joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da386
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x56b06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x47052c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x47052c
call fcn.0046ef20
mov edi, eax
jmp 0x47064b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x47054f
call fcn.0046ef20
jmp 0x47063e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x47056d
call fcn.0046ef20
jmp 0x47063e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x47058e
mov edi, 0x8007000e
jmp 0x470640
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x470684
jb 0x4705ac
cmp eax, 0xffffffff
ja 0x470684
cmp eax, 0x400
jbe 0x4705c1
push eax
lea ecx, [ebp - 0x418]
call fcn.0046eef0
jmp 0x4705e7
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x4705e7
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x4705fe
mov edi, 0x8007000e
jmp 0x470640
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x47061e
call fcn.0046ef20
jmp 0x47063e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00470320
mov edi, eax
test esi, esi
je 0x47064b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x470664
lea ecx, [ebp - 0x418]
call fcn.0046eed0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048358b
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00421000
int3
Function at 0x4866a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x4866b3
mov eax, dword [esi]
jmp 0x4866b5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4866dd
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00486590
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4866f4
mov dword [edi], 0
call fcn.0048a820
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x48672b
push esi
call fcn.004860d0
add esp, 4
test al, al
je 0x486720
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x4867b0
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x4867bc
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4867fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4867fa
cmp eax, 3
je 0x4867fa
cmp eax, 0x7b
je 0x4867fa
cmp eax, 0xf
je 0x4867fa
cmp eax, 0x15
je 0x4867fa
cmp eax, 0x57
je 0x4867fa
cmp eax, 0xa1
je 0x4867fa
cmp eax, 0x35
je 0x4867fa
xor al, al
ret
mov al, 1
ret

Function at 0x486800
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x48680c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x48684a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x48684a
cmp eax, 3
je 0x48684a
cmp eax, 0x7b
je 0x48684a
cmp eax, 0xf
je 0x48684a
cmp eax, 0x15
je 0x48684a
cmp eax, 0x57
je 0x48684a
cmp eax, 0xa1
je 0x48684a
cmp eax, 0x35
je 0x48684a
xor al, al
ret
mov al, 1
ret
Function at 0x486f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db792
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x56b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x486fd1
mov eax, dword [edi]
jmp 0x486fd3
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x486ff2
push esi
push edi
push ebx
call fcn.00486590
add esp, 0xc
jmp 0x4870ee
test eax, 0x400
je 0x4870ad
cmp dword [edi + 0x14], 8
jb 0x487007
mov eax, dword [edi]
jmp 0x487009
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.00438ff0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040a8a0
cmp esi, 0xffffffff
jne 0x487062
push dword [ebp - 0x34]
push edi
push ebx
call fcn.00486590
add esp, 0xc
jmp 0x4870ee
push edi
call fcn.004860d0
add esp, 4
test al, al
jne 0x487095
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.004861b0
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4870ee
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4870bf
mov dword [esi], 0
call fcn.0048a820
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x4870d6
mov dword [ebp - 0x30], 2
call fcn.004861b0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048358b
mov esp, ebp
pop ebp
ret
Function at 0x4876b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db890
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x56b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0x4e3698
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.00409400
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
call fcn.0047192e
add esp, 4
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.004094c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x48c9b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc2c1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x56b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push edi
call fcn.0048f480
mov eax, dword [ebp + 8]
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x24]
mov dword [edi + 0x18], 0
mov ecx, esi
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048ce50
mov dword [esi], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov eax, edi
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x491c20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc8fe
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x56b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x56b0b4]
cmp eax, 0xffffffff
jne 0x491c56
xor ebx, ebx
jmp 0x491c5f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x491d67
cmp dword [ebx + 0x18], 0
jne 0x491c81
cmp dword [ebx + 0xc], 0
je 0x491d5d
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x491d06
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x491cd4
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x491cd4
push 0x49
push str.._boost_thread_win32_thread_heap_alloc.hpp
push str.void___cdecl_boost::detail::free_raw_heap_memory_void__
push str.detail::win32::HeapFree_detail::win32::GetProcessHeap___0_heap_memory__0
call fcn.00422780
add esp, 0x10
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x491c81
push 0x49
push str.._boost_thread_win32_thread_heap_alloc.hpp
push str.void___cdecl_boost::detail::free_raw_heap_memory_void__
push str.detail::win32::HeapFree_detail::win32::GetProcessHeap___0_heap_memory__0
call fcn.00422780
add esp, 0x10
jmp 0x491c81
cmp dword [ebx + 0x18], 0
je 0x491c77
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
cmp dword [esi + 0x14], 0
je 0x491d4e
cmp dword [esi + 0x1c], 0
je 0x491d4e
cmp dword [esi + 0x14], 0
jne 0x491d43
push 0x2bf
push str.._boost_smart_ptr_shared_ptr.hpp
push str.struct_boost::detail::tss_cleanup_function___thiscall_boost::shared_ptr_struct_boost::detail::tss_cleanup_function_::operator__void__const
push str.px___0
call fcn.00422780
add esp, 0x10
mov ecx, dword [esi + 0x14]
push dword [esi + 0x1c]
mov eax, dword [ecx]
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.00490d60
jmp 0x491d06
push 0
call fcn.00491dd0
add esp, 4
mov dword [ebp - 4], 1
test ebx, ebx
je 0x491db1
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x491db1
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x491db1
push 0x49
push str.._boost_thread_win32_thread_heap_alloc.hpp
push str.void___cdecl_boost::detail::free_raw_heap_memory_void__
push str.detail::win32::HeapFree_detail::win32::GetProcessHeap___0_heap_memory__0
call fcn.00422780
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491dd0
Capabilities:
Set thread local storage value

Disassembly:
push 0x490a90
push 0x572d6c
call fcn.004905e0
mov eax, dword [0x56b0b4]
add esp, 8
cmp eax, 0xffffffff
je 0x491e15
push dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x491e2e
push 0x6e
push str.libs_thread_srcwin32_thread.cpp
push str.void___cdecl_boost::_anonymous_namespace::set_current_thread_data_struct_boost::detail::thread_data_base__
push str.TlsSetValue_current_thread_tls_key__new_data_
call fcn.00422780
add esp, 0x10
ret
push 0x72
push str.libs_thread_srcwin32_thread.cpp
push str.void___cdecl_boost::_anonymous_namespace::set_current_thread_data_struct_boost::detail::thread_data_base__
push 0x4e3c78
call fcn.00422780
add esp, 0x10
ret

Function at 0x4953a0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub ecx, edx
push ebx
inc ecx
xor ebx, ebx
push esi
shr ecx, 1
xor esi, esi
push edi
xor edi, edi
cmp edx, dword [esp + 0x14]
cmova ecx, ebx
test ecx, ecx
je 0x4953e9
movzx eax, word [edx]
lea edx, [edx + 2]
imul eax, eax, 0xcc9e2d51
inc edi
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
cmp edi, ecx
jne 0x4953c1
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4a6ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x56b06c]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x4e369a
mov dword [esp + 4], str.___.___
mov dword [esp + 8], 0x4e91cc
mov dword [esp + 0xc], 0x4e91d0
mov dword [esp + 0x10], 0x4e91d4
mov dword [esp + 0x14], 0x4e91d8
mov dword [esp + 0x18], 0x4e3694
mov dword [esp + 0x1c], 0x4e91dc
mov dword [esp + 0x20], 0x4e4720
mov dword [esp + 0x24], 0x4e91e0
mov dword [esp + 0x28], 0x4e91e4
mov dword [esp + 0x2c], 0x4e91e8
mov dword [esp + 0x30], 0x4e91ec
mov dword [esp + 0x34], 0x4e91f0
mov dword [esp + 0x38], 0x4e91f4
mov dword [esp + 0x3c], 0x4e91f8
mov dword [esp + 0x40], 0x4e91fc
mov dword [esp + 0x44], 0x4e9200
mov dword [esp + 0x48], 0x4e8de0
mov dword [esp + 0x4c], 0x4e8de4
mov dword [esp + 0x50], 0x4e920c
mov dword [esp + 0x54], 0x4e9210
mov dword [esp + 0x58], 0x4e369a
mov dword [esp + 0x5c], 0x4e369a
mov dword [esp + 0x60], 0x4e9214
mov dword [esp + 0x64], 0x4e9218
mov dword [esp + 0x68], str._n_:_
mov dword [esp + 0x6c], 0x4e9220
mov dword [esp + 0x70], 0x4e8de8
mov dword [esp + 0x74], 0x4e8dec
mov dword [esp + 0x78], 0x4e8df0
mov dword [esp + 0x7c], 0x4e8df4
mov dword [esp + 0x80], 0x4e8df8
mov dword [esp + 0x84], 0x4e8dfc
mov dword [esp + 0x88], 0x4e8e00
mov dword [esp + 0x8c], 0x4e8e04
mov dword [esp + 0x90], 0x4e9224
mov dword [esp + 0x94], 0x4e9228
mov dword [esp + 0x98], 0x4e8e08
mov dword [esp + 0x9c], 0x4e369a
mov dword [esp + 0xa0], 0x4e369a
mov dword [esp + 0xa4], 0x4e369a
mov dword [esp + 0xa8], 0x4e369a
mov dword [esp + 0xac], 0x4e369a
mov dword [esp + 0xb0], 0x4e369a
mov dword [esp + 0xb4], 0x4e369a
mov dword [esp + 0xb8], 0x4e369a
mov dword [esp + 0xbc], 0x4e8e0c
mov dword [esp + 0xc0], 0x4e8e10
mov dword [esp + 0xc4], 0x4e8e14
mov dword [esp + 0xc8], 0x4e3698
mov dword [esp + 0xcc], 0x4e8e18
mov dword [esp + 0xd0], 0x4e8e1c
mov dword [esp + 0xd4], 0x4e922c
mov dword [esp + 0xd8], 0x4e8e20
mov dword [esp + 0xdc], 0x4e8e24
mov dword [esp + 0xe0], 0x4e8e28
mov dword [esp + 0xe4], 0x4e9230
mov dword [esp + 0xe8], 0x4e8e2c
mov dword [esp + 0xec], 0x4e8e30
cmp cl, 0x3c
jb 0x4a7256
mov eax, 0x4e369a
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.0048358b
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.0048358b
add esp, 0xf4
ret
Function at 0x4a7280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x56b06c]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x4a73eb
add eax, 4
cmp word [eax], cx
jb 0x4a73e3
sub eax, 2
cmp cx, word [eax]
jb 0x4a7410
cmp cx, word [eax + 2]
ja 0x4a7410
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0048358b
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor al, al
xor ecx, esp
call fcn.0048358b
add esp, 0x9c
ret

Function at 0x4c5345
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c51c4

Function at 0x4cad5a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ca6c8

Function at 0x4cad65
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ca903
Function at 0x40e630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
mov eax, dword [esp + 0x60]
push ebx
mov ebx, dword [esp + 0x68]
push ebp
push esi
mov esi, dword [esp + 0x64]
sub eax, esi
push edi
cdq
idiv dword [ebx + 0x14]
mov ebp, eax
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov eax, dword [ebx + 0x14]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x74], esi
jle 0x40e692
mov edx, dword [ebx + 0x18]
mov eax, dword [edx + esi*4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, edi
jle 0x40e68a
mov ecx, dword [ebx + 0x18]
mov dword [esp + 0x74], esi
mov edx, dword [ecx + esi*4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov eax, dword [ebx + 0x14]
inc esi
cmp esi, eax
jl 0x40e666
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], ecx
mov ecx, 0xf
mov esi, 0x4d5968
lea edi, [esp + 0x20]
mov dword [esp + 0x14], eax
lea edx, [eax + ebp - 2]
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x1c], edx
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebx + 0x18]
mov eax, dword [esp + 0x74]
xor esi, esi
mov edi, dword [esp + 0x60]
mov ecx, dword [edx + eax*4]
mov eax, dword [esp + 0x10]
push esi
push ecx
mov ecx, dword [esp + 0x1c]
sub esp, 0x10
mov edx, esp
push edi
mov dword [edx], eax
mov eax, dword [esp + 0x34]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
call fcn.00409a70
add esp, 0x1c
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
push edx
mov dword [esp + 0x2c], esi
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push edi
mov dword [esp + 0x78], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x74], eax
mov eax, dword [ebx + 0x14]
cmp eax, esi
jle 0x40e782
mov edi, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x18]
mov dword [esp + 0x10], eax
lea edx, [edi + ebp]
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edx
mov edx, dword [ecx + esi*4]
push 0x26
push eax
mov eax, dword [esp + 0x68]
push 0xffffffffffffffff
push edx
push eax
call dword [sym.imp.USER32.dll_DrawTextA]
mov eax, dword [ebx + 0x14]
inc esi
add edi, ebp
cmp esi, eax
jl 0x40e73e
mov edi, dword [esp + 0x60]
mov ecx, dword [esp + 0x74]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x70]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x416610
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
mov edx, dword [esp + 0x1c]
push esi
mov esi, ecx
push edi
push 1
mov dword [esi], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov ecx, dword [eax + 0x21]
lea edi, [esi + 0x44]
push edi
push ecx
mov eax, dword [ecx + 0x1e]
mov ecx, esp
mov dword [esi + 0xc], eax
mov edx, dword [edx + 0x21]
push edx
call fcn.00417280
lea eax, [esp + 0x14]
push eax
call fcn.00460650
mov eax, dword [edi + 8]
mov edx, dword [edi]
sub eax, edx
add esp, 0x10
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp dword [eax + 0x6e], 4
je 0x41670f
mov ecx, dword [eax + 0x86]
mov edx, dword [eax + 0x82]
push ecx
push edx
push eax
call fcn.00414cb0
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x18], eax
add esp, 0xc
mov edx, dword [ecx + 0x6e]
mov edi, dword [ecx + 0x82]
cmp edx, 3
mov edx, dword [ecx + 0x86]
jne 0x4166f6
sub edx, edi
mov edi, dword [eax + 8]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0x14]
fild dword [esp + 0x1c]
sub edx, edi
mov dword [esp + 0x1c], edx
fidiv dword [esp + 0x1c]
fstp dword [esi + 0x1c]
mov edx, dword [ecx + 0x8e]
mov edi, dword [ecx + 0x8a]
mov ecx, dword [eax + 0x18]
sub edx, edi
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0xc]
fild dword [esp + 0x1c]
sub ecx, edx
mov dword [esp + 0x1c], ecx
fidiv dword [esp + 0x1c]
fstp dword [esi + 0x20]
jmp 0x416716
sub edx, edi
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
fidiv dword [eax + 4]
mov dword [esi + 0x20], 0
fstp dword [esi + 0x1c]
jmp 0x416716
mov dword [esi + 0x18], 0
mov eax, dword [esi + 8]
pop edi
mov cl, byte [eax + 6]
inc cl
mov byte [eax + 6], cl
mov eax, esi
pop esi
add esp, 0x10
ret 0xc

Function at 0x41bd40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test ebx, ebx
jne 0x41bd56
call edi
mov ebx, eax
call edi
push 0
mov esi, eax
call fcn.0041bcb0
test al, al
jne 0x41bd7e
mov ebp, dword [esp + 0x18]
sub esi, ebx
cmp esi, ebp
jge 0x41bd87
call edi
push 0
mov esi, eax
call fcn.0041bcb0
test al, al
je 0x41bd69
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
Function at 0x42f1b0
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [ecx + 8]
test eax, eax
je 0x42f20e
mov eax, dword [ecx + 0x86]
test eax, eax
je 0x42f20e
push esi
mov edx, 5
mov esi, dword [ecx + 0x8e]
cmp esi, edx
pop esi
je 0x42f20e
mov dword [ecx + 0x9a], 1
mov dword [ecx + 0x8a], eax
mov dword [ecx + 0x6a], 0
mov dword [ecx + 0x8e], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x42f2f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret