joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aa6e
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 4], esi
test eax, eax
jne 0x45aa8e
push 0x1cb21e
call fcn.00456bc8
jmp 0x45abee
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x45aaa5
push 0x1cb21f
call fcn.00456bc8
jmp 0x45abed
push ebx
mov ebx, dword [ebp + 8]
push 2
pop ecx
cmp ebx, ecx
je 0x45aac4
cmp ebx, 8
je 0x45aac4
cmp ebx, 3
je 0x45aac4
push 0x1cb220
jmp 0x45abc0
cmp dword [eax], esi
je 0x45aad2
push 0x1cb221
call fcn.00456bc8
cmp dword [edi], esi
je 0x45aae0
push 0x1cb222
call fcn.00456bc8
push edi
push esi
push ebx
mov dword [edi], esi
call sub.Secur32.dll_GetUserNameExW
movzx esi, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x45abc7
cmp eax, 0xea
jne 0x45abc7
mov eax, dword [edi]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c574
mov esi, dword [ebp + 0xc]
pop ecx
mov ecx, eax
mov dword [esi], ecx
test ecx, ecx
jne 0x45ab2f
push 0x1cb240
jmp 0x45aba8
mov eax, dword [edi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ecx
push ebx
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x45ab4a
push 0x1cb241
jmp 0x45aba8
mov eax, dword [edi]
dec eax
cmp dword [ebp - 4], eax
je 0x45ab5c
push 0x1cb242
call fcn.00456bc8
push 2
pop eax
cmp ebx, eax
jne 0x45ab78
push dword [edi]
mov eax, dword [esi]
call fcn.0045aa0a
pop ecx
test eax, eax
jne 0x45abec
push 0x1cb243
jmp 0x45aba8
cmp ebx, 8
jne 0x45abb6
cmp dword [esi], 0
jne 0x45ab89
push 0x1cb21c
jmp 0x45ab9e
push 0x40
push dword [esi]
call dword [sym.imp.MSVCR100.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x45abaf
push 0x1cb21d
call fcn.00456bc8
push 0x1cb244
call fcn.00456bc8
jmp 0x45abd4
xor ecx, ecx
mov word [eax], cx
jmp 0x45abec
cmp ebx, 3
je 0x45abec
push 0x1cb245
call fcn.00456bc8
jmp 0x45abec
push 0x1cb223
call fcn.00456bc8
mov esi, dword [ebp + 0xc]
cmp dword [esi], 0
je 0x45abe4
push dword [esi]
call fcn.0043c581
and dword [esi], 0
pop ecx
cmp dword [edi], 0
je 0x45abec
and dword [edi], 0
pop ebx
pop edi
pop esi
leave
ret

Function at 0x45abf1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 1
push 0x1c
push edi
xor esi, esi
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45ac6c
push dword [ebp + 8]
push edi
push 0x4222ac
call fcn.004436e9
inc esi
cmp dword [ebp + 0xc], 0
je 0x45ac6c
push edi
call fcn.00498f74
test eax, eax
jne 0x45ac6c
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00456f22
add esp, 0xc
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x4222d4
call fcn.00444c6e
lea eax, [ebp - 0x20c]
push eax
call fcn.00498f93
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret
Function at 0x45adc6
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40c], eax
test esi, esi
jne 0x45ae0f
xor eax, eax
jmp 0x45af89
and dword [esi], 0
push ebx
push edi
xor edi, edi
inc edi
push edi
push eax
push ecx
push 0x400
lea eax, [ebp - 0x404]
push eax
call fcn.00499a6f
mov ecx, dword [ebp - 0x40c]
and dword [ebp - 0x408], 0
and dword [ebp - 0x41c], 0
mov ebx, eax
mov eax, ecx
shr eax, 0x1a
not eax
and eax, edi
mov dword [ebp - 0x410], eax
test ebx, ebx
je 0x45ae76
mov eax, ecx
shr eax, 0x17
push ebx
and eax, edi
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ecx, dword [ebp - 0x40c]
mov dword [esi], eax
mov eax, dword [ebp - 0x410]
cmp dword [esi], 0
jne 0x45af23
test eax, eax
je 0x45af23
and dword [ebp - 0x418], 0
push edi
lea eax, [ebp - 0x414]
push eax
push ecx
call fcn.004998f6
test eax, eax
je 0x45af05
mov eax, dword [ebp - 0x40c]
shr eax, 0x19
push ebx
and eax, edi
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x418], eax
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x40c]
call fcn.00499a2a
mov ecx, dword [ebp - 0x418]
cmp ecx, 5
jne 0x45af0b
cmp dword [ebp - 0x41c], 0
jne 0x45af0b
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x41c], edi
jmp 0x45ae50
mov ecx, dword [ebp - 0x418]
cmp dword [esi], 0
je 0x45af23
xor eax, eax
cmp ecx, 0xb7
setne al
mov dword [ebp - 0x408], eax
jmp 0x45af29
mov eax, dword [ebp - 0x408]
cmp dword [esi], 0
je 0x45af33
cmp dword [esi], 0xffffffff
jne 0x45af53
cmp dword [ebp - 0x410], 0
je 0x45af46
push 0x6b633230
call fcn.00456bc8
and dword [esi], 0
xor eax, eax
mov dword [ebp - 0x408], eax
xor edi, edi
mov ecx, dword [ebp - 0x420]
test ecx, ecx
je 0x45af79
test ebx, ebx
jne 0x45af66
mov ebx, 0x42209d
push dword [ebp + 0x14]
push ecx
push ebx
call fcn.0045ad6f
mov eax, dword [ebp - 0x408]
add esp, 0xc
mov ecx, dword [ebp - 0x424]
test ecx, ecx
je 0x45af85
mov dword [ecx], eax
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043f894
leave
ret 0x1c

Function at 0x45cfd5
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
xor edx, edx
push 0xa
pop ecx
div ecx
xor ebx, ebx
mov esi, 0x811c9dc5
lea edx, [eax + 1]
cmp dword [edi + 0x10], ebx
jbe 0x45d016
cmp dword [edi + 0x14], 8
jb 0x45d001
mov eax, dword [edi]
jmp 0x45d003
mov eax, edi
movzx ecx, word [eax + ebx*2]
imul esi, esi, 0x1000193
add ebx, edx
xor esi, ecx
cmp ebx, dword [edi + 0x10]
jb 0x45cff7
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x465dca
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x811c9dc5
jmp 0x465de5
movzx ecx, word [edx]
imul eax, eax, 0x1000193
xor eax, ecx
add edx, 2
cmp edx, dword [ebp + 0xc]
jne 0x465dd7
pop ebp
ret 8

Function at 0x46ab75
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [eax + 0x10], ebx
je 0x46abe2
cmp dword [ebp + 0xc], ebx
je 0x46abe2
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x46abe2
cmp dword [eax + 0x14], 8
jb 0x46ab99
mov eax, dword [eax]
push 1
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call fcn.00497d73
mov esi, eax
cmp esi, 0xffffffff
je 0x46abe2
push ebx
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46abdb
cmp dword [ebp + 8], edi
jne 0x46abdb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x46abe4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x46bdcb
Capabilities:
Delete file

Disassembly:
push 0xb8
mov eax, 0x4a32d6
call fcn.0043fd5f
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], esi
test eax, eax
je 0x46bf88
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0046b123
push esi
lea eax, [ebp - 0xc4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.0046b2d6
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
mov ebx, dword [ebp - 0xc0]
mov edi, dword [ebx]
mov byte [ebp - 4], 2
jmp 0x46be91
lea eax, [edi + 8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0046d86a
cmp byte [ebp - 0x30], 0
mov byte [ebp - 4], 3
jne 0x46be52
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x46be49
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x46be83
mov esi, dword [ebp - 0x94]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x98]
call fcn.004670fa
cmp dword [ebp - 0x5c], esi
jne 0x46be83
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x46be7c
lea eax, [ebp - 0x2c]
push eax
call fcn.0049904e
pop ecx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.0046d8a4
mov edi, dword [edi]
cmp edi, ebx
jne 0x46be27
mov edi, dword [ebp - 0x94]
mov esi, dword [edi]
cmp esi, edi
je 0x46bf20
mov ebx, dword [ebp - 0x50]
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x34]
call fcn.0046ca27
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 4
call fcn.004670fa
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0xc0]
jne 0x46beec
mov eax, dword [ebp - 0x18]
mov cl, byte [eax + 0x1c]
movzx ecx, cl
add eax, 0xc
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
call fcn.00445d4a
jmp 0x46bf0e
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
push dword [ebp + 0x10]
add eax, 0x28
push eax
lea eax, [ecx + 0xc]
movzx ecx, byte [ecx + 0x1c]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, ebx
call fcn.0046bf90
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.0046caef
mov esi, dword [esi]
cmp esi, edi
jne 0x46bea4
mov esi, dword [ebp - 0x58]
push esi
lea eax, [ebp - 0x3c]
push eax
call fcn.0046b123
push eax
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 5
call fcn.0046c73c
lea ecx, [ebp - 0x3c]
call fcn.0046c7ab
cmp dword [ebp - 0x90], 0
jne 0x46bf66
push esi
call fcn.00445d4a
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x14], 8
jb 0x46bf5f
mov eax, dword [eax]
push eax
call fcn.0049904e
pop ecx
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0046973e
lea ecx, [ebp - 0xc4]
call fcn.0046d670
lea ecx, [ebp - 0x98]
call fcn.0046c7ab
call fcn.0043fde2
ret 0x10
Function at 0x475ac0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x475ad3
push 0x57
pop eax
jmp 0x475b8e
push ebx
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov dword [esi], ecx
movzx eax, byte [edi + 0x70]
neg eax
sbb eax, eax
and eax, 0x800000
push eax
push ecx
push ecx
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 0x5c]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
call ebx
mov dword [ebp + 0x14], eax
test eax, eax
je 0x475b1d
lea eax, [ebp + 0x14]
push eax
push 0x42f2a8
push 2
call fcn.00476180
cmp dword [esi], 0
je 0x475b76
cmp byte [edi + 0x72], 0
je 0x475b2f
or dword [edi + 0x68], 0x17e0c00
push 0
push dword [edi + 0x68]
push dword [edi + 0x74]
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
cmp eax, 0xffffffff
jne 0x475b5f
call ebx
mov dword [ebp + 0x14], eax
test eax, eax
je 0x475b8c
lea eax, [ebp + 0x14]
push eax
push 0x42f340
push 2
call fcn.004761e5
jmp 0x475b89
push 4
lea eax, [ebp + 8]
push eax
push 0x2d
push dword [esi]
mov dword [ebp + 8], edi
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x475b7a
call ebx
jmp 0x475b8c
cmp byte [ebp + 0x18], 0
jne 0x475b89
push dword [esi]
mov ecx, edi
call fcn.00475c2a
mov eax, dword [ebp + 0x14]
pop edi
pop ebx
pop esi
pop ebp
ret 0x14

Function at 0x475c2a
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ecx + 0x3c]
lea ecx, [ebp - 0x10]
call fcn.00475dad
lea ecx, [ebp - 0x10]
call fcn.00476612
test al, al
je 0x475cda
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x475cda
mov edi, dword [ebp - 8]
cmp edi, 1
jbe 0x475cda
and dword [ebp - 4], 0
push 0x7fffffff
push 0
add edi, 0xb
push edi
call fcn.004439c9
push eax
lea ecx, [ebp - 4]
call fcn.00445e96
mov esi, dword [ebp - 4]
test al, al
je 0x475ccf
push edi
push esi
push 0x42f294
call fcn.0044081b
push edi
push esi
push ebx
call fcn.004436e9
push edi
push esi
push 0x41b118
call fcn.004436e9
push 0xa0000000
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x475ccf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x475cdc
push esi
call fcn.00456ef0
pop ecx
jmp 0x475cdc
test esi, esi
je 0x475cda
push esi
call fcn.00456ef0
pop ecx
xor edi, edi
lea ecx, [ebp - 0x10]
call fcn.00475de0
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4795fa
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x4f2e00], 0x20
push esi
push edi
mov esi, ecx
je 0x47963b
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x42fb38
push dword [0x4f2e0c]
push dword [0x4f2e08]
call fcn.0049f150
push 0x1c135e
call fcn.00456bc8
lea eax, [esi + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
shl eax, 0xc
xor eax, ecx
mov edi, ecx
and eax, 0x7f000
xor ecx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], ecx
push ebx
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, eax
cmp ecx, edi
jne 0x479650
cmp edx, dword [ebp - 0xc]
jne 0x479650
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x479ed5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x20], ebx
jne 0x479ef0
mov eax, 0x80004005
jmp 0x47a088
cmp byte [esi + 0x17c], bl
je 0x479eff
xor eax, eax
jmp 0x47a088
mov ecx, dword [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
call fcn.00477640
test al, al
jne 0x479f2c
mov eax, dword [esi]
push esi
call dword [eax + 0x30]
test eax, eax
je 0x479f2c
push 0x1c1417
call fcn.00456bc8
push edi
push 0x2710
lea ecx, [esi + 0x38]
call fcn.00481c89
test eax, eax
je 0x479f9e
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, ebx
je 0x479f7c
dec eax
je 0x479f94
dec eax
je 0x479f7c
dec eax
je 0x479f64
push 0x1c1418
call fcn.00456bc8
jmp 0x479f72
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x80004005
jmp 0x47a087
neg ecx
sbb ecx, ecx
and ecx, 0x4e21
dec ecx
push ecx
lea ecx, [esi + 0x38]
call fcn.00481c89
test eax, eax
je 0x479f9e
mov eax, 0x80004004
jmp 0x47a087
mov ecx, dword [esi + 0x24]
mov byte [esi + 0x17c], 1
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edi, [esi + 0x124]
cmp dword [edi + 8], ebx
je 0x479fe0
cmp dword [edi], ebx
je 0x479fe0
jmp 0x479fd1
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
push 1
call dword [eax + 0x7c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 4]
push eax
mov ecx, edi
call fcn.0047b7bc
test al, al
jne 0x479fbe
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x479fec
call fcn.00487d87
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x479ff8
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x47a004
call fcn.004862f6
lea edi, [esi + 0x7c]
cmp dword [edi + 8], ebx
je 0x47a033
cmp dword [edi], ebx
je 0x47a033
jmp 0x47a024
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.0047b7bc
test al, al
jne 0x47a012
lea edi, [esi + 0xd0]
cmp dword [edi + 8], ebx
je 0x47a05c
cmp dword [edi], ebx
je 0x47a05c
jmp 0x47a04d
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0xc]
push eax
mov ecx, edi
call fcn.0047b7bc
test al, al
jne 0x47a044
cmp dword [esi + 0x178], ebx
je 0x47a085
call fcn.00477640
test al, al
je 0x47a07b
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esi + 0x178], ebx
jmp 0x47a085
push 0x1c141d
call fcn.00456bc8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x47d115
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x403b5c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [edi + 8]
mov dword [ebp - 0x24], eax
cmp eax, dword [edx + 4]
jne 0x47d18b
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
and ecx, 0x7ff
cmp ecx, dword [edi + 0x14]
jne 0x47d18b
mov eax, dword [edi + 8]
inc dword [eax + 8]
test byte [0x4f2e00], 0x80
je 0x47d178
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x42fbb8
push dword [0x4f2e0c]
push dword [0x4f2e08]
call fcn.00486583
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043f894
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push ebx
mov byte [ebp - 8], 0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x15], al
push esi
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
lea esp, [esp]
mov eax, ecx
and eax, 0x7ff
xor ebx, ebx
cmp eax, 0x7fb
sete bl
mov edx, ecx
test ebx, ebx
jne 0x47d1db
test eax, eax
je 0x47d1db
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ebx
cmp byte [ebp - 0x15], bl
jne 0x47d205
and ecx, 0xfffff800
add ecx, 0x800
and ecx, 0xfffff800
jmp 0x47d203
mov eax, dword [edi + 0x14]
xor eax, ecx
and eax, 0x7ff
xor ecx, eax
cmp byte [ebp - 0x15], 0
mov dword [ebp - 0x20], 1
je 0x47d205
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
and ecx, 0x7ff
or ecx, eax
mov esi, dword [edi + 8]
mov eax, edx
lock cmpxchg dword [esi], ecx
mov ecx, eax
cmp ecx, edx
jne 0x47d1a1
cmp dword [ebp - 0x20], 0
mov eax, dword [edi + 8]
jne 0x47d2ca
mov eax, dword [eax]
and eax, 0xfffff800
cmp eax, 0x28f5800
jb 0x47d239
push 0x1c124c
call fcn.00456bc8
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x47d271
cmp byte [ebp - 0x15], 0
jne 0x47d258
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [ebp - 0x1c], esi
test ebx, ebx
jne 0x47d271
jmp 0x47d25b
mov esi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, ebx
jae 0x47d28e
sub ebx, ecx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
mov byte [ebp - 0x15], 1
mov dword [ebp - 0x10], ebx
call fcn.0047d50b
jmp 0x47d199
mov eax, dword [edi + 8]
mov eax, dword [eax]
mov esi, dword [edi + 8]
mov ecx, eax
shr ecx, 0xb
dec ecx
mov edx, eax
and eax, 0x7ff
shl ecx, 0xb
or ecx, eax
mov eax, edx
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x47d293
pop esi
pop ebx
mov eax, 0x102
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043f894
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
mov eax, dword [edi + 8]
mov dword [eax + 8], 1
test byte [0x4f2e00], 0x80
je 0x47d303
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x42fbb8
push dword [0x4f2e0c]
push dword [0x4f2e08]
call fcn.00486583
mov ecx, dword [ebp - 4]
neg ebx
sbb ebx, ebx
and ebx, 0x80
pop esi
mov eax, ebx
pop ebx
xor ecx, ebp
pop edi
call fcn.0043f894
mov esp, ebp
pop ebp
ret 8
Function at 0x47ec29
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esi], eax
test edi, edi
je 0x47ec59
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov dword [edi], ecx
xor eax, eax
cmp dword [esi], eax
pop edi
setne al
pop esi
pop ebp
ret 0x14

Function at 0x481937
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4f2ea0], 0
jne 0x4819b5
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x430560
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48199c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x430534
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x481990
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 8]
xor eax, eax
test esi, esi
setne al
mov dword [0x4f2ea0], 1
pop esi
mov dword [0x4f2ea4], eax
leave
ret
mov eax, dword [0x4f2ea4]
leave
ret

Function at 0x481e3d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push 0xffffffffffffffff
push esi
mov edi, ecx
mov dword [ebp - 4], esi
call fcn.0047abcd
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x481e5b
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
cmp dword [eax], esi
je 0x481e6c
mov esi, 0x80004005
jmp 0x481eec
cmp byte [edi + 0x30], 0
je 0x481e62
inc dword [edi + 0x2c]
test byte [edi + 0x2c], 0x3f
jne 0x481e83
push esi
mov ecx, edi
call fcn.00481c89
push ebx
lea ecx, [edi + 0x20]
call fcn.00481f47
mov ebx, eax
test ebx, ebx
jne 0x481e99
mov esi, 0x8007000e
jmp 0x481eeb
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebx], esi
push dword [ebp + 8]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
test ecx, ecx
jne 0x481ed7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x481ece
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x481ee4
mov esi, 0x80004005
jmp 0x481ee4
mov eax, dword [ebp + 0x14]
mov dword [ebx], ecx
test eax, eax
je 0x481ee2
mov dword [eax], ecx
mov ebx, esi
test ebx, ebx
je 0x481eeb
dec dword [edi + 0x24]
pop ebx
mov ecx, edi
call fcn.0047ac14
pop edi
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x48312b
Capabilities:
Encode data using xor

Disassembly:
push esi
lea esi, [ecx + 0x10]
mov edx, dword [esi]
mov eax, edx
and eax, 0xffffc000
add eax, 0x4000
xor eax, edx
and eax, 0xfffc000
mov ecx, edx
xor edx, eax
mov eax, ecx
lock cmpxchg dword [esi], edx
mov edx, eax
cmp edx, ecx
jne 0x483131
pop esi
ret
Function at 0x483d62
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
xor esi, esi
cmp byte [ebx + 8], 0
mov dword [ebp - 4], esi
je 0x483d7f
mov esi, 0x80004005
jmp 0x483e39
mov ecx, dword [ebx + 0x38]
push edi
cmp ecx, dword [ebx + 0x34]
ja 0x483dad
lea eax, [ecx*4 + 0x14]
push eax
push dword [ebx + 0x2c]
call fcn.00476d21
test eax, eax
jne 0x483da6
mov esi, 0x8007000e
jmp 0x483e38
add dword [ebx + 0x38], 5
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 4]
push eax
mov ecx, ebx
call fcn.00483f0b
test eax, eax
jns 0x483dc3
mov edi, dword [ebp - 4]
mov esi, eax
jmp 0x483e2d
mov eax, dword [ebx + 0x40]
or eax, dword [ebx + 0x44]
jne 0x483dd7
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], edx
mov edi, dword [ebp - 4]
xor ecx, ecx
lea eax, [edi + 0x908]
inc ecx
lock xadd dword [eax], ecx
lea eax, [edi + 0x8f0]
push eax
push esi
push edi
push 0x483f88
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x483e0f
mov ecx, edi
call fcn.004836ee
mov esi, 0x80004005
jmp 0x483e2d
mov dword [edi + 0x8ec], eax
mov ecx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x2c]
mov dword [eax + ecx*4], edi
inc dword [ebx + 0x34]
push 0x3e
mov edi, esi
pop edx
lea eax, [ebx + 0x30]
lock xadd dword [eax], edx
test edi, edi
je 0x483e38
mov ecx, edi
call fcn.004836ee
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret