joyce8/EMBER2024-capa huggingface dataset:
Function at 0xae89e4
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae89e4
ret

Function at 0xa28210
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa28360
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa28236
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa28222
add dl, dl
jne 0xa28241
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa28294
xor eax, eax
add dl, dl
jne 0xa2824e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa28335
add dl, dl
jne 0xa2825d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa28268
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa28273
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa2827e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa2828a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa2822d
mov eax, 1
add dl, dl
jne 0xa282a2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa282ad
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa28299
sub eax, ebx
mov ebx, 1
jne 0xa282e0
mov ecx, 1
add dl, dl
jne 0xa282c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa282d1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa282bd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa2822d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa282f7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa28302
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa282ee
cmp eax, 0x7d00
jae 0xa28325
cmp eax, 0x500
jb 0xa28320
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa2822d
cmp eax, 0x7f
ja 0xa28328
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa2822d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa28356
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa2822d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x44e803e1
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x4f2c59fe
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4062e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b508
cmp edx, dword [eax]
je 0x406307
add eax, 8
inc ecx
cmp eax, 0x40b598
jl 0x4062f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b508]
jne 0x406435
mov eax, dword [0x40ba54]
cmp eax, 1
je 0x40640f
test eax, eax
jne 0x406338
cmp dword [0x40b1b4], 1
je 0x40640f
cmp edx, 0xfc
je 0x406435
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40636f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004037b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004038a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4063b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004038a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40957c
push edi
call fcn.004077b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004037b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004037c0
lea eax, [ebp - 0xa0]
push 0x40955c
push eax
call fcn.004037c0
push dword [esi + 0x40b50c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004037c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407726
add esp, 0x2c
pop edi
jmp 0x406435
lea eax, [ebp + 8]
lea esi, [esi + 0x40b50c]
push 0
push eax
push dword [esi]
call fcn.004038a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x261c441d
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x13ee6e0a
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x405040
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f790
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x482024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x483124
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00424450
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x482adc
push eax
call fcn.00424450
mov esi, dword [0x483134]
xor ebx, ebx
mov edi, dword [0x483138]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x4868f8], bl
mov eax, ebx
mov ecx, 0x483124
cmovae ecx, dword [0x483124]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x486a08], al
inc ebx
cmp ebx, 0x100
jl 0x4050c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x4868f8]
movzx eax, byte [esi + 0x486a08]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x405114
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x4868f8]
mov byte [esi + 0x4868f8], al
inc esi
mov byte [edi + 0x4868f8], dl
cmp esi, 0x100
jl 0x4050f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404d30
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405169
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40515f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4051bf
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4051ab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4051a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4051bf
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00445cee
int3
Function at 0x4065f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f8c0
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x414], edi
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.004419d0
add esp, 0xc
mov dword [ebp - 0x414], 0x400
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x418]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4066a0
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x410]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [edi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4066c6
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
mov ecx, edi
call fcn.00424450
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x40670e
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406704
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40676d
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x406750
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406746
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40676d
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a843
mov esp, ebp
pop ebp
ret
call fcn.00445cee
int3
Function at 0x406780
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 8]
push ecx
push 0xf003f
lea eax, [ebp + 8]
mov dword [ebp - 8], connect
cmovae eax, dword [ebp + 8]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4067e7
cmp dword [ebp + 0x4c], 0x10
lea edx, [ebp + 0x38]
mov eax, dword [ebp + 0x48]
lea ecx, [ebp + 0x20]
cmovae edx, dword [ebp + 0x38]
cmp dword [ebp + 0x34], 0x10
cmovae ecx, dword [ebp + 0x20]
inc eax
push eax
push edx
push 2
push 0
push ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x406824
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40681a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4068b6
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x406866
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40685c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4068b6
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x4068a8
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40689e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4068b6
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a843
mov esp, ebp
pop ebp
ret
call fcn.00445cee
int3
Function at 0x4068c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x4c], 0x10
lea eax, [ebp + 0x38]
push 0
cmovae eax, dword [ebp + 0x38]
push 0
push eax
mov dword [ebp - 0xc], connect
call fcn.004487a8
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xc]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push 0xf003f
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406935
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp - 8]
push 4
push ecx
push 4
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x406972
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406968
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406a04
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4069b4
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4069aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406a04
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x4069f6
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4069ec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406a04
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a843
mov esp, ebp
pop ebp
ret
call fcn.00445cee
int3
Function at 0x408900
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45fb58
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x482024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov edx, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
push 1
push 0x476870
call fcn.004260e0
add esp, 8
xor edx, edx
test al, al
mov ecx, 5
cmove ecx, edx
mov edx, str.runas
push ecx
mov ecx, 0x475b6b
cmovne ecx, edx
push ecx
lea ecx, [ebp + 8]
call fcn.00424450
cmp dword [ebp + 0x4c], 0x10
lea edx, [ebp + 0x38]
push 0
cmovae edx, dword [ebp + 0x38]
lea ecx, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 8]
push 0
cmovae ecx, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0x10
push edx
cmovae eax, dword [ebp + 8]
push ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
mov dword [0x488ac4], esi
cmp edx, 0x10
jb 0x4089d6
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4089cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408a6c
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x408a18
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408a0e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408a6c
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x408a5a
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408a50
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408a6c
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00445cee
int3
Function at 0x408be0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45fb58
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x482024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
mov dword [0x4869f8], 0
call esi
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x489c08]
cmp eax, dword [ecx + 4]
jle 0x408cb1
push 0x489c08
call fcn.0042a968
add esp, 4
cmp dword [0x489c08], 0xffffffff
jne 0x408cb1
push 0x467520
mov dword [0x4893d0], 0
mov dword [0x4893d4], 0xf
mov byte [0x4893c0], 0
mov dword [0x4893e8], 0
mov dword [0x4893ec], 0xf
mov byte [0x4893d8], 0
mov dword [0x489400], 0
mov dword [0x489404], 0xf
mov byte [0x4893f0], 0
call fcn.0042aea5
push 0x489c08
call fcn.0042a91e
add esp, 8
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x4893c0
push eax
call fcn.00424450
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
mov ecx, 0x4893d8
push eax
call fcn.00424450
cmp dword [ebp + 0x4c], 0x10
lea eax, [ebp + 0x38]
push dword [ebp + 0x48]
cmovae eax, dword [ebp + 0x38]
mov ecx, 0x4893f0
push eax
call fcn.00424450
push 0
push 0
push 0x4893c0
push 0x408a80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call esi
mov edx, dword [ebp + 0x1c]
mov esi, dword [0x4869f8]
cmp edx, 0x10
jb 0x408d55
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408d4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408deb
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x408d97
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408d8d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408deb
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x408dd9
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408dcf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408deb
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00445cee
int3
Function at 0x409130
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45fcb0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00407f50
cmp dword [eax + 0x14], 0x10
jb 0x409173
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x4091ae
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4091a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409368
push edx
push ecx
call fcn.0042aeba
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x34], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x482a1c
call fcn.00423520
lea ecx, [ebp - 0x64]
call fcn.004064c0
add esp, 0x18
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
sub esp, 0x18
mov ecx, esp
push 0x482df4
call fcn.00423520
lea ecx, [ebp - 0x30]
call fcn.004064c0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.00424bf0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00424af0
sub esp, 0x14
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x4830dc
call fcn.00423520
mov ecx, esi
call fcn.004064c0
mov ecx, esp
mov byte [ebp - 4], 5
push 1
push str.0123456789
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00424450
mov byte [ebp - 4], 3
call fcn.00408900
mov edx, dword [ebp - 0x38]
add esp, 0x48
cmp edx, 0x10
jb 0x409296
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40928c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40936d
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp edx, 0x10
jb 0x4092dc
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4092d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40936d
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp edx, 0x10
jb 0x40931e
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409314
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40936d
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x40934e
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409344
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409372
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a843
mov esp, ebp
pop ebp
ret
call fcn.00445cee
call fcn.00445cee
call fcn.00445cee
int3
Function at 0x409be0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45fddb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x17c
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x118
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x154]
push 0
push eax
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x28], xmm0
call fcn.004419d0
add esp, 0xc
mov dword [ebp - 0x158], 0x11c
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x409c6d
mov eax, 0x64
jmp 0x409daf
sub esp, 0x18
mov ecx, esp
push 0x483558
call fcn.00423520
lea ecx, [ebp - 0x18c]
call fcn.004064c0
add esp, 0x18
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x409c99
mov eax, dword [eax]
push eax
sub esp, 0x18
mov ecx, esp
push 0x482eb4
call fcn.00423520
lea ecx, [ebp - 0x174]
call fcn.004064c0
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x409cbf
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x160]
mov esi, eax
cmp edx, 0x10
jb 0x409d09
mov ecx, dword [ebp - 0x174]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409cff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409dcc
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x178]
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0xf
mov byte [ebp - 0x174], 0
cmp edx, 0x10
jb 0x409d61
mov ecx, dword [ebp - 0x18c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409d57
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409dcc
push edx
push ecx
call fcn.0042aeba
add esp, 8
mov dword [ebp - 0x17c], 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
push eax
test esi, esi
je 0x409d88
call esi
jmp 0x409d8e
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x154], 6
jb 0x409daf
mov ax, word [ebp - 0x38]
cmp ax, 9
jne 0x409da8
mov eax, 1
jmp 0x409daf
test ax, ax
jne 0x409daf
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042a843
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00445cee
int3

Function at 0x40a090
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0x10
jb 0x40a098
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40a0ab
test al, 0x10
je 0x40a0ab
mov al, 1
ret
xor al, al
ret