joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419858
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x443518]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41989e
cmp word [ebx], dx
jne 0x41989e
or byte [eax + edi + 0x28], 4
jmp 0x4198a3
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x419a06
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4199e6
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4198e4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41991a
cmp eax, edx
jae 0x419928
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4198bf
jmp 0x419a06
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4199e1
cmp dword [ebp - 0x18], 0
je 0x4199e1
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x443518]
test byte [eax + edi + 0x28], 0x48
je 0x4199b7
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41997b
mov word [esi], cx
jmp 0x4199b2
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x443518]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x443518]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x443518]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x419a06
pop eax
cmp word [ebp - 4], ax
jne 0x4199c7
cmp esi, ebx
jne 0x4199c7
mov word [esi], ax
jmp 0x419a03
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00419bac
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x419a06
push 0xd
pop eax
jmp 0x4199c2
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x443518]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x419a00
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x419a06
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x420869
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4208a8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4208a8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4208a8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4208a8
cmp dword [ecx + 0x74], 0xe
jbe 0x4208a8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x423f65
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x441da0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00414696
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00414696
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x423fdc
cmp word [ecx], dx
je 0x423fdc
mov eax, dword [0x434d24]
push edi
dec eax
push eax
push 0x434c10
call fcn.00424155
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x42404f
cmp word [eax], dx
je 0x42404f
mov eax, dword [edi]
test eax, eax
je 0x424000
cmp word [eax], dx
je 0x424000
lea eax, [ebp - 0x10]
push eax
call fcn.004241b6
jmp 0x424009
lea eax, [ebp - 0x10]
push eax
call fcn.004244a4
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x424079
mov eax, dword [0x434c0c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x434900
call fcn.00424155
add esp, 0xc
test al, al
je 0x424079
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x424044
cmp word [eax], di
je 0x424044
lea eax, [ebp - 0x10]
push eax
call fcn.004241b6
pop ecx
jmp 0x42407b
lea eax, [ebp - 0x10]
push eax
call fcn.004244a4
jmp 0x424041
mov eax, dword [edi]
test eax, eax
je 0x424066
cmp word [eax], dx
je 0x424066
lea eax, [ebp - 0x10]
push eax
call fcn.004245d8
pop ecx
jmp 0x424079
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x424144
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004246ca
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x424144
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x424144
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x424144
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4240d1
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00415030
test ebx, ebx
je 0x42413f
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00415030
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x424144
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x424144
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0042b53c
add esp, 0x10
xor eax, eax
inc eax
jmp 0x424146
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418700
leave
ret
Function at 0x4247d0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00414696
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42483f
cmp esi, dword [ebp - 4]
je 0x42483a
cmp dword [ebp + 0xc], 0
je 0x42483a
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x424817
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00424899
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x424841
xor eax, eax
inc eax
jmp 0x424841
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x4248d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4248fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4248fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430ded
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x430e8a
push ebx
push esi
call fcn.00430e8d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042111a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x430e37
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x430e89
push edi
push eax
call fcn.00413f68
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x430e57
call fcn.00413f2e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x430e88
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042111a
add esp, 0x20
test eax, eax
jne 0x430e76
push edi
call fcn.00413f2e
jmp 0x430e7e
push ebx
call fcn.00413f2e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x445458
Capabilities:
Self delete

Disassembly:
push ebx
push edi
push dword [0x442568]
call fcn.00405360
push edx
push eax
pop ebx
pop edi
cmp ebx, 0
jne 0x445477
cmp edi, 0
jne 0x445477
xor eax, eax
jmp 0x44547c
mov eax, 1
or eax, eax
je 0x44554d
push dword [0x4430a4]
push dword [0x4430a4]
mov edx, str._c_del__
push edx
call fcn.00409310
mov edx, dword [0x442558]
push edx
call fcn.00409310
mov edx, str.ffmpeg0.bmp_
push edx
call fcn.00409310
add dword [0x4430a4], 2
mov eax, str.cmd.exe
push eax
mov edx, dword [0x441b5c]
add dword [esp + 4], edx
call fcn.00446d7a
pop dword [0x4430a4]
push dword [0x4430a4]
push dword [0x4430a4]
mov edx, 0x43f178
push edx
call fcn.00409310
mov edx, dword [0x442558]
push edx
call fcn.00409310
mov edx, str.audio.pcm_
push edx
call fcn.00409310
mov edx, dword [0x441b5c]
add dword [esp], edx
call fcn.004061ac
pop dword [0x4430a4]
push dword [0x4430a4]
mov edx, dword [0x442558]
push dword [0x4430a4]
push edx
call fcn.00409310
mov edx, str.audio.pcm
push edx
call fcn.00409310
mov edx, dword [0x441b5c]
add dword [esp], edx
call fcn.004061ac
pop dword [0x4430a4]
xor eax, eax
pop edi
pop ebx
ret
Function at 0x40170e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401723
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401735
xor eax, eax
jmp 0x401767
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401759
cmp esi, eax
jae 0x401731
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40174b
cmp esi, eax
jae 0x401731
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret

Function at 0x4035ca
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, eax
cmp byte [esi + 0x24], 0
jne 0x403655
push ebx
mov byte [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp - 4], eax
push edi
xor edi, edi
jmp 0x403606
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push edi
push edi
push dword [esi + 0x20]
lea eax, [ebp - 0x20]
push eax
call ebx
test eax, eax
jne 0x4035f2
cmp dword [esi + 0xc], edi
jbe 0x403653
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
add edx, ecx
cmp eax, edx
jae 0x403638
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4035ee
mov ebx, dword [esi + 4]
cmp ebx, edi
je 0x403653
jmp 0x403643
xor edi, edi
mov eax, ebx
mov ebx, dword [ebx]
push edi
mov edi, eax
call fcn.00403768
test ebx, ebx
jne 0x403641
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x4036b6
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x403763
push edi
push dword [ebp + 0xc]
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.0040388f
mov edi, eax
test edi, edi
jne 0x403713
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x403762
movzx eax, byte [ebp - 9]
push edi
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
push str.CCommEngine__::Connect__d._d._d._d__session_is__08X_n
call fcn.004101cb
add esp, 0x18
push 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x403760
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x403760
lea ecx, [esi + 4]
mov eax, edi
call fcn.00403b29
jmp 0x40370f
mov eax, edi
pop edi
pop ebx
leave
ret 8
Function at 0x40388f
Capabilities:
Set socket configuration

Disassembly:
mov eax, 0x4468bc
call fcn.00429ea8
sub esp, 0x38
push esi
push edi
lea esi, [ebp - 0x44]
call fcn.00403b60
and dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x44], ebx
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
movsd dword es:[edi], dword [esi]
push 0x8004667e
push ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 8]
push 0x33
push 0x478
push dword [eax + 0x20]
push ebx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x4038eb
xor esi, esi
jmp 0x40392c
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1002
mov edi, 0xffff
push edi
push ebx
mov dword [ebp - 0x10], 0x7d0
call esi
push 4
lea eax, [ebp - 0x10]
push eax
push 0x1001
push edi
push ebx
call esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
add esi, 4
call fcn.00403b92
mov esi, eax
lea ecx, [ebp - 0x2c]
call fcn.00403c58
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x403963
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d0
push ebx
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, ecx
mov esi, edx
jne 0x4039aa
push ebx
push 0x7d0
lea eax, [ebp - 0x7d0]
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jne 0x40399b
push ebx
call fcn.00403768
jmp 0x4039ce
cmp eax, 0xffffffff
jne 0x4039d3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, ebx
je 0x4039ce
cmp eax, 0x2733
je 0x4039ce
mov edx, dword [esi]
push ebx
push ebx
push edi
push eax
mov ecx, esi
call dword [edx]
push edi
mov eax, esi
call fcn.00403875
test al, al
je 0x4039ce
mov eax, edi
call fcn.004035a6
pop edi
pop esi
pop ebx
leave
ret
mov edx, dword [esi]
push eax
lea eax, [ebp - 0x7d0]
push eax
push edi
push ebx
mov ecx, esi
call dword [edx]
jmp 0x4039ce

Function at 0x4039e5
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [esp + 8], 0
push ebx
push esi
jne 0x403a50
cmp dword [edi + 0x28], 0
je 0x403a5b
lea ebx, [edi + 0x20]
mov esi, dword [ebx]
add esi, 8
push 0
push dword [esi + 0x7d0]
push esi
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x403a43
mov ecx, dword [esi + 0x7d0]
cmp eax, ecx
jge 0x403a34
sub ecx, eax
push ecx
add eax, esi
push eax
push esi
mov dword [esi + 0x7d0], ecx
call fcn.00426420
add esp, 0xc
jmp 0x4039fc
mov ecx, ebx
call fcn.00403bdc
cmp dword [edi + 0x28], 0
jne 0x4039f7
jmp 0x403a5b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x403a5b
mov esi, dword [esp + 0xc]
mov eax, edi
call fcn.004035a6
pop esi
pop ebx
ret 8
Function at 0x404303
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d4
push esi
mov esi, eax
test esi, esi
jle 0x40434f
cmp esi, 0x7d0
jg 0x40434f
cmp dword [edi + 0x28], 0
jne 0x404356
push 0
push esi
push dword [ebp + 8]
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x404342
add dword [ebp + 8], eax
sub esi, eax
test esi, esi
jg 0x404321
mov al, 1
jmp 0x404351
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x404356
xor al, al
pop esi
leave
ret 4
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x7d4]
push eax
mov dword [ebp - 4], esi
call fcn.00425f30
add esp, 0xc
lea eax, [ebp - 0x7d4]
push eax
lea esi, [edi + 0x20]
call fcn.00404515
test eax, eax
setne al
jmp 0x404351
Function at 0x409762
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x446dcd
call fcn.00429ea8
sub esp, 0x28
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
cmp eax, dword [ebx + 0xd8]
jne 0x4098fc
mov eax, dword [ebx + 0xc8]
test eax, eax
push esi
push edi
je 0x4098d3
mov ecx, dword [eax + 0xdc]
dec ecx
je 0x409840
dec ecx
jne 0x4098fa
cmp dword [eax + 0xe0], 0
jbe 0x4098fa
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [ebx + 0xc8]
mov ecx, dword [ecx + 0xe4]
add ecx, 0x1f4
cmp ecx, eax
jae 0x4098fa
mov ebx, dword [ebx + 0xc8]
call edi
mov ecx, dword [ebx + 0xe8]
add ecx, dword [ebx + 0xe0]
cmp ecx, eax
jae 0x4098fa
mov esi, dword [ebp + 8]
push ebx
lea ebx, [ebp + 0xc]
mov ecx, esi
call fcn.00409b9c
xor ebx, ebx
push ebx
mov dword [ebp - 4], ebx
push 2
push dword [eax]
mov eax, dword [esi + 0xc8]
call fcn.00408b43
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040150d
cmp dword [esi + 0xc8], ebx
je 0x4098d0
call edi
mov ecx, esi
mov ecx, dword [ecx + 0xc8]
mov dword [ecx + 0xe8], eax
jmp 0x4098fa
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x4098fa
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0xcc]
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4098fa
mov esi, dword [ebx + 0xc8]
push dword [ebp - 0x20]
add esi, 0xbc
push dword [ebp - 0x24]
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x34]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_OffsetRect]
push dword [ebp - 0x10]
lea eax, [ebp - 0x34]
push dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4098fa
mov eax, dword [ebx + 0xc8]
xor esi, esi
mov dword [eax + 0xdc], esi
mov eax, dword [ebx + 0xc8]
push esi
add eax, 0xbc
push eax
push dword [ebx + 0xcc]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebx + 0xc8], esi
jmp 0x4098d3
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xc8], 0
jne 0x4098fa
mov eax, dword [ebx + 0xd8]
test eax, eax
je 0x4098fa
push eax
push dword [ebx + 0xcc]
call dword [sym.imp.USER32.dll_KillTimer]
and dword [ebx + 0xd8], 0
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40a277
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x446dbb
call fcn.00429ea8
sub esp, 0x220
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0xa
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x22c]
jmp 0x40a2d1
cmp cl, 0x5c
jne 0x40a2cd
mov byte [eax], bl
lea eax, [ebp - 0x22c]
push eax
lea esi, [ebp - 0x24]
call fcn.0040a4f1
lea eax, [ebp - 0x22c]
jmp 0x40a2d0
mov byte [eax], cl
inc eax
inc edi
mov cl, byte [edi]
cmp cl, bl
jne 0x40a2af
mov byte [eax], bl
lea eax, [ebp - 0x22c]
push eax
lea esi, [ebp - 0x24]
call fcn.0040a4f1
cmp dword [ebp - 0x1c], 2
jb 0x40a351
cmp byte [ebp + 8], bl
jne 0x40a2fa
mov ecx, esi
call fcn.0040a4d5
mov esi, dword [ebp - 0x24]
mov byte [ebp - 0x128], bl
jmp 0x40a33a
mov eax, esi
push dword [eax + 8]
mov esi, dword [esi]
lea eax, [ebp - 0x128]
push eax
call fcn.004278d0
lea eax, [ebp - 0x128]
push 0x45836c
push eax
call fcn.004278d0
add esp, 0x10
push ebx
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, ebx
jne 0x40a305
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne bl
lea esi, [ebp - 0x24]
call fcn.0040a519
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40b3cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x24]
push esi
mov esi, dword [edi + 0x34]
sub esi, dword [edi + 0x6c]
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x24]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x40b452
mov eax, dword [edi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00425f30
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
add esp, 0xc
sub dword [edi + 0x54], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40b415
mov eax, dword [edi + 0x38]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40b437
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x40b4ad
mov ecx, dword [edi + 0x6c]
add ecx, dword [edi + 0x64]
push esi
add ecx, dword [edi + 0x30]
mov esi, eax
push ecx
call fcn.0040b11e
add dword [edi + 0x6c], eax
mov esi, dword [edi + 0x6c]
cmp esi, 3
pop ecx
pop ecx
jb 0x40b499
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x50]
mov dword [edi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x4c]
mov dword [edi + 0x40], eax
cmp esi, 0x106
jae 0x40b4ad
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x40b3d6
pop esi
pop ebx
leave
ret
Function at 0x410168
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x46351c]
cmp eax, 0xffffffff
je 0x4101b2
push esi
push edi
push 5
pop ecx
mov esi, str._r_n_r_n_t_tSTOPPING_LOG_r_n_r_n
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [ebp - 4]
push ecx
push 0x16
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x1c]
push ecx
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x46351c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x46351c], 0xffffffff
pop edi
pop esi
mov eax, dword [0x465e90]
test eax, eax
je 0x4101c9
push eax
call fcn.00438cde
and dword [0x465e90], 0
pop ecx
leave
ret

Function at 0x410217
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [0x46351c], 0xffffffff
je 0x410300
push esi
lea eax, [ebp - 8]
push edi
push eax
call fcn.0042937c
lea eax, [ebp - 8]
push eax
call fcn.00427734
mov esi, eax
push esi
push str.__y__m__d__H:_M:_S_
lea eax, [ebp - 0x58]
push 0x3f
push eax
call fcn.00429361
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x18]
push str._08X
push eax
call fcn.0042744e
mov eax, dword [0x463520]
add esp, 0xc
cmp eax, dword [esi + 0x1c]
je 0x4102ab
push ebx
push esi
call fcn.0041010d
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x4102aa
push dword [esi + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edi, dword [0x46351c]
push 0x463520
call esi
push ebx
push 0x46351c
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00426760
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
push dword [0x46351c]
call esi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00426760
pop ecx
push eax
lea eax, [ebp - 0x58]
push eax
push dword [0x46351c]
call esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x46351c]
call esi
pop edi
pop esi
leave
ret

Function at 0x4105e9
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret