joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401180
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x40
push 0x3000
push 0x3e8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test eax, eax
jne 0x4011ae
mov dword [ebp - 4], 1
jmp 0x4011b5
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4011c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0x40
push 0x1000
push 0x291
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401211
push 0x291
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.004037d0
add esp, 0xc
push 0x291
push section..data
mov ecx, dword [ebp - 4]
push ecx
call fcn.00403250
add esp, 0xc
jmp 0x401213
jmp 0x401249
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], str.E7a0eCX76F0YzS4j
push str.6ASMkFslyhwXehNZw048cF1Vh1ACzyyR
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004010d0
add esp, 0xc
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 8]
push edx
call fcn.00401140
mov esp, ebp
pop ebp
ret
Function at 0x401990
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x4019a6
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x401a57
mov ecx, 4
imul edx, ecx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
imul eax, edx, 0
add eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov cl, byte [ecx + str.cw]
mov byte [eax + edx], cl
mov edx, 4
shl edx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
shl edx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + str.cw]
mov byte [edx + eax], cl
mov edx, 4
shl edx, 1
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
shl edx, 1
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + str.cw]
mov byte [edx + eax], cl
mov edx, 4
imul eax, edx, 3
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx edx, byte [eax + ecx]
mov eax, 4
imul ecx, eax, 3
add ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dl, byte [edx + str.cw]
mov byte [ecx + eax], dl
jmp 0x40199d
mov esp, ebp
pop ebp
ret

Function at 0x402020
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x402036
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x4020e7
mov ecx, 4
imul edx, ecx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
imul eax, edx, 0
add eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov cl, byte [ecx + 0x40f2a0]
mov byte [eax + edx], cl
mov edx, 4
shl edx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
shl edx, 0
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + 0x40f2a0]
mov byte [edx + eax], cl
mov edx, 4
shl edx, 1
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [edx + eax]
mov edx, 4
shl edx, 1
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + 0x40f2a0]
mov byte [edx + eax], cl
mov edx, 4
imul eax, edx, 3
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx edx, byte [eax + ecx]
mov eax, 4
imul ecx, eax, 3
add ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dl, byte [edx + 0x40f2a0]
mov byte [ecx + eax], dl
jmp 0x40202d
mov esp, ebp
pop ebp
ret

Function at 0x402f0b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402f4a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402f4a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402f4a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402f4a
cmp dword [ecx + 0x74], 0xe
jbe 0x402f4a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407967
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4162c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4079b2
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00407b84
test al, al
jne 0x4079ac
sub edx, 2
cmp edx, edi
jne 0x407992
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4079d4
lea eax, [edi + 2]
cmp edx, eax
je 0x4079d4
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004078b3
add esp, 0x10
jmp 0x407ace
push esi
lea ecx, [ebp - 0x255]
call fcn.00407b84
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x407a17
push dword [ebp - 0x25c]
jmp 0x4079c4
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x407a54
cmp word [ebp - 0x226], 0
je 0x407a75
cmp word [ebp - 0x226], ax
jne 0x407a54
cmp word [ebp - 0x224], 0
je 0x407a75
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004078b3
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x407ac1
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x407a2e
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x407aa9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x407ace
push 0x4076e3
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040a5b0
add esp, 0x10
jmp 0x407a9e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040259c
leave
ret

Function at 0x409513
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411644
push 0x41163c
push str.FlsAlloc
push 0x1f
call fcn.0040944e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409547
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f110]
call esi
jmp 0x40954d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409591
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411654
push 0x41164c
push str.FlsGetValue
push 0x21
call fcn.0040944e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4095c8
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f110]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4095d0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41165c
push 0x411654
push str.FlsSetValue
push 0x22
call fcn.0040944e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40960a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f110]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40e2d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e2fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e2fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x7ffe53a1
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
cld
push edx
cdq
pop edx
nop
and bh, 0xff
stc
add eax, 0
clc
add eax, 0
clc
push edx
cdq
pop edx
clc
and bh, 0xff
nop
push edx
cdq
pop edx
cld
lea esp, [esp]
cld
push edx
cdq
pop edx
clc
push edx
cdq
pop edx
cld
lea esp, [esp]
clc
add eax, 0
cld
push edx
cdq
pop edx
nop
add eax, 0
clc
pushal
inc eax
popal
nop
lea esp, [esp]
cld
and bh, 0xff
clc
lea esp, [esp]
clc
add eax, 0
cld
add eax, 0
nop
lea esp, [esp]
clc
push edx
cdq
pop edx
clc
pushal
inc eax
popal
stc
add eax, 0
clc
lea esp, [esp]
nop
push edx
cdq
pop edx
nop
and bh, 0xff
cld
add eax, 0
stc
add eax, 0
clc
add eax, 0
cld
lea esp, [esp]
nop
clc
call 0x7ffe542a
pop edx
stc
lea esp, [esp]
inc esi
dec esi
stc
xor dx, dx
clc
and bh, 0xff
add edx, 0xd5e0
and bh, 0xff
xor ecx, ecx
pushal
inc eax
popal
cld
mov cl, 0x1e
push edx
cdq
pop edx
nop
nop
xor byte [ecx + edx], 0x9e
loop 0x7ffe544f
push dword fs:[0x24]
stc
push edx
cdq
pop edx
stc
and bh, 0xff
stc
pop dword [edx + 0xa]
lea esp, [esp]
clc
cld
stc
mov cl, 0xff
cld
push edx
loop 0x7ffe5471
clc
push es
pop ds
stc
mov dword [edx + 0x11], 0xffffacbb
clc
cld
clc
mov ecx, dword [eax + 0x2c]
cld
push edx
cdq
pop edx
cld
push edx
cdq
pop edx
mov dword [edx + 0x1b], ecx
cld
mov dword [edx + 0x100], ecx
add eax, 0
stc
mov dword [eax + 0x2c], esp
cld
push 0
push 0
cld
push edx
cdq
pop edx
inc esi
dec esi
cld
push 0
cld
and bh, 0xff
stc
push edx
cdq
pop edx
push 0
add eax, 0
push 0x30
clc
cld
push 0x20
pushal
inc eax
popal
cld
pushal
inc eax
popal
push 0
cld
cld
push 0
lea esp, [esp]
add edx, 0xffff7f33
add eax, 0
pushal
inc eax
popal
push edx
add eax, 0
cld
inc esi
dec esi
nop
push edx
and bh, 0xff
add eax, 0
push 0
and al, 0xff
cld
call dword [edx + 0x8210]
add esp, 0x3f8
push es
pop ds
cld
xor eax, eax
clc
cld
inc eax
and bh, 0xff
nop
and bh, 0xff
cld
cld
ret 0xc
Function at 0x1001c75
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x10011d4
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jmp loc.0100d8ae

Function at 0x1003be3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jmp loc.0100d6d6

Function at 0x1003c8e
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Delete registry value
Get common file path
Get file attributes
Get system information on windows
Persist via run registry key
Query or enumerate registry value
Read .ini file
Set registry value
Write file on windows

Disassembly:
sub esp, 0x59c
and dword [esp + 0x14], 0
push ebx
push ebp
push esi
push edi
mov ecx, 0x240
xor eax, eax
mov edi, 0x1006328
rep stosd dword es:[edi], eax
push 0x1007630
mov dword [0x1007630], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov esi, 0x100
mov ebp, dword [esp + 0x5b0]
push esi
push 0x100ae68
push 3
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1006c28
push 4
push ebp
jmp loc.0100d9c0

Function at 0x1004f86
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x1009608], 0
je 0x1004fa3
push 0
push 0
jmp loc.0100d0b6
and dword [0x1009608], 0
xor eax, eax
ret

Function at 0x1004fad
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x1007634], 4
push ebx
push esi
push edi
jbe fcn.01004fcf
cmp dword [0x1007640], 2
jmp loc.0100d736

Function at 0x10050d3
Capabilities:
Delete file
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push dword [ebp + 8]
mov esi, 0x1008ff0
lea eax, [ebp - 0x104]
push esi
push 0x1001b00
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
add esp, 0x10
lea eax, [ebp - 0x208]
push 0x104
push eax
lea eax, [ebp - 0x104]
push eax
call ebx
test eax, eax
je 0x100512b
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
jmp loc.0100dbb2

Function at 0x100519e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1005221
jmp loc.0100df5f
xor eax, eax
pop esi
leave
ret 0x18

Function at 0x1005228
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
jmp loc.0100d409
Function at 0x10052e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b38
push 0x10054e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x100b28c], 0xffffffff
mov dword [0x100b290], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x100b288]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x100b284]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x100b294], ecx
call fcn.010054d0
mov eax, dword [0x1006010]
test eax, eax
jne 0x1005371
push 0x10054c0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
jmp loc.0100d2fe

Function at 0x10054ec
Capabilities:
Get common file path
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
lea eax, [ebp - 0x114]
xor ebx, ebx
push 0x100
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x114]
lea eax, [ebp - 0x114]
test ecx, ecx
je 0x1005533
mov cl, byte [eax]
cmp cl, bl
je 0x1005533
cmp cl, 0x5c
jne 0x1005530
mov byte [eax], 0x2f
inc eax
jne 0x1005522
mov edi, 0x1001bb8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x114]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
mov edi, 0x2001f
push ebx
push edi
push ebx
push ebx
push ebx
push 0x1001b80
push 0x80000002
call esi
test eax, eax
jmp 0x100d48d

Function at 0x100d67a
Capabilities:
Set registry value

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
lea eax, [esp + 0x10]
push esi
jmp fcn.010023c1

Function at 0x100d804
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push edi
mov eax, 0x20
xor ecx, ecx
push 0x206
push 0
push edx
push 0x8001
push 0
push 8
push 0
push 0x2b4
push eax
push 0
push 0x79afe8
push 0x40f678
push 0x79d880
push eax
push 0x7ab000
push 0
cmp edx, 0x22
add esp, 0x44
leave
popal
popfd
jne 0x1002966
jmp fcn.0100210f
Function at 0x406ff4
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x407100
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
test bl, bl
je 0x407074
movzx eax, bl
add ax, 0x41
dec eax
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xc], 0
lea eax, [ebp - 0x420]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
mov edi, eax
cmp edi, 0x104
jbe 0x40706b
mov edx, edi
dec edx
lea eax, [ebp - 4]
call fcn.0040b120
mov eax, dword [ebp - 4]
call fcn.0040af94
push eax
push edi
call sub.kernel32.dll_GetCurrentDirectoryW
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [ebp - 0x218]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
cmp esi, 0x104
ja 0x4070a4
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x104
call fcn.0040b048
jmp 0x4070c0
mov edx, esi
dec edx
mov eax, dword [ebp - 8]
call fcn.0040b120
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040af94
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x4070e8
cmp edi, 0x104
jbe 0x4070dc
mov eax, dword [ebp - 4]
call fcn.0040af94
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x4070e8
lea eax, [ebp - 0x420]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407107
lea eax, [ebp - 4]
call fcn.0040a480
pop eax
jmp eax

Function at 0x407674
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a480
test esi, esi
jne 0x4076aa
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a618
jmp 0x4076c8
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004075b8
mov edi, eax
test esi, esi
je 0x4076c8
cmp dword [ebx], 0
je 0x4076c8
dec esi
jmp 0x4076b1
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x408ff8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004094b8
mov byte [esp], al
cmp byte [esp], 0
jne 0x409181
test edi, edi
je 0x409181
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4090c1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x40909c
cmp edi, 0xffffffff
je 0x40905d
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40905d
mov byte [esp], 0
jmp 0x409181
cmp dword [esi], 1
jg 0x40909c
cmp dword [esi], 0
jne 0x40908e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40908e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x409181
lea eax, [esp + 0xc]
call fcn.00408c90
dec ebp
test ebp, ebp
jg 0x409042
cmp edi, 0xffffffff
je 0x4090c1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4090bf
mov byte [esp], 0
jmp 0x409181
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409006
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4090c1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004091fc
mov edx, eax
mov ebx, dword [0x63c900]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409125
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x409123
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409125
xor edi, edi
cmp byte [esp], 0
je 0x40914b
mov ebx, dword [esi]
test bl, 1
jne 0x409161
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40912b
mov byte [esp + 1], 1
jmp 0x409161
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40914b
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4090d8
cmp byte [esp], 0
je 0x409181
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409e10
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x63eba0
cmp dword [ebp + 0xc], 2
jl 0x409e24
mov ebx, 0x63ebd0
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x409e5c
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x40526c
mov dword [0x63c01c], eax
mov eax, 0x405274
mov dword [0x63c020], eax
mov eax, ebx
call fcn.00409cf4
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x409e91
cmp al, 3
jge 0x409e91
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x409ea2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x409ead
call dword [ecx + eax*4]
cmp dword [0x63c040], 0
jne 0x409ec3
mov byte [0x63c048], 1
fnstcw word [0x62e02c]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.0040a1b0
call fcn.00409da4
ret 4

Function at 0x40a118
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x63c05c], 0
je 0x40a17f
cmp word [0x63c34c], 0xd7b2
jne 0x40a141
cmp dword [0x63c354], 0
jbe 0x40a141
mov eax, 0x63c348
call dword [0x63c364]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a1ac
call fcn.0040ad44
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x62e036], 0
jne 0x40a19b
push 0
push 0x62e9db
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40a340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x62e038], 0
je 0x40a36b
mov edx, edi
mov eax, esi
call dword [0x62e038]
mov ebx, eax
jmp 0x40a37c
mov eax, 8
call fcn.00406e4c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x63c05d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a308
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40a3ac
mov eax, ebx
call fcn.00406e68
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc