joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1ff526
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
push dword [esp + 0x3c]
push ebp
push edx
push ecx
call fcn.001f542b
mov dword [esp + 0x34], 0x549fa2
xor esi, esi
mov dword [esp + 0x38], 0x3101fe
add esp, 0x10
mov dword [esp + 0x2c], 0x619cf0
xor edx, edx
mov dword [esp + 0x30], esi
mov edi, esi
mov dword [esp + 0x10], 0x967d
xor dword [esp + 0x10], 0xcc63c068
add dword [esp + 0x10], 0x1ff
shl dword [esp + 0x10], 1
xor dword [esp + 0x10], 0x98c69dd6
mov dword [esp + 0x38], 0xb8e5
shr dword [esp + 0x38], 8
shr dword [esp + 0x38], 0xc
mov eax, dword [esp + 0x38]
push 0x78
pop ecx
div ecx
mov dword [esp + 0x38], eax
xor dword [esp + 0x38], 0x1898
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x20], eax
mov ebx, dword [eax + ebp + 0x78]
add ebx, ebp
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
add eax, ebp
mov dword [esp + 0x1c], eax
add ecx, ebp
mov eax, dword [ebx + 0x24]
add eax, ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [ebx + 0x18], esi
jbe 0x1ff630
mov edx, dword [ecx + edi*4]
push dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
add edx, ebp
call fcn.00207a34
xor eax, 0x762b677b
pop ecx
cmp eax, dword [esp + 0x3c]
je 0x1ff604
mov ecx, dword [esp + 0x14]
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x1ff5da
jmp 0x1ff630
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
movzx eax, word [eax + edi*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, ebx
jb 0x1ff630
mov eax, dword [esp + 0x20]
mov eax, dword [eax + ebp + 0x7c]
add eax, ebx
cmp esi, eax
jae 0x1ff630
mov ecx, esi
call fcn.00207edc
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x202c11
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 0x14]
mov esi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push edx
push ecx
call fcn.001f542b
and dword [ebp - 0xc], 0
add esp, 0x18
and dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x430482
mov dword [ebp - 4], 0xa9de
shr dword [ebp - 4], 3
imul eax, dword [ebp - 4], 0x35
mov dword [ebp - 4], eax
xor dword [ebp - 4], 0x4643c
cmp ecx, 0x40
jae 0x202c60
xor eax, eax
jmp 0x202c85
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x202c5c
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x202c5c
movzx edx, word [eax + 0x18]
xor esi, esi
mov ecx, dword [ebp - 4]
cmp edx, ecx
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x205d65
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
push dword [esp + 0x3c]
mov ebx, edx
mov edx, ecx
push dword [esp + 0x3c]
mov dword [esp + 0x24], edx
push ebx
push edx
call fcn.001f542b
mov dword [esp + 0x3c], 0x1d278d
xor esi, esi
mov dword [esp + 0x40], esi
add esp, 0x10
mov dword [esp + 0x10], 0x8ea6
mov ebp, esi
imul eax, dword [esp + 0x10], 0xf
mov dword [esp + 0x10], eax
add dword [esp + 0x10], 0xfbcc
xor dword [esp + 0x10], 0x50c7df06
xor dword [esp + 0x10], 0x50ced575
mov dword [esp + 0x14], 0x5d4
xor dword [esp + 0x14], 0x5075cd52
add dword [esp + 0x14], 0xffffa7e1
xor dword [esp + 0x14], 0x507554a4
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x28], eax
mov edi, dword [eax + ebx + 0x78]
add edi, ebx
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add eax, ebx
mov dword [esp + 0x24], eax
add ecx, ebx
mov eax, dword [edi + 0x24]
add eax, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
cmp dword [edi + 0x18], esi
jbe 0x205e5b
mov eax, dword [ecx + ebp*4]
add eax, ebx
push eax
push dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
call fcn.002035c0
pop ecx
pop ecx
test eax, eax
je 0x205e35
mov ecx, dword [esp + 0x18]
inc ebp
mov edx, dword [esp + 0x1c]
cmp ebp, dword [edi + 0x18]
jb 0x205e0c
jmp 0x205e5b
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
movzx eax, word [eax + ebp*2]
mov esi, dword [esi + eax*4]
add esi, ebx
cmp esi, edi
jb 0x205e5b
mov ecx, dword [esp + 0x28]
xor eax, eax
mov ecx, dword [ecx + ebx + 0x7c]
add ecx, edi
cmp esi, ecx
cmovb esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x2061b9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
push ebx
push esi
push dword [esp + 0x84]
push dword [esp + 0x84]
push dword [esp + 0x84]
push dword [esp + 0x84]
push 0
push 3
push ecx
call fcn.001f542b
and dword [esp + 0x88], 0
xor edx, edx
mov dword [esp + 0x84], 0x15bbba
mov dword [esp + 0x44], 0x7e44
imul eax, dword [esp + 0x44], 0x56
push 0x3e
pop esi
push 0x2e
mov dword [esp + 0x48], eax
or dword [esp + 0x48], 0xe97810d5
xor dword [esp + 0x48], 0xe97a6add
mov dword [esp + 0x58], 0x50ea
shr dword [esp + 0x58], 9
shr dword [esp + 0x58], 8
xor dword [esp + 0x58], 0x8000
mov dword [esp + 0x2c], 0x7422
add dword [esp + 0x2c], 0xffff8791
xor dword [esp + 0x2c], 0x724a15f0
add dword [esp + 0x2c], 0xd05
xor dword [esp + 0x2c], 0x8db5db48
mov dword [esp + 0x60], 0x2edd
mov eax, dword [esp + 0x60]
div esi
xor edx, edx
mov dword [esp + 0x60], eax
xor dword [esp + 0x60], 0x5532
mov dword [esp + 0x44], 0xee3f
add dword [esp + 0x44], 0xffffe6cd
add dword [esp + 0x44], 0xffff5ce1
xor dword [esp + 0x44], 0x6965
mov dword [esp + 0x28], 0xa36d
shl dword [esp + 0x28], 0xc
add dword [esp + 0x28], 0x5d19
shr dword [esp + 0x28], 1
xor dword [esp + 0x28], 0x51bebf0
mov dword [esp + 0x5c], 0xa852
add dword [esp + 0x5c], 0xddb7
xor dword [esp + 0x5c], 0x19bba
mov dword [esp + 0x30], 0xa4e6
or dword [esp + 0x30], 0xa6d42a45
imul eax, dword [esp + 0x30], 0x22
pop esi
mov dword [esp + 0x2c], eax
shl dword [esp + 0x2c], 1
xor dword [esp + 0x2c], 0x507e3c16
mov dword [esp + 0x64], 0x2ce2
Function at 0x207a34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push dword [ebp + 8]
mov ebx, edx
push ebx
push ecx
call fcn.001f542b
and dword [ebp - 0xc], 0
add esp, 0xc
mov dword [ebp - 0x14], 0x35e2df
mov dword [ebp - 0x10], 0x52290
mov dword [ebp - 4], 0xdbb2
xor dword [ebp - 4], 0xd5385f4b
xor dword [ebp - 4], 0xd53884f9
mov dword [ebp - 8], 0x6576
add dword [ebp - 8], 0xfffffa8c
or dword [ebp - 8], 0x95d8e2a6
xor dword [ebp - 8], 0x95d8e2a0
mov dword [ebp - 8], 0xe475
shr dword [ebp - 8], 9
xor dword [ebp - 8], 0x62
cmp byte [ebx], 0
je 0x207af8
push esi
push edi
mov edi, dword [ebp - 4]
mov dword [ebp - 8], 0x6576
add dword [ebp - 8], 0xfffffa8c
or dword [ebp - 8], 0x95d8e2a6
xor dword [ebp - 8], 0x95d8e2a0
mov cl, byte [ebp - 8]
mov esi, dword [ebp - 4]
mov dword [ebp - 8], 0xe475
shr dword [ebp - 8], 9
xor dword [ebp - 8], 0x62
shl esi, cl
mov cl, byte [ebp - 8]
mov edx, dword [ebp - 4]
movsx eax, byte [ebx]
mov dword [ebp - 4], eax
add dword [ebp - 4], esi
shl edx, cl
add dword [ebp - 4], edx
sub dword [ebp - 4], edi
inc ebx
cmp byte [ebx], 0
jne 0x207aa3
pop edi
pop esi
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x207b8f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push esi
push edi
push eax
push dword [esp + 0x24]
push edx
push ecx
call fcn.001f542b
mov dword [esp + 0x34], 0x2399
lea edi, [eax + 4]
xor dword [esp + 0x34], 0xb4bbd3b6
add dword [esp + 0x34], 0xfffffbe3
xor dword [esp + 0x34], 0xb4bbb717
mov dword [esp + 0x20], 0xf668
or dword [esp + 0x20], 0x7255987b
xor dword [esp + 0x20], 0x7255e635
mov dword [esp + 0x1c], 0x6aea
add dword [esp + 0x1c], 0xffff3e88
xor dword [esp + 0x1c], 0xffff96c8
mov ecx, dword [eax]
mov eax, dword [edi]
add edi, 4
xor eax, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
add esp, 8
mov eax, dword [esp + 0x2c]
mov ecx, esi
call fcn.001f7b36
mov ebx, eax
mov dword [esp + 0x2c], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x207c94
shr esi, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x207c8b
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
mov byte [edx], cl
mov eax, ecx
shr eax, 8
lea edx, [edx + 4]
shr ecx, 0x10
mov byte [edx - 3], al
mov byte [edx - 2], cl
shr ecx, 8
inc ebp
mov byte [edx - 1], cl
cmp ebp, esi
jb 0x207c62
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
pop ebp
mov byte [ebx + eax], 0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x207c9d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push dword [esp + 0x30]
push edx
push ecx
call fcn.001f542b
mov dword [esp + 0x30], 0x3e4ab4
lea edi, [ecx + 4]
xor ebp, ebp
xor edx, edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x24], 0xc5f8
add dword [esp + 0x24], 0x6051
xor dword [esp + 0x24], 0x10c1f
mov dword [esp + 0x1c], 0x21c8
mov eax, dword [esp + 0x1c]
push 0x48
pop esi
div esi
xor edx, edx
mov dword [esp + 0x1c], eax
add dword [esp + 0x1c], 0xffffac68
xor dword [esp + 0x1c], 0xffffa2cd
mov dword [esp + 0x20], 0xf93e
mov eax, dword [esp + 0x20]
push 0xe
pop esi
div esi
mov dword [esp + 0x20], eax
xor dword [esp + 0x20], 0x4b7b
mov edx, dword [ecx]
mov eax, dword [edi]
add edi, 4
xor eax, edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add esp, 4
mov eax, dword [esp + 0x20]
lea ecx, [esi + esi]
call fcn.001f7b36
mov ebx, eax
mov dword [esp + 0x20], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x207dc9
shr esi, 2
xor eax, eax
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x207dbf
mov ebx, dword [esp + 0x1c]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
movzx eax, cl
mov word [edx], ax
mov eax, ecx
shr eax, 8
lea edx, [edx + 8]
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebp
mov word [edx - 4], ax
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, esi
jb 0x207d86
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov word [ebx + eax*2], cx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x52257093
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x79652781
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4a14f4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a15cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a15e8
push ebx
push 0x4a15f8
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a768
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004077c0
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a494
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a1576
mov ax, 0x83
call fcn.004a1118
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a14c8
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a157f
call fcn.004a14c8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a15d4
lea eax, [ebp - 4]
call fcn.00409a3c
pop eax
jmp eax

Function at 0x4a16e8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
jmp 0x4a17a5
cmp dword [esi + 0x10], 0x1000
jne 0x4a1793
test byte [esi + 0x15], 1
jne 0x4a1793
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1744
cmp ebp, 2
je 0x4a1744
cmp ebp, 0x10
je 0x4a1744
cmp ebp, 0x20
jne 0x4a1760
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a1760
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a1771
mov eax, dword [esi]
add eax, ebx
call fcn.004a16e0
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a1764
cmp byte [esp + 4], 0
je 0x4a1793
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a1719
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xc36e84
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00c36e84
ret
Function at 0x408f90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f44
test al, al
jne 0x408fb1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408ffd
xor eax, eax
push ebp
push 0x408fed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033e8
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ff4
lea eax, [ebp - 0xc]
call fcn.00408f80
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409304
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4093f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cc8
mov edx, dword [ebp - 8]
mov ecx, 0x40940c
xor eax, eax
call fcn.004091f8
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093c1
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409324
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408dac
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c58
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407258
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408d7c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404624
call fcn.00405854
call fcn.00402e88
jmp 0x409324
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093fa
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040318c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040318c
ret

Function at 0x4094ac
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409506
inc esi
xor edi, edi
cmp edi, 1
jne 0x4094d2
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4094e0
cmp edi, 1
jle 0x4094e0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408f90
test eax, eax
jne 0x409506
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409506
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409506
inc edi
dec esi
jne 0x4094c2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x409510
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x40955d
xor ebx, ebx
jmp 0x409552
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404c04
test eax, eax
jne 0x409551
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x40960d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409533
mov al, byte [ebp - 1]
sub al, 1
jb 0x409568
je 0x409571
jmp 0x40957a
call fcn.00406ff8
mov edi, eax
jmp 0x40957c
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x40957c
xor edi, edi
test di, di
je 0x40960d
xor ebx, ebx
jmp 0x4095b8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4095b7
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095ac
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4095b7
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40960d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409589
xor ebx, ebx
jmp 0x409602
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409601
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4095f6
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409601
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40960d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4095c7
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x62
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret
Function at 0x4023d0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4225d0]
xor eax, esp
mov dword [esp + 4], eax
push 0x41d3df
push dword [esp + 0x20]
call fcn.0040d63d
add esp, 8
mov dword [esp], eax
mov eax, 0x78c74688
mov ebp, 0x8be6f483
mov ebx, 0x920754fd
nop word cs:[eax + eax]
nop
cmp eax, 0xc1cc8e02
jle 0x4024e0
cmp eax, 0x3603c7ef
jg 0x402440
cmp eax, 0xc1cc8e03
je 0x40258b
cmp eax, 0x24cdd96c
jne 0x402410
jmp 0x4024c8
cmp eax, 0x3603c7f0
je 0x402468
cmp eax, 0x78c74688
jne 0x402410
cmp dword [esp], 0
mov eax, 0x3603c7f0
mov ecx, 0xae488a00
cmove eax, ecx
cmp eax, 0xc1cc8e02
jg 0x40241b
jmp 0x4024e0
push 2
push 0
push dword [esp + 8]
call fcn.0040da3a
add esp, 0xc
push dword [esp]
call fcn.0040dd5d
add esp, 4
mov esi, eax
push dword [esp]
call fcn.0040d4e8
add esp, 4
push 0x41d3df
push dword [esp + 0x20]
call fcn.0040d63d
add esp, 8
mov edi, eax
push esi
call fcn.0040e3b2
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
push edi
push esi
push 1
push eax
call fcn.0040d829
add esp, 0x10
push edi
call fcn.0040d4e8
add esp, 4
mov eax, 0xc1cc8e03
cmp eax, 0xc1cc8e02
jg 0x40241b
nop dword [eax + eax]
cmp eax, 0x8be6f483
je 0x402535
cmp eax, 0x920754fd
je 0x402547
cmp eax, 0xae488a00
jne 0x402410
mov eax, dword [0x422ff4]
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
mov eax, 0x8be6f483
sete cl
cmove eax, ebx
cmp dword [0x422ff8], 0xa
setl dl
cmovge eax, ebp
xor dl, cl
cmovne eax, ebx
cmp eax, 0xc1cc8e02
jg 0x40241b
jmp 0x4024e0
mov eax, 0x920754fd
cmp eax, 0xc1cc8e02
jg 0x40241b
jmp 0x4024e0
mov eax, dword [0x422ff4]
mov esi, 0x24cdd96c
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
mov eax, 0x8be6f483
sete cl
cmove eax, esi
cmp dword [0x422ff8], 0xa
setl dl
cmovge eax, ebp
xor dl, cl
cmovne eax, esi
cmp eax, 0xc1cc8e02
jg 0x40241b
jmp 0x4024e0
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00409263
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret