joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ebx, ebx
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx]
lea ebp, [ebx + 0x6e667871]
xor ebp, edi
mov edi, ebp
and edi, 1
xor ebp, 1
lea ecx, [edi*2]
add ecx, ebp
add cl, 0xca
mov byte [esp + ebx], cl
mov ecx, ebx
xor eax, 1
add eax, ebx
and ebx, 1
and ecx, 6
add eax, ebx
sub eax, ecx
mov ebx, eax
cmp eax, 7
jb 0x43f3e0
mov eax, dword [esp]
mov ebx, dword [0x44b064]
test ebx, ebx
je 0x43f46e
xor ebp, ebp
mov edi, dword [0x44b068]
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x43f440
inc ebp
cmp ebx, ebp
jne 0x43f430
jmp 0x43f46e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f46e
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44b06c]
call fcn.0043c950
add esp, 0x30
cmp eax, 0x103
jne 0x43f519
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
mov eax, ecx
movzx edx, byte [esp + ecx]
lea esi, [ecx + 0x6e667871]
xor esi, edx
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xca
mov byte [esp + ecx], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 6
add eax, ecx
sub eax, edx
mov ecx, eax
cmp eax, 7
jb 0x43f490
mov eax, dword [esp]
mov ecx, dword [0x44b064]
test ecx, ecx
je 0x43f511
xor edx, edx
mov edi, dword [0x44b068]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x43f4f0
inc edx
cmp ecx, edx
jne 0x43f4e0
jmp 0x43f511
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f511
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44b06c]
call fcn.0043c950
add esp, 0x18
test eax, eax
js 0x43f519
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43f527
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100010b6
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
lea eax, [ebp - 0xa8]
push ebx
push eax
mov dword [ebp - 0xa8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1000119e
cmp dword [ebp - 0x98], 2
jne 0x1000119e
cmp dword [ebp - 0xa4], 6
jb 0x1000119e
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
push ecx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000119e
push esi
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edi
push eax
push ebx
push ebx
push 0x19
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1000118e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000118e
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1000118e
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 0x19
push dword [ebp - 8]
call esi
test eax, eax
je 0x10001187
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov al, byte [eax]
dec al
movzx eax, al
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
cmp dword [eax], 0x3000
jb 0x10001187
mov dword [ebp - 4], 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], ebx
pop edi
pop esi
jne 0x100011a2
xor eax, eax
jmp 0x100011f6
lea eax, [ebp - 0x10]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100011f4
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x1000c368
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100011eb
cmp dword [ebp - 4], ebx
je 0x100011eb
push 1
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret

Function at 0x100019a5
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.10004c14
test eax, eax
pop ecx
jle 0x100019cc
mov ecx, dword [esp + 4]
mov dx, word [ecx]
xor dx, 0x4d
sub edx, 0xff
mov word [ecx], dx
inc ecx
inc ecx
dec eax
jne 0x100019b7
ret

Function at 0x100019cd
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.10004370
pop ecx
xor ecx, ecx
test eax, eax
jle 0x100019e8
xor byte [ecx + esi], 0xf
inc ecx
cmp ecx, eax
jl 0x100019df
pop esi
ret
Function at 0x1000270d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x10002727
xor esi, esi
jmp 0x10002755
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.10004d50
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x10002790
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x10002789
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10002825
xor esi, esi
jmp 0x10002825
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x100027b3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x100027c6
xor esi, esi
jmp 0x1000281c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x100027d8
jmp 0x100027a3
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1000281c
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [esi + eax], bl
je 0x1000280e
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.10004d50
lea eax, [esi + 1]
mov edi, esp
push eax
push dword [ebp + 8]
push edi
call fcn.10004890
add esp, 0xc
mov byte [edi + esi], bl
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.1000288c
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10003242
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.10003204
mov edi, eax
cmp edi, esi
je 0x10003282
cmp dword [ebp - 4], esi
je 0x1000327b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000331f
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x100032f3
lea eax, [ebp - 0x114]
lea ecx, [ebp - 4]
push eax
call fcn.10003242
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x100032e0
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 4]
jmp 0x100032a5
cmp dword [ebp - 4], esi
je 0x100032ee
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x1000331f
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10003306
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x1000331d
push dword [ebp - 4]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10003326
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.10004d50
push ebx
push esi
lea eax, [ebp - 0x2014]
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x14], esi
call fcn.100029e5
xor edi, edi
cmp eax, edi
jl 0x100034de
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.100034eb
pop ecx
test eax, eax
pop ecx
jne 0x10003371
mov eax, 0x80020009
jmp 0x100034de
mov ecx, esi
call fcn.100029bd
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.100029e5
cmp eax, edi
jl 0x100034de
movzx eax, word [ebp - 0xa]
sub eax, 8
je 0x100034a6
sub eax, 9
je 0x1000340b
dec eax
dec eax
jne 0x100034cd
lea eax, [ebp - 0x1014]
test eax, eax
jne 0x100033b6
xor ebx, ebx
jmp 0x100033eb
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.10004d50
mov ebx, esp
push esi
push ebx
lea eax, [ebp - 0x1014]
push 0xffffffffffffffff
push eax
push edi
push edi
mov word [ebx], di
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push ebx
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x10]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x100034be
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, 1
mov dword [ebp - 8], eax
jne 0x10003447
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10004d50
mov dword [ebp - 4], esp
push ebx
push edi
push dword [ebp - 4]
call fcn.100051f0
add esp, 0xc
cmp dword [ebp - 4], edi
jne 0x10003451
mov eax, 0x80004005
jmp 0x100034de
cmp dword [ebp - 8], 0
jle 0x1000348b
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov al, byte [ebp + edi - 0x1014]
push eax
call fcn.10003572
pop ecx
mov ecx, edi
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x10003457
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 4]
mov eax, dword [eax]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edi, edi
jmp 0x100034cd
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1014]
push eax
push 1
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.100029e5
cmp eax, edi
jl 0x100034de
xor eax, eax
lea esp, [ebp - 0x2020]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10006dac
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10006d23
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10006d41
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10006d9f
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10006d86
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10006d8f
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10006d99
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10006d7b
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10006d05
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x10006ee5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x17af0001], ebp
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10006611
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
add al, 0
add byte [eax], al
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
invalid
Function at 0x4027d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443005
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45703c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
lea eax, [edi + 4]
xorps xmm0, xmm0
mov dword [edi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 4]
push eax
call dword [0x4474fc]
add esp, 8
mov dword [ebp - 4], 0
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
mov dword [edi + 0xc], eax
lea eax, [ebx + 0x14]
mov dword [edi + 0x10], ecx
lea ecx, [edi + 0x14]
push eax
call fcn.00402160
mov dword [edi], vtable.boost::thread_resource_error.0
lea esi, [edi + 0x2c]
mov dword [ebp - 4], 1
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x30]
mov dword [ebp + 8], esi
mov dword [esi + 4], ecx
test ecx, ecx
je 0x402869
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x34]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x38]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x10], eax
mov eax, edi
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x402d00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4430cd
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x45703c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov esi, dword [ebp + 0xc]
lea eax, [edi + 4]
push eax
mov dword [edi], vtable.std::exception.0
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call dword [0x4474fc]
add esp, 8
mov dword [ebp - 4], 0
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [edi + 0x10], ecx
lea ecx, [edi + 0x14]
push eax
call fcn.00402160
mov dword [edi + 0x2c], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406230
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x45703c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x40627a
mov dword [edi], 0
mov eax, edi
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040c879
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x1c], 0
jg 0x40628a
jl 0x406259
cmp dword [esp + 0x18], 0
jbe 0x406259
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call ebx
test eax, eax
jne 0x4062b1
nop dword [eax]
inc esi
cmp esi, 3
ja 0x406259
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
je 0x4062a0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.0040ce10
mulsd xmm0, qword [0x44b358]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
movsd qword [esp + 0x10], xmm0
call fcn.0040ce10
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.0040cd00
mov ecx, dword [esp + 0x24]
mov dword [edi], eax
mov eax, edi
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c879
mov esp, ebp
pop ebp
ret
Function at 0x406910
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44377d
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x45703c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 8]
push ebx
push 0
push 0xf4240
push dword [eax + 4]
push dword [eax]
call fcn.00442d50
mov edi, ebx
pop ebx
nop
push 0
push 0xf4240
push edx
push eax
mov esi, ecx
call fcn.0040cc10
add eax, esi
push 0
push 0x3e8
adc edx, edi
push edx
push eax
call fcn.0040cc10
mov ebx, eax
mov dword [ebp - 0x38], edx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x406996
xorps xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
jmp 0x406a0a
cmp dword [ebp - 0x20], 0
jg 0x4069ae
jl 0x40698c
cmp dword [ebp - 0x24], 0
ja 0x4069ae
xorps xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
jmp 0x406a0a
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x2c]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x4069d0
inc esi
cmp esi, 3
ja 0x40698c
lea eax, [ebp - 0x2c]
push eax
call edi
test eax, eax
je 0x4069c0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
call fcn.0040ce10
mulsd xmm0, qword [0x44b358]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
movsd qword [ebp - 0x34], xmm0
call fcn.0040ce10
movsd xmm1, qword [ebp - 0x34]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.0040cd00
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
add ecx, ebx
mov edi, dword [ebp - 0x3c]
adc eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x44], ecx
mov ecx, edi
push eax
call fcn.0040b320
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040b2e0
add esp, 4
mov ecx, dword [eax]
cmp ecx, dword [esi]
je 0x406a71
lea eax, [ebp - 0x15]
mov ecx, edi
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0040afe0
neg al
sbb al, al
and al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040c879
mov esp, ebp
pop ebp
ret 4
sub esp, 8
lea ecx, [ebp - 0x70]
call fcn.004061d0
push eax
mov dword [ebp - 4], 0
call fcn.004024b0
int3

Function at 0x408250
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x45703c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa28
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.0040e98a
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c879
mov esp, ebp
pop ebp
ret
Function at 0x4082b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x45703c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x128]
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x108]
push 0x104
push eax
mov dword [ebp - 0x118], 0xaac56b
mov dword [ebp - 0x114], 0x11d0cd44
mov dword [ebp - 0x110], 0xc000c28c
mov dword [ebp - 0x10c], 0xee95c24f
mov dword [ebp - 0x128], 0x10
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x15c], 0x34
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 2
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0x200
mov dword [ebp - 0x130], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x108]
push str._wintrust.dll
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4083f7
push str.WinVerifyTrust
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x15c]
push ecx
lea ecx, [ebp - 0x118]
push ecx
push 0
call eax
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4083fd
mov esi, dword [ebp - 0x160]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.0040c879
mov esp, ebp
pop ebp
ret