ecx
push esi
call fcn.0041a070
add dword [0x44d048], 0x7db6a222
mov edx, dword [0x44f0b0]
lea eax, [ebx + esi + 3]
add esp, 0xc
add edi, edx
mov ecx, esi
cmp esi, eax
je 0x4137ca
lea ebx, [ebx]
mov dl, byte [edi]
xor byte [ecx], dl
inc ecx
inc edi
cmp ecx, eax
jne 0x4137c0
cmp dword [ebp + 0xc], ebx
je 0x4137e7
mov byte [eax], 0
mov edi, dword [eax - 3]
sub eax, 3
sub dword [ebp + 0xc], ebx
mov esi, eax
mov ebx, 1
jmp 0x4136f0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c3f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44ddd0]
jne 0x41c400
repz ret
jmp fcn.0042a03c
Function at 0x4332f0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00420228
and dword [ebp - 4], 0
cmp dword [0x45003c], 0
mov ebx, eax
jne 0x4333a1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x433452
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x433452
push eax
call fcn.004201b6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45003c], eax
call esi
push eax
call fcn.004201b6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x450040], eax
call esi
push eax
call fcn.004201b6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x450044], eax
call esi
push eax
call fcn.004201b6
pop ecx
mov dword [0x45004c], eax
test eax, eax
je 0x4333a1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004201b6
pop ecx
mov dword [0x450048], eax
mov eax, dword [0x450048]
cmp eax, ebx
je 0x4333f9
cmp dword [0x45004c], ebx
je 0x4333f9
push eax
call fcn.00420231
push dword [0x45004c]
mov esi, eax
call fcn.00420231
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4333f9
test edi, edi
je 0x4333f9
call esi
test eax, eax
je 0x4333f0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4333f0
test byte [ebp - 0xc], 1
jne 0x4333f9
or dword [ebp + 0x10], 0x200000
jmp 0x433432
mov eax, dword [0x450040]
cmp eax, ebx
je 0x433432
push eax
call fcn.00420231
pop ecx
test eax, eax
je 0x433432
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x433432
mov eax, dword [0x450044]
cmp eax, ebx
je 0x433432
push eax
call fcn.00420231
pop ecx
test eax, eax
je 0x433432
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45003c]
call fcn.00420231
pop ecx
test eax, eax
je 0x433452
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x433454
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ee7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi], edi
je 0x403f16
cmp dword [esi + 4], edi
jbe 0x403f0f
mov eax, dword [esi]
mov eax, dword [eax + edi*8]
test eax, eax
je 0x403f09
push eax
call fcn.004301e8
inc edi
cmp edi, dword [esi + 4]
jb 0x403efa
push dword [esi]
call fcn.004324f6
push ebx
xor ebx, ebx
mov edi, 0xe0
cmp dword [esi + 8], ebx
je 0x403f48
cmp dword [esi + 0xc], ebx
jbe 0x403f40
mov dword [ebp + 8], ebx
mov eax, dword [esi + 8]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0xc]
jb 0x403f2b
push dword [esi + 8]
call fcn.004324f6
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x403f74
cmp dword [esi + 0x14], ebx
jbe 0x403f6c
and dword [ebp + 8], ebx
mov eax, dword [esi + 0x10]
add eax, dword [ebp + 8]
push eax
call fcn.00403e14
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x403f57
push dword [esi + 0x10]
call fcn.004324f6
xor edi, edi
pop ebx
cmp dword [esi + 0x18], edi
je 0x403f9f
cmp dword [esi + 0x1c], edi
jbe 0x403f97
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edi*8]
test dword [edi + 0x65], eax
je 0x403fb9
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x73], 0x6c6c6174
push edx
imul esi, dword gs:[bp + di + 0x74], 0x654b7972
imul esi, dword [bp + di + 0x74], 0x654b7972
jns 0x403fcf
jo 0x404016
xor dword [eax], eax
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx + 0x40], al
add byte [eax], al
add byte [esi + 0x2e000011], dh
adc dword [eax], eax
add byte [esi], ch
adc al, 0
add byte [0x516aede9], bl
cmp edi, dword [eax]
pop esp
add dword [edi - 0x7e818284], 0x383b8177
dec esi
dec esi
dec esi
cmp dword [ebx], 0x4e4e4e38
dec esi
adc byte [ebx - 0x6c685f5e], 0xa4
xchg ebx, eax
dec esi
mov al, byte [0xa1979593]
mov byte [0x994ea7a0], al
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
push esi
mov eax, dword [0x9d944e57]
mov al, byte [0xa1a7a14e]
mov byte [0x975b9b93], al
pushfd
mov eax, dword [0x9a9a8fa2]
xchg ebx, eax
xchg edx, eax
dec esi
invalid
invalid

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x2c3133ee
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x8392a19
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x426370
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
cmp dword [0x451a8c], 0
je 0x426392
mov eax, dword [ebp + 8]
push eax
call fcn.004262f9
add esp, 4
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x80000000
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
jmp 0x4263d7
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 5
jae 0x426410
lea eax, [ebp - 0x4c]
push eax
push 0x30200
push 0x803
push 0
call dword [sym.imp.WINMM.dll_mciSendCommandA_1]
test eax, eax
jne 0x42640b
mov dword [ebp - 0x30], 1
jmp 0x426410
jmp 0x4263d4
cmp dword [ebp - 0x30], 0
je 0x4264a3
mov eax, dword [ebp - 0x48]
mov word [0x451a88], ax
mov dword [0x451a8c], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x28]
push eax
push 0x40000
push 0x841
xor eax, eax
mov ax, word [0x451a88]
push eax
call dword [sym.imp.WINMM.dll_mciSendCommandA_1]
mov dword [ebp - 0x10], 0x4001
lea eax, [ebp - 0x18]
push eax
push 0x100
push 0x814
xor eax, eax
mov ax, word [0x451a88]
push eax
call dword [sym.imp.WINMM.dll_mciSendCommandA_1]
mov eax, dword [ebp - 0x14]
mov dword [0x46bd38], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0042614a
add esp, 4
jmp 0x4264c7
push 0x30
push 0
push 0x451ae0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.user32.DLL_MessageBoxA_1]
mov dword [0x451a8c], 0
xor eax, eax
jmp 0x426510
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.user32.DLL_InvalidateRect_1]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.user32.DLL_UpdateWindow_1]
push 0
mov eax, dword [0x46bd38]
push eax
call dword [sym.imp.user32.DLL_GetWindowThreadProcessId_1]
push eax
mov eax, dword [0x45d2e8]
push eax
push 0x426090
push 3
call dword [sym.imp.user32.DLL_SetWindowsHookExA_1]
mov dword [0x46bd68], eax
mov eax, 1
jmp 0x426510
pop edi
pop esi
pop ebx
leave
ret

Function at 0x426662
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x451af4]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
jmp 0x426685
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1a
jge 0x426713
movsx eax, byte [ebp - 0xc]
add eax, 0x2e
mov byte [ebp - 8], al
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA_1]
cmp eax, 3
jne 0x42670e
movsx eax, byte [ebp - 0xc]
mov al, 0x2e
nop
mov byte [0x451a98], al
push 0
lea eax, [ebp - 0x98]
push eax
push 0x451a98
call dword [sym.imp.KERNEL32.DLL_OpenFile_1]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
nop
nop
nop
nop
nop
nop
push 1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL__hread_1]
cmp eax, 1
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL__lclose_1]
mov eax, dword [ebp - 0xc]
jmp 0x42671d
jmp 0x426682
mov eax, 0xffffffff
jmp 0x42671d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43731c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.0044646a
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jl 0x437345
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x43734d
call fcn.0044646a
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
sub eax, dword [ebp - 4]
jmp 0x43735a
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4478b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push esi
push edi
mov esi, 0x453b30
lea edi, [ebp - 4]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
cmp eax, 1
lea ecx, [eax + 0x2d]
mov eax, 0
mov byte [ebp - 4], cl
adc eax, 0xffffffff
lea ecx, [ebp - 4]
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA_1]
cmp eax, 2
je 0x447900
cmp eax, 3
je 0x447904
cmp eax, 5
jb 0x4478f9
cmp eax, 6
jbe 0x447904
mov eax, 0xffffffff
jmp 0x447909
xor eax, eax
jmp 0x447909
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x448470
Capabilities:
Accept command line arguments
Link many functions at runtime

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c038
push 0x448a40
push eax
mov dword fs:[0], esp
sub esp, 0x60
jmp 0x481100
nop
call dword [sym.imp.KERNEL32.DLL_GetVersion_1]
mov dword [0x453b90], eax
xor eax, eax
mov al, byte [0x453b91]
mov dword [0x453b9c], eax
mov eax, dword [0x453b90]
shr dword [0x453b90], 0x10
and eax, 0xff
mov dword [0x453b98], eax
shl eax, 8
add eax, dword [0x453b9c]
mov dword [0x453b94], eax
call fcn.0044a270
mov dword [ebp - 4], 0
call fcn.0044a090
call fcn.0044a080
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA_1]
mov dword [0x476cbc], eax
call fcn.00449c20
mov dword [0x453b70], eax
test eax, eax
je 0x448509
cmp dword [0x476cbc], 0
jne 0x448513
push 0xffffffffffffffff
call fcn.00448850
add esp, 4
call fcn.004499a0
call fcn.004498c0
call fcn.00448820
mov esi, dword [0x476cbc]
mov al, byte [esi]
cmp al, 0x22
je 0x44853a
cmp al, 0x20
jbe 0x448567
inc esi
cmp byte [esi], 0x20
ja 0x448532
jmp 0x448567
inc esi
cmp byte [esi], 0x22
je 0x448566
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x448561
xor eax, eax
mov al, bl
push eax
call fcn.00449860
add esp, 4
test eax, eax
je 0x44855b
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x448543
cmp byte [esi], 0x22
jne 0x448567
inc esi
cmp byte [esi], 0
je 0x448577
cmp byte [esi], 0x20
ja 0x448577
inc esi
cmp byte [esi], 0
jne 0x44856c
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA_1]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x44859b
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA_1]
push eax
call main
push eax
call fcn.00448850
jmp 0x4485dc
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
call 0x481106
pop ebp
sub ebp, 0x106
push ebp
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA_1]
mov dword [ebp + 0x2c], eax
mov edx, eax
lea eax, [ebp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress_1]
mov dword [ebp + 0x20], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress_1]
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress_1]
mov dword [ebp + 0x28], eax
lea ebx, [ebp + 0x60]
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA_1]
lea ebx, [ebp + 0x70]
push ebx
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress_1]
mov dword [ebp + 0x58], eax
lea ebx, [ebp + 0x80]
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress_1]
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x40], 0
popal
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
jmp 0x448495
Function at 0x448890
Capabilities:
Terminate process

Disassembly:
mov dword [0x453bc8], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x453bc4], bl
jne 0x4488ec
cmp dword [0x476cb8], 0
je 0x4488da
mov esi, dword [0x476cb0]
sub esi, 4
cmp esi, dword [0x476cb8]
jb 0x4488da
mov eax, dword [esi]
test eax, eax
je 0x4488cf
call eax
sub esi, 4
cmp esi, dword [0x476cb8]
jae 0x4488c7
push 0x44d0f8
push 0x44d0f0
call fcn.00448910
add esp, 8
push 0x44d100
push 0x44d0fc
call fcn.00448910
add esp, 8
test ebx, ebx
jne 0x44890d
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_ExitProcess_1]
pop esi
pop ebx
ret
Function at 0x449c20
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
cmp dword [0x453c78], 0
push ebx
push esi
push edi
push ebp
jne 0x449c70
mov esi, dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW_1]
call esi
mov edi, eax
test edi, edi
je 0x449c4e
mov dword [0x453c78], 1
mov ebx, dword [esp + 0x10]
jmp 0x449c7e
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStrings_1]
mov ebx, eax
test ebx, ebx
je 0x449c66
mov dword [0x453c78], 2
jmp 0x449c7e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW_1]
cmp dword [0x453c78], 1
jne 0x449d2d
test edi, edi
jne 0x449ca1
call esi
mov edi, eax
test edi, edi
jne 0x449ca1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x449cbb
add esi, 2
cmp word [esi], 0
jne 0x449ca9
add esi, 2
cmp word [esi], 0
jne 0x449ca9
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte_1]
mov ebp, eax
test ebp, ebp
je 0x449d1c
push ebp
call fcn.004489c0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x449d1c
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte_1]
test eax, eax
jne 0x449d0b
push ebx
call fcn.0044a4c0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW_1]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW_1]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x453c78], 2
jne 0x449db1
test ebx, ebx
jne 0x449d50
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStrings_1]
mov ebx, eax
test ebx, ebx
jne 0x449d50
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x449d65
inc ebp
cmp byte [ebp], 0
jne 0x449d57
inc ebp
cmp byte [ebp], 0
jne 0x449d57
sub ebp, ebx
inc ebp
push ebp
call fcn.004489c0
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x449d8a
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA_1]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA_1]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret