joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498480
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x498488
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x498641
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49861c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4136e8]
call fcn.00403b7c
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 8]
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
call fcn.0040911c
sub eax, 1
jb 0x4984ff
je 0x498544
dec eax
je 0x498589
dec eax
je 0x4985cb
jmp 0x49860b
push 1
push 0
lea ecx, [ebp - 0xc]
mov edx, 2
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.00404e5c
push eax
lea ecx, [ebp - 0x10]
mov edx, 1
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00404e5c
push eax
push 0x498650
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x49860b
push 0
push 0
lea ecx, [ebp - 0x14]
mov edx, 2
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00404e5c
push eax
lea ecx, [ebp - 0x18]
mov edx, 1
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00404e5c
push eax
push 0x498650
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x49860b
push 3
push 0
lea ecx, [ebp - 0x1c]
mov edx, 2
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.00404e5c
push eax
lea ecx, [ebp - 0x20]
mov edx, 1
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00404e5c
push eax
push 0x498650
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x49860b
push 6
push 0
lea ecx, [ebp - 0x24]
mov edx, 2
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x24]
call fcn.00404e5c
push eax
lea ecx, [ebp - 0x28]
mov edx, 1
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.00404e5c
push eax
push 0x498650
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.00403bac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498626
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498648
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004049c0
ret
Function at 0x49bba8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x49bc52
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49bc32
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e5c
push eax
push 0
call sub.user32.dll_SetFocus
test bl, bl
je 0x49bc04
mov dword [ebp - 0x10], 2
jmp 0x49bc09
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
push esi
call sub.user32.dll_SetCursor
call sub.user32.dll_GetKeyboardLayoutList
test eax, eax
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49bc3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49bc59
lea eax, [ebp - 4]
call fcn.0040499c
ret

Function at 0x49bc64
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x49bcae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0x20
call sub.user32.dll_GetClientRect
push eax
call sub.user32.dll_SetForegroundWindow
mov cl, 1
mov edx, 0x49bccc
mov eax, dword [ebp - 8]
call fcn.0049bba8
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DefFrameProcA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49bcb8
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x49c0c0
Capabilities:
Shutdown system

Disassembly:
xor eax, eax
pop edx
pop edx
jmp 0x49c27b
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x49c0c8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x49c2ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x4a7ecc]
call fcn.004a0bcc
mov edx, 0x49c2c4
mov eax, dword [ebp - 0xc]
call fcn.0049be60
xor eax, eax
push ebp
push 0x49c281
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402bfc
cmp dword [0x4a7ed8], 0
jne 0x49c123
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c28b
mov esi, dword [0x4a7ed8]
dec esi
test esi, esi
jl 0x49c277
inc esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
lea edx, [ebx + 2]
mov ecx, 1
mov eax, dword [0x4a7edc]
call fcn.00404ebc
mov eax, dword [ebp - 0x10]
mov edx, 0x49c2d4
call fcn.00404da8
jne 0x49c18d
dec ecx
add al, ch
push eax
invalid
xor edi, edi
jne 0x49c151
push dword [ebp - 0xc]
lea edx, [ebp - 0x14]
mov eax, 6
call fcn.0049c010
push dword [ebp - 0x14]
push 0x49c2e0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404d1c
mov eax, dword [ebp - 4]
call fcn.0040950c
test al, al
jne 0x49c159
jmp 0x49c1c6
lea eax, [ebp - 0x18]
call fcn.0049d114
push dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
mov eax, 6
call fcn.0049c010
push dword [ebp - 0x1c]
push 0x49c2f0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404d1c
mov eax, dword [ebp - 4]
call fcn.0040950c
test al, al
jne 0x49c18d
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00408fb0
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x49c300
call fcn.00404ca8
mov eax, dword [ebp - 0x20]
call fcn.00404e5c
mov edx, eax
mov eax, 0x49c304
mov ecx, 1
call fcn.0049d5c4
test al, al
je 0x49c26f
lea eax, [ebp - 0x28]
push eax
lea edx, [ebx + 2]
mov ecx, 1
mov eax, dword [0x4a7edc]
call fcn.00404ebc
mov eax, dword [ebp - 0x28]
mov edx, 0x49c314
call fcn.00404da8
jne 0x49c26f
mov eax, dword [ebp - 4]
call fcn.00404e5c
push eax
call sub.user32.dll_IsChild
mov edi, eax
test edi, edi
je 0x49c26f
push 0x49c318
push edi
call fcn.00406f5c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49c269
mov eax, dword [0x4a7f24]
call fcn.00404e5c
push eax
mov eax, dword [0x4a7ed0]
call fcn.00404e5c
push eax
call dword [ebp - 8]
jmp 0x49c26f
push edi
call sub.user32.dll_ExitWindowsEx
inc ebx
dec esi
jae 0x49c135
jmp 0x4083df
jmp dword [ecx + ecx*4 + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c2b5
lea eax, [ebp - 0x28]
mov edx, 8
call fcn.004049c0
lea eax, [ebp - 4]
call fcn.0040499c
ret
Function at 0x49d5c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
push ebp
push 0x49d6d7
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov byte [ebp - 1], 0
push eax
push edx
mov eax, dword [0x4a6664]
push eax
call sub.user32.dll_EnumWindows
mov ebx, eax
test ebx, ebx
je 0x49d6cd
push ebx
mov eax, dword [0x4a6664]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
mov esi, eax
test esi, esi
je 0x49d6cd
push ebx
mov eax, dword [0x4a6664]
push eax
call sub.user32.dll_PostMessageA
mov ebx, eax
dec edi
je 0x49d62b
dec edi
je 0x49d6a8
jmp 0x49d6cd
push 0
push 0x20
push 2
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00404e5c
push eax
call sub.user32.dll_DestroyIcon
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x49d6cd
xor eax, eax
push ebp
push 0x49d6a1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
call fcn.0040705c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_ScrollWindow
test eax, eax
je 0x49d681
cmp ebx, dword [ebp - 8]
je 0x49d685
xor eax, eax
jmp 0x49d687
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d6cd
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DefFrameProcA
ret
mov eax, dword [ebp + 8]
mov edx, ebx
call fcn.00404fe8
mov eax, dword [ebp + 8]
call fcn.00404eb4
push eax
push esi
call fcn.0040705c
mov ecx, ebx
pop edx
call fcn.00402a10
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49d6e1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49f154
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
mov eax, dword [ebp - 8]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x49f382
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49f35d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x49f1a2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f367
call fcn.0049f7c0
test al, al
je 0x49f27c
push 0x49f390
call sub.user32.dll_IsChild
mov ebx, eax
test ebx, ebx
jne 0x49f1cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f367
push 0x49f3a0
push ebx
call fcn.00406f5c
mov esi, eax
mov dword [0x4a7d1c], esi
test esi, esi
jne 0x49f1f6
push ebx
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f367
mov esi, 0x200
mov eax, esi
call fcn.00402764
mov dword [ebp - 0xc], eax
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004057d4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x56], eax
xor eax, eax
mov dword [ebp - 0x52], eax
mov eax, 0x49f3ac
mov dword [ebp - 0x4e], eax
mov dword [ebp - 0x4a], 0x102
mov dword [ebp - 0x46], 0xffffffff
xor eax, eax
mov dword [ebp - 0x42], eax
mov eax, esi
call fcn.00402764
mov edi, eax
mov ecx, esi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004057d4
mov dword [ebp - 0x3e], edi
mov eax, 0x49f3ac
mov dword [ebp - 0x3a], eax
push 0
lea eax, [ebp - 0x56]
push eax
push 2
push 0
call dword [0x4a7d1c]
mov eax, dword [ebp - 0xc]
call fcn.00402784
mov eax, edi
call fcn.00402784
jmp 0x49f34d
push 0x49f3b0
call sub.user32.dll_IsChild
mov ebx, eax
test ebx, ebx
jne 0x49f299
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f367
push 0x49f3a0
push ebx
call fcn.00406f5c
mov esi, eax
mov dword [0x4a7d20], esi
test esi, esi
jne 0x49f2c3
push ebx
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f367
lea eax, [ebp - 0x36]
xor ecx, ecx
mov edx, 0xd
call fcn.004032e4
mov eax, dword [ebp - 8]
call fcn.00404c5c
push eax
lea eax, [ebp - 8]
call fcn.00404eb4
lea edx, [ebp - 0x36]
pop ecx
call fcn.00402a10
mov byte [ebp - 0x29], 0
mov word [ebp - 0x28], 0x102
lea eax, [ebp - 0x26]
xor ecx, ecx
mov edx, 4
call fcn.004032e4
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 4
call fcn.004032e4
mov eax, dword [ebp - 4]
call fcn.00404e5c
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 9
call fcn.004032e4
lea eax, [ebp - 0x15]
xor ecx, ecx
mov edx, 9
call fcn.004032e4
push 0x2a
lea eax, [ebp - 0x36]
push eax
push 0x32
push 0
call dword [0x4a7d20]
push ebx
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f367
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f389
lea eax, [ebp - 8]
mov edx, 2
call fcn.004049c0
ret
Function at 0x49f3bc
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x49f512
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49f4f2
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0049f7c0
test al, al
je 0x49f46a
push 0x49f520
call sub.user32.dll_IsChild
mov ebx, eax
test ebx, ebx
jne 0x49f412
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f4fc
push 0x49f530
push ebx
call fcn.00406f5c
mov esi, eax
mov dword [0x4a7d14], esi
test esi, esi
jne 0x49f43c
push ebx
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f4fc
mov edi, 0x200
mov eax, edi
call fcn.00402764
mov esi, eax
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004057d4
push 0
push esi
push 0
call dword [0x4a7d14]
mov eax, esi
call fcn.00402784
jmp 0x49f4e2
push 0x49f53c
call sub.user32.dll_IsChild
mov ebx, eax
test ebx, ebx
jne 0x49f484
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f4fc
push 0x49f530
push ebx
call fcn.00406f5c
mov esi, eax
mov dword [0x4a7d18], esi
test esi, esi
jne 0x49f4ab
push ebx
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f4fc
lea eax, [ebp - 0x11]
xor ecx, ecx
mov edx, 0xd
call fcn.004032e4
mov eax, dword [ebp - 4]
call fcn.00404c5c
push eax
lea eax, [ebp - 4]
call fcn.00404eb4
lea edx, [ebp - 0x11]
pop ecx
call fcn.00402a10
push 0
lea eax, [ebp - 0x11]
push eax
push 0
call dword [0x4a7d18]
push ebx
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f4fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f519
lea eax, [ebp - 4]
call fcn.0040499c
ret

Function at 0x49f6b4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x49f78d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49f76d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004049f0
test ebx, ebx
je 0x49f763
push ebx
push 0
push 0x410
call sub.user32.dll_IsWindowVisible
mov ebx, eax
test ebx, ebx
je 0x49f75d
push 0x49f79c
call sub.user32.dll_IsChild
mov edi, eax
push 0x49f7a8
push edi
call fcn.00406f5c
mov dword [0x4a7f5c], eax
cmp dword [0x4a7f5c], 0
je 0x49f757
push 0x401
lea eax, [ebp - 0x405]
push eax
push 0
push ebx
call dword [0x4a7f5c]
test eax, eax
jle 0x49f757
mov edx, esi
lea eax, [ebp - 0x405]
call fcn.00409cc8
push edi
call sub.user32.dll_ExitWindowsEx
push ebx
call sub.user32.dll_DefFrameProcA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f777
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f794
lea eax, [ebp - 4]
call fcn.0040499c
ret
Function at 0x49fc1c
Capabilities:
Execute anti-debugging instructions
Open clipboard

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
call sub.user32.dll_GetClientRect
push eax
call sub.user32.dll_GetMenuItemID
mov ebx, eax
call sub.user32.dll_GetCursor
push eax
call sub.user32.dll_GetScrollRange
mov esi, eax
push 0x100
call sub.user32.dll_GetClientRect
push eax
call sub.user32.dll_OpenClipboard
push 0xf
call sub.user32.dll_GetCursor
push eax
call sub.user32.dll_PeekMessageA
push 0xa
call fcn.0040e260
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call fcn.0040e260
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.user32.dll_GetCursor
push eax
call sub.user32.dll_PeekMessageA
push ebx
call sub.user32.dll_GetClientRect
push eax
call sub.user32.dll_OpenClipboard
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x49fcbc]
fstp qword [ebp - 0x10]
wait
fld qword [ebp - 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404819
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
push edi
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and eax, 0x12
xor edx, edx
mov ecx, 0x63984b5e
div ecx
mov dword [ebp - 0x1a8], edx
mov eax, 0xf1
imul eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b8], eax
push 0x29
pop eax
imul eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1c0], eax
mov eax, 0xb9
and eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
or eax, 0x30ed
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 0x1a4]
or ecx, 0xdffcf2d
mov eax, 0xc2
xor edx, edx
div ecx
mov dword [ebp - 0x1b4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
and ecx, 0x10c
or ecx, 0x5b2147d0
mov eax, dword [ebp - 0x1b4]
xor edx, edx
div ecx
mov dword [ebp - 0x1bc], edx
mov eax, dword [ebp - 0x1bc]
or eax, 0x63
mov dword [ebp - 0x1cc], eax
push 6
pop ecx
or ecx, 0x2d1d13bb
mov eax, dword [ebp - 0x1cc]
xor edx, edx
div ecx
mov dword [ebp - 0x1a0], edx
push 0x47
pop eax
sub eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
add eax, 0x4ccb243f
mov dword [ebp - 0x1c4], eax
push 0x49
pop eax
imul eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1ac], eax
mov eax, 0x4c82
sub eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [0x4231dc], eax
push bp
pop bp
xor eax, eax
add eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
pop dword [ebp - 0x118]
add eax, dword [0x4231d4]
mov dword [0x4231d8], eax
push 0x50
push 0x5c
push 0x5d
push 0xb
push 0xaa
mov eax, 0xea
push 0x5e
pop ecx
call fcn.00403918
add esp, 0x14
mov dword [0x4231dc], eax
mov dword [ebp - 0x120], 0x9e6df9da
mov dword [ebp - 0x134], 0x888c4b57
mov dword [ebp - 0x148], 0x888c4b57
mov dword [ebp - 0x14c], 0x26f1c819
mov dword [ebp - 0x140], 0xc5747cb
or dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x11c], 0x12b80e24
mov dword [ebp - 0x144], 0xed47f1db
mov dword [ebp - 0x150], 0x6b2475be
mov dword [ebp - 0x138], 0x6b2475be
push eax
pop dword [ebp - 0x13c]
mov edx, dword [0x411168]
sub edx, dword [ebp - 0x120]
xor edx, 0xca
lea esi, [esi]
mov eax, dword [ebp - 0x134]
xor eax, dword [ebp - 0x148]
add eax, dword [ebp - 0x114]
mov ah, ah
mov edx, dword [0x41116c]
or edx, dword [ebp - 0x14c]
xor edx, 0x82
not edx
push bp
pop bp
mov ecx, eax
push dword [ebp - 0x140]
pop dword [ebp - 0x130]
mov edx, 0x56
lea eax, [eax]
rdtsc
lea ebp, [ebp]
mov edx, dword [0x411170]
xor edx, dword [0x411174]
and edx, 0x3f
push esi
pop dword [ebp - 0x12c]
xor eax, dword [ebp - 0x128]
mov dword [ebp - 0x114], eax
not dword [ebp - 0x114]
not eax
push eax
pop dword [ebp - 0x154]
mov edx, dword [ebp - 0x11c]
or edx, dword [ebp - 0x144]
xor edx, 0x7f
not edx
push esp
pop dword [ebp - 0x124]
mov eax, dword [ebp - 0x150]
sub eax, dword [ebp - 0x138]
xor eax, ecx
lea ecx, [ecx]
mov edx, 0x95
jmp loc.00435000
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41067b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x41068a
pop dword [ebp - 0x34]
mov eax, 0x41068a
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x32b6ce8e
sub dword [ebp - 0x44], 0xe4648943
mov dword [ebp - 0x40], 0x13782866
add dword [ebp - 0x40], 0x1ebb23df
mov dword [ebp - 0x3c], 0xd0858aa1
sub dword [ebp - 0x3c], 0x84394673
mov dword [ebp - 0x38], 0x648cc1d5
add dword [ebp - 0x38], 0x9b733e2b
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x1826c791
sub dword [ebp - 0x44], 0xa3b45e3b
mov dword [ebp - 0x40], 0x5d1942e6
add dword [ebp - 0x40], 0xe4531e8f
mov dword [ebp - 0x3c], 0x27f5b73b
sub dword [ebp - 0x3c], 0xc4864acf
mov dword [ebp - 0x38], 0xa1209d1b
sub dword [ebp - 0x38], 0xa1209d1b
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xb8da0740
add eax, 0x476829e4
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3d6a7
push 0
call eax
mov ecx, 0x2e4220b2
sub ecx, 0x2e41d9f4
mov ebx, eax
mov esi, 0xa6d8064
sub esi, 0xa2a3c64
add esi, dword [ebp - 0x34]
mov edx, 0x3c75a38f
add edx, 0xd703b559
mov edi, dword [esi]
xor dword [ebp - 0x28], ebx
xor edi, edx
xor dword [ebp - 0x10], 0xbbf684be
mov dword [ebx], edi
sub dword [ebp - 0x20], 0x93c56b3c
add ebx, 0xee25df22
sub ebx, 0xee25df1e
add esi, 0x7717c979
sub esi, 0x7717c975
loop 0x4107a2
add eax, 0xf5de0130
sub eax, 0xf5dcf365
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x407594
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a434
test esi, esi
jne 0x4075ca
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a5cc
jmp 0x4075e8
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004074d8
mov edi, eax
test esi, esi
je 0x4075e8
cmp dword [ebx], 0
je 0x4075e8
dec esi
jmp 0x4075d1
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x408f6c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040942c
mov byte [esp], al
cmp byte [esp], 0
jne 0x4090f5
test edi, edi
je 0x4090f5
mov byte [esp + 1], 0
test ebp, ebp
jle 0x409035
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x409010
cmp edi, 0xffffffff
je 0x408fd1
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408fd1
mov byte [esp], 0
jmp 0x4090f5
cmp dword [esi], 1
jg 0x409010
cmp dword [esi], 0
jne 0x409002
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x409002
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4090f5
lea eax, [esp + 0xc]
call fcn.00408c04
dec ebp
test ebp, ebp
jg 0x408fb6
cmp edi, 0xffffffff
je 0x409035
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409033
mov byte [esp], 0
jmp 0x4090f5
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408f7a
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409035
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409170
mov edx, eax
mov ebx, dword [0x7d0900]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409099
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x409097
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409099
xor edi, edi
cmp byte [esp], 0
je 0x4090bf
mov ebx, dword [esi]
test bl, 1
jne 0x4090d5
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40909f
mov byte [esp + 1], 1
jmp 0x4090d5
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4090bf
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x40904c
cmp byte [esp], 0
je 0x4090f5
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret