joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1272dd5b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
sub eax, 0
mov dword [ebp - 4], 4
je 0x1272de4b
dec eax
jne 0x1272de50
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.1273ba25
mov dword [0x1277baa4], 0x50
call fcn.1272db44
mov ecx, dword [0x1277baa4]
test eax, eax
je 0x1272ddaa
add ecx, ecx
mov dword [0x1277baa4], ecx
push edi
push 3
pop edi
mov eax, ecx
shl eax, 2
xor edx, edx
div edi
mov dword [0x1277ba94], ecx
mov dword [0x1277baa0], eax
lea eax, [ecx + ecx]
mov dword [0x1277ba9c], eax
mov eax, ecx
imul eax, eax, 0x28
mov dword [0x1277ba98], eax
lea eax, [ebp + 0xc]
push eax
push 0x12721580
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
pop edi
test eax, eax
jne 0x1272de3a
lea eax, [ebp - 4]
push eax
push 0x1277ba90
lea eax, [ebp + 8]
push eax
push 0
push 0x12721f8c
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1272de25
cmp dword [ebp + 8], 4
jne 0x1272de25
mov eax, dword [0x1277ba90]
cmp eax, 4
jb 0x1272de25
cmp eax, 0x80
jbe 0x1272de2f
mov dword [0x1277ba90], 0x18
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1272de44
mov dword [0x1277ba90], 0x18
call fcn.1272dc8a
jmp 0x1272de50
call fcn.1275d290
xor eax, eax
inc eax
leave
ret 0xc

Function at 0x1272deb2
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x1277bbac]
test eax, eax
je 0x1272dee6
push esi
mov esi, dword [sym.imp.msvcrt.dll_fwrite]
push eax
push 1
lea eax, [ebp + 8]
push 4
push eax
call esi
push dword [0x1277bbac]
lea eax, [ebp + 0xc]
push 1
push 4
push eax
call esi
add esp, 0x20
pop esi
pop ebp
ret

Function at 0x1272df2b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x1277bbac]
test eax, eax
je 0x1272df4b
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x127371f3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
and dword [eax], 0
mov eax, dword [ebp + 8]
sub esp, 0xc
push ebx
push esi
push edi
push 4
pop edx
mov ecx, edx
mov edi, 0x12721800
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x12737227
mov ebx, dword [ebp + 0xc]
mov dword [ebx], 0x12777404
jmp 0x127372e3
mov ecx, edx
mov edi, 0x12721820
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x12737244
mov ebx, dword [ebp + 0xc]
mov dword [ebx], 0x1277740c
jmp 0x127372e3
mov ecx, edx
mov edi, 0x12721860
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x12737261
mov ebx, dword [ebp + 0xc]
mov dword [ebx], 0x1277741c
jmp 0x127372e3
mov ecx, edx
mov edi, 0x12721840
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x1273727b
mov ebx, dword [ebp + 0xc]
mov dword [ebx], 0x12777414
jmp 0x127372e3
mov ecx, edx
mov edi, 0x127217f0
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x12737295
mov ebx, dword [ebp + 0xc]
mov dword [ebx], 0x12777424
jmp 0x127372e3
mov ecx, edx
mov edi, 0x12721830
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x127372b3
mov esi, eax
mov ecx, edx
mov edi, 0x12721850
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x127372c2
push 0x12722a68
call fcn.12736e61
pop ecx
test eax, eax
jne 0x127372d1
mov eax, dword [ebp + 0xc]
and dword [eax], ebx
mov eax, 0x80004002
jmp 0x127373b0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call eax
mov eax, dword [ebp + 8]
push 4
pop edx
mov esi, eax
mov ecx, edx
mov edi, 0x127217f0
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x127373ae
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x12721250
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x127373ae
push 4
pop esi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x12722a54
push dword [ebp - 4]
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x127373a5
cmp dword [ebp - 8], esi
jne 0x127373a5
cmp dword [ebp + 0xc], esi
jne 0x127373a5
mov eax, dword [ebp - 0xc]
dec eax
je 0x1273739f
dec eax
je 0x12737397
dec eax
je 0x1273738f
dec eax
je 0x1273736e
dec eax
je 0x12737366
dec eax
jne 0x127373a5
mov dword [ebx], 0x1277741c
jmp 0x127373a5
mov dword [ebx], 0x12777428
jmp 0x127373a5
push 0x12722a68
call fcn.12736e61
pop ecx
test eax, eax
jne 0x12737384
and dword [ebx], eax
jmp 0x127372c7
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call eax
jmp 0x127373a5
mov dword [ebx], 0x1277740c
jmp 0x127373a5
mov dword [ebx], 0x12777414
jmp 0x127373a5
mov dword [ebx], 0x12777404
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x127380ca
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xe28]
mov ecx, edi
call fcn.127498e6
xor ebx, ebx
cmp eax, ebx
jne 0x1273824a
push 0xdde
push ebx
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 8]
mov ecx, esi
mov word [esi + 0xdde], ax
call fcn.12737fab
cmp eax, ebx
jne 0x1273824a
push esi
mov ecx, edi
call fcn.12749add
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xdaa], eax
push 8
pop ecx
xor eax, eax
mov dword [esi + 0x10c0], 0x10c4
lea edi, [esi + 0x10a0]
rep stosd dword es:[edi], eax
or dword [esi + 0xe18], 0xffffffff
mov edx, 0x1c4
mov ecx, esi
call fcn.1273927f
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xd02], eax
lea eax, [ebp - 4]
push eax
push 0x12721580
push 0x80000002
mov dword [esi + 0xde0], 0x1273ac07
mov dword [esi + 0xde4], 0x1273aa6f
mov dword [esi + 0xde8], 0x1273aad6
mov dword [esi + 0xdec], 0x1273ad3e
mov dword [esi + 0xdf0], 0x1273aa09
mov dword [esi + 0xdf4], 0x1273aa23
mov dword [esi + 0xdf8], 0x1273a9e6
mov dword [esi + 0xdfc], 0x1275c4ff
mov dword [esi + 0xdae], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x12738248
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
mov dword [ebp + 0x14], ebx
pop ebx
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0x12722ac8
push dword [ebp - 4]
mov dword [ebp + 0xc], ebx
call edi
test eax, eax
jne 0x12738204
cmp dword [ebp + 8], ebx
jne 0x12738204
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0x12722ab8
push dword [ebp - 4]
mov dword [ebp + 0xc], ebx
call edi
test eax, eax
jne 0x1273823f
cmp dword [ebp + 8], ebx
jne 0x1273823f
cmp dword [ebp + 0x10], eax
jne 0x12738236
or dword [esi + 0xdae], 0xffffffff
jmp 0x1273823f
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xdae], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1273beed
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x12721580
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1273bf47
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1273bf47
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x1273bf47
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x407400
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x2b8
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push 0x104
push eax
mov dword [esp + 0x14], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407427
mov byte [esp + 0x10], al
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.004c5e20
add esp, 8
test eax, eax
je 0x40743e
mov byte [eax + 1], 0
push 0x104
lea edx, [esp + 0x14]
push str.characters_
push edx
call sub.storm.dll_Ordinal_503
lea eax, [esp + 0x10]
push 0x104
push 0x4ea868
push eax
call sub.storm.dll_Ordinal_503
mov al, byte [0x650bdc]
test al, al
mov eax, str..mpc
jne 0x407479
mov eax, str..spc
push 0x104
lea ecx, [esp + 0x14]
push eax
push ecx
call sub.storm.dll_Ordinal_503
lea edx, [esp + 0x114]
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40751b
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x114], 0x16
jne 0x407505
lea ecx, [esp + 0x140]
push 0x2e
push ecx
call fcn.004c5e20
add esp, 8
test eax, eax
je 0x4074cc
mov byte [eax], 0
lea edi, [esp + 0x140]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x19
jae 0x407505
lea edx, [esp + 0x254]
lea ecx, [esp + 0x140]
call fcn.00407170
test eax, eax
je 0x407505
lea edx, [esp + 0x254]
push edx
call dword [esp + 0x10]
lea eax, [esp + 0x114]
push eax
push esi
call ebp
test eax, eax
jne 0x4074a9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
add esp, 0x2b8
ret

Function at 0x4076c0
Capabilities:
Delete file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push 0x104
push eax
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4076e3
mov byte [esp + 4], al
lea ecx, [esp + 4]
push 0x5c
push ecx
call fcn.004c5e20
add esp, 8
test eax, eax
je 0x4076fa
mov byte [eax + 1], 0
push 0x104
lea edx, [esp + 8]
push str.characters_
push edx
call sub.storm.dll_Ordinal_503
lea eax, [esp + 4]
push 0x104
push esi
push eax
call sub.storm.dll_Ordinal_503
mov al, byte [0x650bdc]
test al, al
mov eax, str..mpc
jne 0x407731
mov eax, str..spc
push 0x104
lea ecx, [esp + 8]
push eax
push ecx
call sub.storm.dll_Ordinal_503
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
add esp, 0x104
ret
Function at 0x40c3f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc4
push ebp
push esi
mov esi, edx
mov ebp, ecx
test esi, esi
jne 0x40c410
push 0x57
call sub.storm.dll_Ordinal_465
pop esi
pop ebp
add esp, 0xc4
ret
push edi
push ebx
push 0x4fa7
call fcn.004c6320
add esp, 4
lea edi, [esp + 0x24]
mov ebx, 0x70
call fcn.004c6330
mov byte [edi], al
inc edi
dec ebx
jne 0x40c428
push 0
call fcn.004c5e90
add esp, 4
push eax
call fcn.004c6320
add esp, 4
xor eax, eax
xor ecx, ecx
cmp byte [eax + esi], 0
jne 0x40c452
xor eax, eax
mov dl, byte [eax + esi]
inc eax
mov byte [esp + ecx + 0x94], dl
inc ecx
cmp ecx, 0x40
jl 0x40c44a
xor ecx, ecx
call fcn.0049e500
lea eax, [esp + 0x10]
lea edx, [esp + 0x94]
push eax
xor ecx, ecx
call fcn.0049e270
call fcn.0049e220
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x94]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov eax, ecx
mov esi, 0x14
cdq
idiv esi
mov bl, byte [esp + ecx + 0x24]
mov dl, byte [esp + edx + 0x10]
xor bl, dl
mov byte [esp + ecx + 0x24], bl
inc ecx
cmp ecx, 0x70
jb 0x40c494
xor eax, eax
xor esi, esi
mov dword [esp + 0x10], eax
lea edi, [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
push edi
mov edx, ebp
mov ecx, esi
call fcn.00464bf0
mov ecx, esi
call fcn.0049e500
lea edx, [esp + 0x54]
mov ecx, esi
push 0
call fcn.0049e270
inc esi
add edi, 0x10
cmp esi, 3
jl 0x40c4ce
mov ecx, 0x1c
xor eax, eax
lea edi, [esp + 0x24]
pop ebx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
add esp, 0xc4
ret
Function at 0x419e50
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov eax, dword [ecx + 0x5c]
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0xc]
xor esi, esi
push edi
mov si, word [eax + 0x64]
mov dx, word [ecx + 0x16]
mov cx, word [ecx + 0x14]
lea eax, [esi*8 + 0x6af898]
mov si, dx
sub si, word [eax + 2]
mov word [esp + 0x1a], si
mov di, word [eax + 6]
add di, dx
mov dx, cx
mov word [esp + 0x1e], di
sub dx, word [eax]
movsx ebp, si
mov word [esp + 0x18], dx
mov ax, word [eax + 4]
add ax, cx
movsx ebx, ax
movsx ecx, dx
sub ebx, ecx
sar ebx, 2
add dx, bx
sub ax, bx
mov word [esp + 0x18], dx
mov word [esp + 0x1c], ax
movsx ecx, di
movsx eax, ax
movsx edx, dx
sub ecx, ebp
sub eax, edx
sar ecx, 2
cdq
add si, cx
sub eax, edx
mov word [esp + 0x1a], si
sub di, cx
mov ecx, dword [esp + 0x18]
mov word [esp + 0x1e], di
sar eax, 1
add eax, ecx
mov word [esp + 0x14], ax
movsx eax, di
movsx ecx, si
mov esi, dword [esp + 0x1a]
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
add eax, esi
mov word [esp + 0x16], ax
mov eax, dword [edx + 0xc]
mov cx, word [eax + 0x14]
mov word [esp + 0x10], cx
mov dx, word [eax + 0x16]
lea eax, [esp + 0x18]
mov word [esp + 0x12], dx
push eax
lea edx, [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.0048b5f0
test eax, eax
je 0x419f55
movsx ecx, word [esp + 0x10]
mov edx, dword [esp + 0x24]
movsx eax, word [esp + 0x12]
mov dword [edx], ecx
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
movsx edx, word [esp + 0x14]
mov eax, dword [esp + 0x24]
pop edi
movsx ecx, word [esp + 0x12]
mov dword [eax], edx
mov edx, dword [esp + 0x24]
pop esi
pop ebp
mov dword [edx], ecx
pop ebx
add esp, 0x10
ret 8
Function at 0x441300
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov ebx, edx
push ebp
push 0x4e58b8
mov esi, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
push 0x1c
push edx
mov dword [eax], 0
push esi
mov dword [ecx], 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4413f0
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x441357
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44137b
push ebp
push 0x4e58b8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
test edi, edi
je 0x4413f0
cmp word [edi], 0x5a4d
jne 0x4413f0
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4413f0
mov ecx, dword [eax + edi]
add eax, edi
cmp ecx, 0x4550
jne 0x4413f0
xor ecx, ecx
xor ebx, ebx
mov cx, word [eax + 0x14]
mov bx, word [eax + 6]
sub esi, edi
xor ebp, ebp
test ebx, ebx
lea ecx, [ecx + eax + 0x18]
mov edi, esi
jbe 0x4413f0
lea eax, [ecx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ecx, dword [eax - 4]
cmp edx, esi
ja 0x4413c5
mov edx, esi
add edx, ecx
cmp edi, ecx
jb 0x4413cf
cmp edi, edx
jbe 0x4413e1
inc ebp
add eax, 0x28
cmp ebp, ebx
jb 0x4413b7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
inc ebp
sub edi, ecx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x446c80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [0x63c53c], 1
mov byte [0x63c540], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x63c530], eax
mov byte [ebp - 8], 0
mov dword [ebp - 4], 0
xor eax, eax
mov al, byte [0x63c548]
test eax, eax
je 0x446d8b
mov ecx, 3
call fcn.00440a80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov cl, byte [0x63c540]
test ecx, ecx
je 0x446cda
jmp 0x446cf7
mov eax, dword [0x63c530]
sub eax, dword [ebp - 0xc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xc8
jle 0x446cf7
mov edx, dword [ebp - 0xc]
mov dword [0x63c530], edx
call fcn.0043f210
mov eax, dword [0x63c52c]
add eax, dword [ebp - 0xc]
cmp eax, 0xa
jbe 0x446d20
mov ecx, dword [ebp - 0xc]
not ecx
add ecx, 1
mov dword [0x63c52c], ecx
call fcn.0049c800
mov byte [ebp - 8], 1
call fcn.00475640
call fcn.00469850
call fcn.0046e360
mov edx, dword [ebp - 0xc]
sub edx, dword [0x63c530]
test edx, edx
jl 0x446d4c
call fcn.00446de0
mov byte [ebp - 8], 1
mov dword [ebp - 4], 1
call fcn.00446d90
cmp dword [0x63b3a4], 0
jne 0x446d66
mov eax, dword [ebp - 8]
and eax, 0xff
test eax, eax
je 0x446d79
mov dword [0x63b3a4], 0
mov byte [ebp - 8], 0
call fcn.004da7d0
cmp dword [ebp - 4], 0
je 0x446d86
mov dword [ebp - 4], 0
jmp 0x446caa
mov esp, ebp
pop ebp
ret

Function at 0x446d90
Capabilities:
Check for time delay via gettickcount

Disassembly:
call fcn.004aa940
call fcn.0047cc20
mov eax, dword [0x64e4ac]
test eax, eax
je 0x446dd4
mov eax, dword [0x4f9500]
test eax, eax
je 0x446dd4
call fcn.0047b700
test eax, eax
jne 0x446dd4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x63c54c]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x14
jb 0x446dd4
mov dword [0x63c54c], eax
call fcn.004d3b30
jmp 0x469e40
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov edi, eax
xor esi, esi
lea eax, [esi + esi*2]
lea eax, [eax + eax*8]
lea eax, [esi + eax*4]
cmp byte [eax*2 + 0x64e600], bl
je 0x469f14
mov edx, dword [esi*4 + 0x64f118]
mov ecx, edi
sub ecx, edx
js 0x469f14
cmp esi, 0xc
mov byte [eax*2 + 0x64e600], bl
jne 0x469ea1
mov edx, dword [0x64f154]
and edx, 0xffff
add edx, 0x127
push edx
push 0x276
mov edx, 0x127
jmp 0x469f0a
cmp esi, 0xb
jl 0x469ec5
mov eax, dword [0x64f154]
mov edx, 0x18
and eax, 0xffff
mov ecx, 0x1a4
add eax, 0x18
push eax
push 0x26c
jmp 0x469f0f
mov ecx, dword [0x64f14c]
mov eax, esi
and ecx, 0xff
sub eax, ecx
mov ecx, 0xb
add eax, 0xb
cdq
idiv ecx
mov ecx, dword [0x64f154]
mov eax, edx
mov edx, dword [0x64f150]
and edx, 0xffff
imul eax, edx
and ecx, 0xffff
lea edx, [ecx + eax + 0x70]
push edx
push 0x276
lea edx, [eax + 0x70]
mov ecx, 0xa
call fcn.004d2f40
inc esi
cmp esi, 0xd
jl 0x469e4f
pop edi
pop esi
pop ebx
ret
Function at 0x446f70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov cl, byte [0x63c53c]
sub cl, 1
mov byte [0x63c53c], cl
xor edx, edx
mov dl, byte [0x63c53c]
test edx, edx
jle 0x446fa6
mov eax, 1
jmp 0x447098
call fcn.00474900
test eax, eax
jne 0x446fda
mov byte [0x63c53c], 1
xor eax, eax
mov al, byte [0x63c540]
test eax, eax
jne 0x446fd3
mov byte [0x63c540], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x63c550], eax
xor eax, eax
jmp 0x447098
xor ecx, ecx
mov cl, byte [0x63c540]
test ecx, ecx
je 0x447057
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x63c550]
mov dword [0x63c550], eax
cmp dword [0x63c550], 0x64
jae 0x447023
mov edx, dword [0x6b3e18]
xor eax, eax
mov al, byte [edx + 0x4e58c4]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [0x63c530]
add ecx, eax
mov dword [0x63c530], ecx
jmp 0x447057
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov edx, dword [0x6b3e18]
xor eax, eax
mov al, byte [edx + 0x4e58c4]
mov edx, dword [0x6b3e18]
xor ebx, ebx
mov bl, byte [edx + 0x63c524]
imul eax, ebx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [0x63c530], ecx
mov byte [0x63c540], 0
mov eax, dword [0x6b3e18]
mov cl, byte [eax + 0x63c524]
mov byte [0x63c53c], cl
xor edx, edx
mov dl, byte [0x650bdc]
test edx, edx
je 0x447093
mov eax, dword [ebp - 4]
mov dword [eax], 1
call fcn.00410440
call fcn.0046bc10
call fcn.00478b90
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x447290
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, edx
mov ebp, ecx
call fcn.0047e260
cmp ebp, esi
ja 0x4104c3
sub esi, ebp
lea edi, [ebp*4 + 0x59e080]
inc esi
mov ebx, esi
mov esi, dword [edi]
test esi, esi
je 0x4104bd
mov al, byte [0x65098c]
mov cl, byte [esi + 0xc]
test al, cl
je 0x4104b6
mov ecx, esi
call fcn.0047e280
mov esi, dword [esi + 4]
test esi, esi
jne 0x4104a3
add edi, 4
dec ebx
jne 0x41049d
mov eax, dword [0x59de70]
test eax, eax
je 0x410569
mov ecx, 0x40
xor eax, eax
mov edi, 0x59e488
mov dword [0x59de70], 0
rep stosd dword es:[edi], eax
mov ecx, 0x59e488
mov esi, 0x59e080
mov eax, dword [esi]
test eax, eax
je 0x410518
xor edx, edx
mov dx, word [eax + 8]
mov bl, byte [edx + 0x59de78]
test bl, bl
je 0x410511
mov dl, byte [eax + 0xc]
mov bl, byte [ecx]
xor bl, dl
mov byte [ecx], bl
mov eax, dword [eax + 4]
test eax, eax
jne 0x4104f8
add esi, 4
inc ecx
cmp esi, 0x59e480
jb 0x4104f2
lea esi, [ebp + 0xd]
cmp esi, 0x100
jb 0x410534
mov esi, 0xff
xor ecx, ecx
cmp ebp, esi
mov eax, ebp
ja 0x41054f
xor edx, edx
mov dl, byte [eax + 0x587dd8]
xor edx, ecx
inc eax
rol edx, 1
cmp eax, esi
mov ecx, edx
jbe 0x41053c
mov eax, ecx
mov dword [0x5879d0], ebp
shr eax, 0x10
xor ecx, eax
mov edx, ecx
shr edx, 8
xor ecx, edx
mov byte [0x59de74], cl
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.00446b10
test eax, eax
je 0x4472dc
xor eax, eax
mov ax, word [0x4fef3a]
lea ecx, [eax - 4]
lea edx, [eax + 0x194]
test ecx, ecx
mov dword [0x63c55c], ecx
mov dword [0x63c564], edx
jge 0x4472c2
xor ecx, ecx
mov dword [0x63c55c], ecx
xor eax, eax
mov ax, word [0x4fef3e]
cmp edx, eax
jl 0x4472d7
lea edx, [eax - 1]
mov dword [0x63c564], edx
jmp 0x410480
ret
Function at 0x44c7c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, edx
mov edi, ecx
mov edx, dword [esp + 0x14]
mov ecx, eax
call fcn.004492c0
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0x409
push edi
call ebp
test esi, esi
mov ebx, eax
je 0x44c848
cmp byte [esi + 0x12], 1
je 0x44c7fe
mov ax, word [esi]
cmp ax, 0xe
je 0x44c7fe
cmp ax, 0x10
jne 0x44c848
mov si, word [esi]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
sub si, 0x10
neg si
sbb esi, esi
and esi, 0xfffffffe
add esi, 6
push esi
push 1
push 0x405
push ebx
call ebp
and esi, 0xffff
shl esi, 0x10
or esi, 4
push ebx
push esi
push 0x114
push edi
call ebp
push 0
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x44c851
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [0x63d65c]
mov ecx, dword [0x63d658]
call fcn.00449d60
test eax, eax
je 0x44c87d
push 5
push 0x3f9
push edi
call ebp
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
jmp 0x44c892
push 0
push 0x3f9
push edi
call ebp
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 0
push 0x406
push edi
call ebp
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x147
push 0x3f1
push edi
call esi
cmp eax, 0xffffffff
je 0x44c8d0
push 0
push eax
push 0x150
push 0x3f1
push edi
call esi
mov ecx, eax
call fcn.0045c0c0
pop edi
pop esi
pop ebp
pop ebx
ret 4