joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x403c58
push ebx
xor eax, eax
push ebp
push 0x403e28
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 9
mov eax, 0x403e3c
call fcn.0040303c
call sub.rtl70.bpl__System_ParamCount_qqrv
dec eax
jle 0x403d66
lea edx, [ebp - 8]
mov eax, 1
call sub.rtl70.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 8]
mov edx, 0x403e50
call sub.rtl70.bpl__System__LStrCmp_qqrv
je 0x403cc5
lea edx, [ebp - 0xc]
mov eax, 1
call sub.rtl70.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0xc]
mov edx, 0x403e5c
call sub.rtl70.bpl__System__LStrCmp_qqrv
jne 0x403d66
xor eax, eax
push ebp
push 0x403d5f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, 1
call sub.rtl70.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x10]
mov edx, 0x403e5c
call sub.rtl70.bpl__System__LStrCmp_qqrv
jne 0x403cfe
lea eax, [ebp - 4]
mov edx, 0x403e68
call sub.rtl70.bpl__System__LStrLAsg_qqrpvpxv
jmp 0x403d06
lea eax, [ebp - 4]
call sub.rtl70.bpl__System__LStrClr_qqrpv
mov eax, dword [ebp - 4]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
call fcn.0040392c
push 5
lea eax, [ebp - 0x14]
call fcn.00402f90
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 2
call sub.rtl70.bpl__System_ParamStr_qqri
mov edx, dword [ebp - 0x18]
pop eax
call sub.rtl70.bpl__System__LStrCat_qqrv
mov eax, dword [ebp - 0x14]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403dfe
mov eax, dword [sym.imp.vcl70.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl70.bpl__Forms_TApplication_Terminate_qqrv
ret
call sub.rtl70.bpl__System_ParamCount_qqrv
dec eax
jle 0x403d8a
lea edx, [ebp - 0x1c]
mov eax, 1
call sub.rtl70.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x1c]
mov edx, 0x403e7c
call sub.rtl70.bpl__System__LStrCmp_qqrv
je 0x403dfe
call sub.rtl70.bpl__System_ParamCount_qqrv
dec eax
jle 0x403de9
lea edx, [ebp - 0x20]
mov eax, 1
call sub.rtl70.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x20]
mov edx, 0x403e88
call sub.rtl70.bpl__System__LStrCmp_qqrv
jne 0x403de9
lea edx, [ebp - 0x24]
mov eax, 3
call sub.rtl70.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x24]
call fcn.0040352c
mov ebx, eax
push ebx
push ebx
push 0x468
lea edx, [ebp - 0x28]
mov eax, 2
call sub.rtl70.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x28]
call sub.rtl70.bpl__Sysutils_StrToInt_qqrx17System_AnsiString
push eax
call sub.user32.dll_PostMessageA
jmp 0x403dfe
call sub.rtl70.bpl__System_ParamCount_qqrv
test eax, eax
jne 0x403dfe
mov eax, dword [sym.imp.vcl70.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl70.bpl__Forms_TApplication_Terminate_qqrv
mov edx, 9
mov eax, 0x403e94
call fcn.0040303c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403e2f
lea eax, [ebp - 0x28]
mov edx, 0xa
call sub.rtl70.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x41fb30
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41fb36
ret
Function at 0x401260
Capabilities:
Parse credit card information

Disassembly:
add ecx, 0xfffffffe
cmp ecx, 8
ja case.default.0x40126c
jmp dword [ecx*4 + 0x40137c]
cmp al, 0x40
jne 0x40127d
mov eax, 4
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x40128c
cmp cl, 0x7a
jbe 0x4012dc
cmp al, 0x30
jl 0x401294
cmp al, 0x39
jle 0x4012dc
cmp al, 0x2d
je 0x4012dc
cmp al, 0x5f
je 0x4012dc
cmp al, 0x2e
je 0x4012dc
cmp al, 0x21
je 0x4012dc
cmp al, 0x7e
je 0x4012dc
cmp al, 0x2a
je 0x4012dc
cmp al, 0x27
je 0x4012dc
cmp al, 0x28
je 0x4012dc
cmp al, 0x29
je 0x4012dc
cmp al, 0x25
je 0x4012dc
cmp al, 0x3b
je 0x4012dc
cmp al, 0x3a
je 0x4012dc
cmp al, 0x26
je 0x4012dc
cmp al, 0x3d
je 0x4012dc
cmp al, 0x2b
je 0x4012dc
cmp al, 0x24
je 0x4012dc
cmp al, 0x2c
jne case.default.0x40126c
mov eax, 3
ret
cmp al, 0x5b
jne 0x4012ec
mov eax, 5
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x4012fb
cmp cl, 0x7a
jbe 0x40130b
cmp al, 0x30
jl 0x401303
cmp al, 0x39
jle 0x40130b
cmp al, 0x2e
je 0x40130b
cmp al, 0x2d
jne case.default.0x40126c
mov eax, 6
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x401320
cmp cl, 0x7a
jbe 0x40130b
cmp al, 0x30
jl 0x401328
cmp al, 0x39
jle 0x40130b
cmp al, 0x2e
je 0x40130b
cmp al, 0x2d
je 0x40130b
cmp al, 0x3a
jne case.default.0x40126c
mov eax, 9
ret
cmp al, 0x5d
jne case.0x40126c.5
mov eax, 8
ret
cmp al, 0x30
jl 0x40134c
cmp al, 0x39
jle 0x401363
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x40135b
cmp cl, 0x66
jbe 0x401363
cmp al, 0x3a
je 0x401363
cmp al, 0x2e
jne case.default.0x40126c
mov eax, 7
ret
sub al, 0x30
cmp al, 9
mov eax, 0xa
jbe 0x401379
mov eax, 1
ret
Function at 0x1000ae52
Capabilities:
Encode data using xor

Disassembly:
lcall 0x9809, 0x1c0f1e2c
out dx, eax
sbb edi, edx
salc
sub eax, 0xafa090b0
out 0x47, eax
invalid
add eax, 0xdc3ee0d9
or cl, byte [edi]
loopne 0x1000adfa
rcl byte [esi]
pavgb mm6, qword [ebp + 0x835aed5]
scasb al, byte es:[edi]
xor eax, 0xe9a80908
dec edx
and eax, 0xa2639010
invalid
cmp al, 0x10
invalid
adc byte [edx], al
das
popal
pop ss
insd dword es:[edi], dx
aam 0xd2
sub eax, 0x2d529010
xor byte [eax - 0x308579f], dl
rol byte [edi], cl
mov byte [0x2103c56], al
das
popal
pop ss
pop ss
insd dword es:[edi], dx
aam 0x6a
sub eax, 0x35429030
inc esp
or dword [edx + 0x40f062c], ebx
add al, 9
cwde
out dx, eax
sbb edi, edx
salc
sub eax, 0xaf409010
sub ebp, dword [edx + 0x4290102d]
das
sub al, 0xaf
and eax, dword [edi - 0x1c]
out dx, eax
cmp eax, 0x434549d4
std
rcl byte [eax + 0x3ccda3b3]
adc al, 2
movups xmm6, xmmword [edx]
pop ss
add eax, edx
bound ebp, qword [0x2519010]
and eax, 0xed509010
adc byte [eax + 0x2daaf471], dl
jo 0x1000ae51
arpl word [ebp - 0x10000ad], sp
pop ss
mov ch, 0xd0
pop edx
pop ss
insd dword es:[edi], dx
shl byte [esi + 0x35], 1
or al, 8
iretd

Function at 0x100668d5
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
cwde
mov al, 8
mov esi, 0xbf38dc55
cmc
pop eax
mov esi, 0x681615c5
mov ah, 0x50
mov ebx, dword [edi + 0x600f0ff]
arpl word [edi + edx + 0xe3c4350], di
mov ah, 0x2b
nop
add byte [eax], dl
add byte [esi], al
arpl word [edi + edx + 0x7cfbe030], di
mov bl, byte [edi]
xchg byte [eax], dl
mov eax, dword [0x4470fb00]
invalid
Function at 0x407970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44d2c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 4]
mov dword [esp + 8], esi
lea ecx, [eax + 0x10]
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], edi
mov dword [ecx], edi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edi
mov dword [esi], eax
mov dword [esi + 0x28], edi
push edi
push edi
push edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x20], edi
call fcn.00428f2d
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x407986
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44d2c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 4]
mov dword [esp + 8], esi
lea ecx, [eax + 0x10]
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], edi
mov dword [ecx], edi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edi
mov dword [esi], eax
mov dword [esi + 0x28], edi
push edi
push edi
push edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x20], edi
call fcn.00428f2d
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40a660
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x463318]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x40a673
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp word [esp + 0x10c], 1
je 0x40a6b5
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x4633c0]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x40a6e7
mov bl, byte [esp + ecx + 0x4c]
jmp 0x40a6eb
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x40a6dc
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x40a709
mov bl, byte [esp + ecx + 0x4c]
jmp 0x40a70d
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x40a6fe
xor ecx, ecx
mov eax, 0x463328
xor ebx, ebx
mov bl, byte [ecx + 0x4633d0]
cmp byte [esp + ebx + 0x14], 0
je 0x40a738
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x4633e8]
cmp byte [esp + ebx + 0x14], 0
je 0x40a74f
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x40a71f
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x40a6a7
lea edx, [esp + 0x84]
push edx
call fcn.0040a790
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x40b860
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0x34
push esi
push edi
mov al, 8
mov ecx, 5
mov esi, 0x463edc
lea edi, [esp + 0xc]
mov byte [esp + 0x2a], al
mov byte [esp + 0x2c], al
rep movsd dword es:[edi], dword [esi]
mov al, 3
mov cl, 0x1d
mov byte [esp + 0x32], al
mov byte [esp + 0x36], al
mov al, 0x8e
mov byte [esp + 0x28], cl
mov byte [esp + 0x35], cl
mov dword [esp + 8], 0
mov byte [esp + 0x20], 0x92
mov byte [esp + 0x21], 0x86
mov byte [esp + 0x22], 0xe2
mov byte [esp + 0x23], 0xd1
mov byte [esp + 0x24], 0xfb
mov byte [esp + 0x25], 0x44
mov byte [esp + 0x26], 0x29
mov byte [esp + 0x27], 0x40
mov byte [esp + 0x29], 0x31
mov byte [esp + 0x2b], 0x1b
mov byte [esp + 0x2d], 0x37
mov byte [esp + 0x2e], 0x82
mov byte [esp + 0x2f], 0x7a
mov byte [esp + 0x30], 0x52
mov byte [esp + 0x31], 0x76
mov byte [esp + 0x33], 0x78
mov byte [esp + 0x34], 0x77
mov byte [esp + 0x37], 0
mov byte [esp + 0x38], al
mov byte [esp + 0x39], 0xd7
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], 0
xor ecx, ecx
mov eax, ecx
mov esi, 0x13
cdq
idiv esi
mov al, byte [esp + edx + 0xc]
mov dl, byte [esp + ecx + 0x20]
xor dl, al
mov byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 0x1b
jl 0x40b90b
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x469aa0
call fcn.004353f3
mov edx, dword [0x469aa0]
mov eax, dword [edx - 8]
test eax, eax
jne 0x40b95f
mov esi, dword [esp + 0x40]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00435324
mov eax, esi
pop edi
pop esi
add esp, 0x34
ret 4
mov esi, dword [esp + 0x40]
push 0x469aa0
mov ecx, esi
call fcn.0043502b
mov eax, esi
pop edi
pop esi
add esp, 0x34
ret 4
Function at 0x40cad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x44d8c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0x40c390
push 0x40c3c0
lea ecx, [esp + 0x18]
call fcn.0041a440
mov dword [esp + 0x58], 0
xor edi, edi
mov esi, 0x463c58
mov eax, dword [esi]
push 0
push 1
push edi
push eax
lea ecx, [esp + 0x20]
call fcn.0041a600
add esi, 4
inc edi
cmp esi, 0x463c88
jl 0x40cb10
push 0x463f10
push 0x88
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0
lea ecx, [esp + 0x18]
call fcn.0041a480
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea esi, [ebx + 0x158]
mov dword [0x468a80], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40cc03
mov ebx, dword [esi]
mov ebp, dword [esi + 4]
cmp ebx, ebp
je 0x40cbcb
mov ecx, dword [esi]
mov edi, ebx
lea eax, [ebx + 4]
cmp edi, ecx
mov ebx, dword [eax]
jne 0x40cb9f
mov ecx, dword [ecx + 4]
mov dword [esi], ecx
mov dword [ecx], 0
jmp 0x40cbac
mov ecx, dword [edi]
mov edx, dword [eax]
mov dword [ecx + 4], edx
mov eax, dword [eax]
mov ecx, dword [edi]
mov dword [eax], ecx
mov ecx, dword [esi + 0x10]
dec ecx
test edi, edi
mov dword [esi + 0x10], ecx
je 0x40cbc7
mov ecx, edi
call fcn.0040fb70
push edi
call fcn.00435865
add esp, 4
cmp ebx, ebp
jne 0x40cb85
mov eax, dword [esi]
cmp ebp, eax
jne 0x40cbde
mov eax, dword [eax + 4]
mov dword [esi], eax
mov dword [eax], 0
jmp 0x40cbef
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 4]
mov edx, dword [ebp]
mov dword [ecx], edx
mov ecx, dword [esi + 0x10]
dec ecx
test ebp, ebp
mov dword [esi + 0x10], ecx
je 0x40cc03
push 1
mov ecx, ebp
call fcn.0040ffb0
lea ecx, [esp + 0x10]
mov dword [0x468a84], 0
call fcn.0041a740
push 0
push 0
push 1
mov ecx, esi
call fcn.0040f190
lea ecx, [esp + 0x10]
mov dword [esp + 0x58], 0xffffffff
call fcn.0041a4a0
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret

Function at 0x40e251
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x40e276
lea eax, [esp + 4]
push eax
push 0
push 0
push fcn.004112b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x64], eax
pop esi
pop ecx
ret

Function at 0x40e2b1
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x40e2d6
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x40e280
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
pop esi
pop ecx
ret
Function at 0x40eb40
Capabilities:
Create thread

Disassembly:
push ecx
mov al, byte [0x4679b0]
push ebx
test al, 1
mov ebx, ecx
jne 0x40eb75
or al, 1
push 0x40e7b0
push 0x40e320
mov ecx, 0x467970
mov byte [0x4679b0], al
call fcn.0041a440
push 0x40ebe0
call fcn.00429ed3
add esp, 4
push esi
push edi
xor edi, edi
mov esi, 0x463c88
mov eax, dword [esi]
push 0
push 1
push edi
push eax
mov ecx, 0x467970
call fcn.0041a600
add esi, 4
inc edi
cmp esi, 0x463cd4
jl 0x40eb7e
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x467970
push 0x40e870
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [0x469ac0], eax
test eax, eax
pop esi
je 0x40ebdc
mov edx, dword [ebx + 8]
mov ecx, 0x467970
push edx
call fcn.0041abb0
mov eax, dword [ebx + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop ebx
pop ecx
ret
Function at 0x410530
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
or ecx, 0xffffffff
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, esi
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp ecx, 4
jge 0x410580
mov edi, dword [esp + 0x28]
xor eax, eax
test ecx, ecx
jle 0x410574
mov bl, byte [esi]
mov dl, al
add dl, 7
xor dl, bl
mov byte [edi], dl
inc edi
inc esi
inc eax
cmp eax, ecx
jl 0x410562
mov byte [edi], 0
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x14
ret
test eax, eax
jle 0x4106e6
movsx ecx, byte [esp + 0x24]
mov dword [esp + 0x2c], eax
lea eax, [eax + eax*2]
lea edx, [ecx*8]
push ebp
sub edx, ecx
mov dword [esp + 0x20], eax
lea edi, [edx*4 + 0x46dd50]
mov bl, byte [esi]
mov ecx, dword [edi + 4]
inc esi
mov byte [esp + 0x10], bl
test ecx, ecx
je 0x4105e4
mov eax, dword [esp + 0x10]
xor edx, edx
and eax, 0xff
div dword [edi + 8]
mov edx, dword [ecx + edx*4]
test edx, edx
je 0x4105e4
cmp byte [edx + 8], bl
je 0x4105d9
mov edx, dword [edx]
test edx, edx
jne 0x4105cc
jmp 0x4105e4
test edx, edx
je 0x4105e4
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov bl, byte [esi]
mov ebp, dword [edi + 4]
mov byte [esp + 0x14], bl
shl ecx, 0x12
inc esi
test ebp, ebp
je 0x410627
mov eax, dword [esp + 0x14]
xor edx, edx
and eax, 0xff
div dword [edi + 8]
mov edx, dword [ebp + edx*4]
test edx, edx
je 0x410627
cmp byte [edx + 8], bl
je 0x41061c
mov edx, dword [edx]
test edx, edx
jne 0x41060f
jmp 0x410627
test edx, edx
je 0x410627
mov edx, dword [edx + 0xc]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov bl, byte [esi]
mov ebp, dword [edi + 4]
mov byte [esp + 0x18], bl
shl eax, 0xc
add ecx, eax
inc esi
test ebp, ebp
je 0x41066c
mov eax, dword [esp + 0x18]
xor edx, edx
and eax, 0xff
div dword [edi + 8]
mov edx, dword [ebp + edx*4]
test edx, edx
je 0x41066c
cmp byte [edx + 8], bl
je 0x410661
mov edx, dword [edx]
test edx, edx
jne 0x410654
jmp 0x41066c
test edx, edx
je 0x41066c
mov edx, dword [edx + 0xc]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov bl, byte [esi]
mov ebp, dword [edi + 4]
mov byte [esp + 0x1c], bl
shl eax, 6
add ecx, eax
inc esi
test ebp, ebp
je 0x4106b1
mov eax, dword [esp + 0x1c]
xor edx, edx
and eax, 0xff
div dword [edi + 8]
mov edx, dword [ebp + edx*4]
test edx, edx
je 0x4106b1
cmp byte [edx + 8], bl
je 0x4106a6
mov edx, dword [edx]
test edx, edx
jne 0x410699
jmp 0x4106b1
test edx, edx
je 0x4106b1
mov edx, dword [edx + 0xc]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
add ecx, edx
mov edx, ecx
sar edx, 0x10
mov byte [eax], dl
mov edx, ecx
inc eax
sar edx, 8
mov byte [eax], dl
inc eax
mov byte [eax], cl
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
dec eax
mov dword [esp + 0x30], eax
jne 0x4105a9
mov ebx, dword [esp + 0x20]
pop ebp
mov eax, dword [esp + 0x28]
pop edi
pop esi
mov byte [eax], 0
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x413160
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x413173
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x14], 0
pop esi
ret

Function at 0x413180
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00413160
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x412f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x14], eax
je 0x4131b0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, esi
call fcn.004131c0
pop esi
pop ecx
ret

Function at 0x413181
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00413160
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x412f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x14], eax
je 0x4131b0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, esi
call fcn.004131c0
pop esi
pop ecx
ret

Function at 0x413430
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
call fcn.00413710
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41344f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x10], 0
mov ecx, esi
call fcn.00413730
mov ecx, esi
call fcn.00413270
pop esi
ret

Function at 0x413460
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00413430
test eax, eax
je 0x413478
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.004132e0
test eax, eax
jne 0x413486
pop esi
pop ecx
ret
lea eax, [esp + 4]
mov dword [esi + 0x203c], 0
push eax
push 0
push esi
push 0x412d80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x10], eax
jne 0x4134c7
mov ecx, esi
call fcn.00413430
mov dword [esi + 0x203c], 2
mov eax, 1
pop esi
pop ecx
ret
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x4135c0
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
push edi
mov edi, ecx
call fcn.00413710
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x1c]
mov ebp, eax
test esi, esi
mov dword [esp + 0x1c], esi
je 0x413655
push ebx
mov ebx, dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x24]
sub eax, ebp
cmp eax, ecx
ja 0x413654
mov ecx, dword [edi + 0x202c]
lea eax, [esp + 0x14]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [edi + 0x202c]
lea edx, [esp + 0x10]
push 0
push edx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x413632
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x413650
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x469b5c]
mov ebp, eax
mov eax, dword [esp + 0x10]
add ebx, eax
sub esi, eax
add ecx, eax
mov dword [0x469b5c], ecx
test esi, esi
jne 0x4135e6
pop ebx
mov ecx, edi
call fcn.00413730
mov eax, dword [esp + 0x1c]
pop edi
sub eax, esi
pop esi
pop ebp
add esp, 8
ret 0xc
Function at 0x414b30
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x44e17e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
mov dword [edi], 0x452d60
mov dword [esp + 0x28], 0
lea esi, [edi + 0x534]
mov dword [esp + 0x10], esi
push ecx
lea ebp, [esi + 0x124]
mov eax, esp
push ecx
mov ecx, esp
mov byte [esp + 0x30], 0xc
mov dword [eax], ebp
mov eax, dword [ebp + 4]
push eax
call fcn.004288c0
mov ecx, ebp
call fcn.004161c0
lea ecx, [esi + 0x120]
mov byte [esp + 0x28], 0xb
call fcn.004352b6
lea ecx, [esi + 0x11c]
mov byte [esp + 0x28], 0xa
call fcn.004352b6
lea ecx, [esi + 0x118]
mov byte [esp + 0x28], 9
call fcn.004352b6
lea ecx, [esi + 0xdc]
mov byte [esp + 0x28], 8
call fcn.00445436
lea ecx, [esi + 0xa0]
mov byte [esp + 0x28], 7
call fcn.00445436
lea ecx, [esi + 0x64]
mov byte [esp + 0x28], 6
call fcn.0044551b
mov ecx, esi
mov byte [esp + 0x28], 5
call fcn.004359ea
lea ebp, [edi + 0x45c]
mov dword [esp + 0x18], ebp
lea ecx, [ebp + 0x98]
mov byte [esp + 0x28], 0xd
call fcn.0044551b
lea esi, [ebp + 0x5c]
mov dword [esp + 0x1c], esi
mov eax, dword [esi + 0x10]
mov byte [esp + 0x28], 0xf
test eax, eax
je 0x414c40
mov eax, dword [esi]
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 4]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.00406fb0
mov eax, dword [esi + 0xc]
mov byte [esp + 0x28], 0xe
test eax, eax
je 0x414c55
push eax
call fcn.00435865
add esp, 4
mov ecx, ebp
mov dword [esi + 0xc], 0
mov byte [esp + 0x28], 4
call fcn.004359ea
lea esi, [edi + 0x340]
mov dword [esp + 0x1c], esi
lea ecx, [esi + 0x118]
mov byte [esp + 0x28], 0x14
call fcn.004352b6
lea ecx, [esi + 0x114]
mov byte [esp + 0x28], 0x13
call fcn.004352b6
lea ecx, [esi + 0x110]
mov byte [esp + 0x28], 0x12
call fcn.004352b6
lea ecx, [esi + 0xd4]
mov byte [esp + 0x28], 0x11
call fcn.00445436
lea ecx, [esi + 0x98]
mov byte [esp + 0x28], 0x10
call fcn.004339a8
lea ebp, [esi + 0x5c]
mov dword [esp + 0x18], ebp
mov eax, dword [ebp + 0x10]
mov byte [esp + 0x28], 0x16
test eax, eax
je 0x414cf4
mov eax, dword [ebp]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, ebp
call fcn.00406fb0
lea ecx, [ebp + 4]
mov byte [esp + 0x28], 0x15
call fcn.00406f90
mov ecx, esi
mov byte [esp + 0x28], 3
call fcn.004359ea
lea esi, [edi + 0x230]
mov dword [esp + 0x1c], esi
lea ecx, [esi + 0xd4]
mov byte [esp + 0x28], 0x18
call fcn.004339a8
lea ecx, [esi + 0x98]
mov byte [esp + 0x28], 0x17
call fcn.00445436
lea ebp, [esi + 0x5c]
mov dword [esp + 0x18], ebp
mov ecx, ebp
mov byte [esp + 0x28], 0x1a
call fcn.00406e00
lea ecx, [ebp + 4]
mov byte [esp + 0x28], 0x19
call fcn.00406f90
mov ecx, esi
mov byte [esp + 0x28], 2
call fcn.004359ea
lea ecx, [edi + 0x138]
mov byte [esp + 0x28], 1
call fcn.00418360
lea ecx, [edi + 0xbc]
mov byte [esp + 0x28], 0
call fcn.0044a3e0
mov ecx, edi
mov dword [esp + 0x28], 0xffffffff
call fcn.004456a4
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret