joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440d00
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x440d33
push esi
call fcn.0044ef90
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x440d2c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x440db9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x440da2
mov eax, dword [esi + 8]
test eax, eax
je 0x440d57
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x440d9e
cmp eax, 2
je 0x440da2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x440d4a
cmp eax, 3
je 0x440d7d
cmp eax, 1
jne 0x440d4a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x440d4a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x440d4a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00440de0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x440dc8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00440de0
add esp, 4
pop esi
ret

Function at 0x441660
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x441681
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x441681
mov eax, dword [eax + 0x44]
test eax, eax
je 0x441681
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x45d080
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x481a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0045cc60
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.0045ccd0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.0045cfb0
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.0045cc80
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10

Function at 0x45d098
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x481a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0045cc60
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.0045ccd0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.0045cfb0
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.0045cc80
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x45f980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x45f98b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x45fa8e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4fc3a4]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4fc3a4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4fc3a4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4fc3a4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4fc3a4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4fc3a4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4fc3a4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4fc3a4]
xor eax, edx
inc ecx
dec edi
jne 0x45f9a6
pop edi
test esi, esi
je 0x45fab0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4fc3a4]
xor eax, edx
inc ecx
dec esi
jne 0x45fa92
pop esi
pop ebx
not eax
ret

Function at 0x4603a0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x4603e1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4603d6
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x4603f4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x465513
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x465533
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00464f6a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x465556
test byte [esp + 8], 2
je 0x465556
call fcn.00464fdd
mov dword [eax], 0xd
call fcn.00464fe6
mov dword [eax], 5
jmp 0x46552f
xor eax, eax
ret

Function at 0x475d76
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x475dae
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00473e2a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00473e02
jmp 0x475dba
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x477464
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4774a6
call fcn.0047cf1d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4774a6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47749d
xor eax, eax
jmp 0x4774ae
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004774b4
pop edi
pop esi
pop ebx
ret 4

Function at 0x47d44d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47d47b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47d499
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047d3b3
jmp 0x47d499
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47d499
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047d3b3
test edi, edi
mov eax, edi
jne 0x47d483
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402568
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402576
call dword [0x40a004]
or eax, eax
je 0x402577
ret
mov al, 1
jmp fcn.004025e8

Function at 0x402580
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40258e
call dword [0x40a008]
or eax, eax
jne 0x40258f
ret
mov al, 2
jmp fcn.004025e8

Function at 0x402598
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4025d0
test edx, edx
je 0x4025ba
push eax
mov eax, ecx
call dword [0x40a00c]
pop ecx
or eax, eax
je 0x4025c9
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.004025e8
mov dword [eax], edx
mov eax, ecx
call dword [0x40a008]
or eax, eax
jne 0x4025b3
ret
mov al, 1
jmp fcn.004025e8
test edx, edx
je 0x4025e4
push eax
mov eax, edx
call dword [0x40a004]
pop ecx
or eax, eax
je 0x4025c9
mov dword [ecx], eax
ret

Function at 0x402770
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40b02c], 0x8088405
inc edx
mov dword [0x40b02c], edx
mul edx
mov eax, edx
ret

Function at 0x4050f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405131
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403230
jmp 0x40513a
mov eax, ebx
mov edx, esi
call fcn.004031e4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405144
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405165
mov al, byte [esp]
jmp 0x405167
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40675c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4067a4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004066f8
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4067ab
lea eax, [ebp - 4]
call fcn.00403150
ret
Function at 0x4069ac
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406a3a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4069f7
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403230
jmp 0x406a24
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x406a0b
lea eax, [ebp - 4]
call fcn.00403150
jmp 0x406a1a
lea edx, [ebp - 4]
call fcn.00406870
test ebx, ebx
je 0x406a1a
dec ebx
jmp 0x4069fc
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a41
lea eax, [ebp - 4]
call fcn.00403150
ret

Function at 0x406a48
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00404ccc
add esp, 0x104
pop ebx
ret

Function at 0x406b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x406cb1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406c9b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406be9
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406c9b
cmp dword [ebp - 0xc], 0
jne 0x406bfe
mov eax, dword [ebp - 4]
call fcn.00403150
mov bl, 1
jmp 0x406c9b
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00403230
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004033d8
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406bb5
test eax, eax
jne 0x406c9b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x406c45
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x406c9b
jmp 0x406c45
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x406c58
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x406c42
cmp dword [ebp - 8], 7
jne 0x406c67
cmp dword [ebp - 0xc], 0
je 0x406c67
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004034a8
cmp dword [ebp - 8], 7
jne 0x406c8e
cmp dword [ebp - 0xc], 0
je 0x406c8e
lea eax, [ebp - 0x10]
call fcn.004033d8
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.004031a0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cb8
lea eax, [ebp - 0x10]
call fcn.00403150
ret
Function at 0x4075ec
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b558
mov eax, esi
mov edx, 8
test al, 1
je 0x407608
shr eax, 1
xor eax, 0xedb88320
jmp 0x40760a
shr eax, 1
dec edx
jne 0x4075fb
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4075f4
pop esi
ret

Function at 0x407637
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40b554], 0
jne 0x407643
call fcn.004075ec
push 1
push 0x40b554
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40766e
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b558]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407649
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x408bc4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408b78
test al, al
jne 0x408be5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408c31
xor eax, eax
push ebp
push 0x408c21
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033cc
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408c28
lea eax, [ebp - 0xc]
call fcn.00408bb4
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408f38
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x409027
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406a74
mov edx, dword [ebp - 8]
mov ecx, 0x409040
xor eax, eax
call fcn.00408e2c
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x408ff5
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x408f58
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408a04
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404b80
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00406fec
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.004089d4
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x40454c
call fcn.0040577c
call fcn.00402e88
jmp 0x408f58
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40902e
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403170
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403170
ret
Function at 0x409108
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409162
inc esi
xor edi, edi
cmp edi, 1
jne 0x40912e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40913c
cmp edi, 1
jle 0x40913c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408bc4
test eax, eax
jne 0x409162
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409162
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409162
inc edi
dec esi
jne 0x40911e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x409554
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x78]
xor eax, eax
push ebp
push 0x409644
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40965c
push esi
push 0x409668
push edi
lea eax, [ebp - 8]
mov edx, 4
call fcn.0040336c
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004033cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4095d8
mov al, 0x62
call fcn.0040916c
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4095ef
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4095e3
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x5c]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x4095ef
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40964b
lea eax, [ebp - 8]
call fcn.00403150
ret
Function at 0x4096dc
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409790
jmp 0x409785
cmp dword [esi + 0x10], 0x1000
jne 0x409771
test byte [esi + 0x15], 1
jne 0x409771
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409730
cmp eax, 2
je 0x409730
cmp eax, 0x10
je 0x409730
cmp eax, 0x20
jne 0x409745
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409745
mov bl, 1
xor ebp, ebp
jmp 0x409756
mov eax, dword [esi]
add eax, ebp
call fcn.004096d4
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409749
test bl, bl
je 0x409771
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409790
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409708
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4104dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4104eb
pop dword [ebp - 0x3c]
mov eax, 0x4104eb
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3fb52
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x2ca0717a
sub ecx, 0x2ca021b2
mov esi, eax
mov edi, 0x1cd21a2a
sub edi, 0x1c8ec62a
add edi, dword [ebp - 0x3c]
mov edx, 0xe9af775c
sub edx, 0x893ef1ab
mov dword [ebp - 0x28], 0x81c632fd
mov ebx, dword [edi]
sub dword [ebp - 0x34], 0x1dfe216b
xor ebx, edx
xor dword [ebp - 0x2c], esi
mov dword [esi], ebx
add dword [ebp - 4], edx
add esi, 0x88a36769
sub esi, 0x88a36765
add edi, 0x2f77050e
sub edi, 0x2f77050a
loop 0x410540
add eax, 0x1279e28f
sub eax, 0x1278b09c
xor ebx, ebx
add ebx, eax
add eax, 0xd66c5457
add eax, 0x2993abae
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x41d2d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e95e
and dword [ebp - 4], 0
cmp dword [0x4310f8], 0
mov ebx, eax
jne 0x41d386
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d437
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x42d324
push edi
call esi
test eax, eax
je 0x41d437
push eax
call fcn.004104dc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4310f8], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4310fc], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431100], eax
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431108], eax
test eax, eax
je 0x41d386
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431104], eax
mov eax, dword [0x431104]
cmp eax, ebx
je 0x41d3de
cmp dword [0x431108], ebx
je 0x41d3de
push eax
call fcn.004104dc
push dword [0x431108]
mov esi, eax
call fcn.004104dc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d3de
test edi, edi
je 0x41d3de
call esi
test eax, eax
je 0x41d3d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d3d5
test byte [ebp - 0xc], 1
jne 0x41d3de
or dword [ebp + 0x10], 0x200000
jmp 0x41d417
mov eax, dword [0x4310fc]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d417
mov eax, dword [0x431100]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4310f8]
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d437
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d439
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret