joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d478
Capabilities:
Encode data using xor

Disassembly:
pushal
jmp 0x43d444
add byte [esi + 0x1454109], dl
imul eax, dword [eax], 0
xchg esi, eax
add eax, 0x8c014541
sub eax, 0x3dee8225
cmp al, byte [ebp + 1]
les eax, [ecx]
ljmp 0:0xfcc8
adc dl, 0x99
mov dx, bp
mov edx, 0xf964dc51
mov esi, 0x64fe62a9
mov ebx, 0x91ed4f71
dec edi
in eax, dx
xchg ecx, eax
movsx ebx, bx
mov cx, ax
call 0x43d478
xchg ebx, eax
adc dword [ebp + 0x4b], edx
test eax, 0x4fe0e4c6
in eax, dx
pop esi
jp 0x43d482
loope 0x43d456
push ebx
inc ebx
push 0x1ce9e28a
add byte [eax], al
add cl, ch
loope 0x43d422
mov esi, 0x2550f6a7
not byte [eax + 0x25]
inc ecx
cmpsb byte [esi], byte es:[edi]
and edi, dword [ebx - 0x2bf7d38d]
test eax, 0xfbc99a7
mov word [esp + eax*4 - 0x4f], gs
or eax, dword [eax - 8]
xor ecx, 0x9dcf3ff3
pop ebp
sbb ch, 0x27
movsx ecx, dx
mov cl, 0xbf
mov ecx, 0x583b06f1
add ebp, 0xc229213e
and bh, 0x31
mov ecx, 0x13b235a9
movsx ebx, dx
xor ebx, 0x455675c1
dec byte [ebp + 0x3dd6de9d]
mov dl, 0x69
dec esi
mov cl, 0xb8
adc edx, 0x3e805361
sub ebp, 1
mov di, cx
adc ecx, 0xbe1abd71
mov edi, esi
mov ecx, 0x81664829
mov ebx, 0x7d28f893
cmp edi, 0x64fe5e70
jne 0x43d4bb
mov edx, 0x47091243
jmp 0x43d43b

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x7e719b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edi*4]
lea esp, [esp + 0xa]
xchg dword [esp + 6], ecx
xchg dh, ah
mov dword [esp + 7], esp
dec edx
jmp 0x7e7120
xchg dword [esp + 3], eax
lea edx, [ebx*4]
xor dl, bl
not cx
stc
sub esp, 0x11
jmp 0x7e7030
mov byte [esp + 8], bh
pop edx
mov dl, byte [esp]
setno ch
bsf eax, esi
jmp 0x7e70f4
mov al, byte [esp + 2]
pop dword [esp]
bswap ecx
sub esp, 0x15
xchg cx, dx
pop eax
jmp 0x7e7066
bts ax, dx
xchg dx, ax
pop dword [esp + 1]
pop cx
rdtsc
cmp dx, cx
jmp 0x7e707c
btr edx, ebp
xchg edx, eax
push dword [esp + 4]
cld
xchg edx, ecx
not ecx
jmp 0x7e70d7
mov ah, 0x4d
std
push dword [esp + 3]
add esp, 3
add esp, 6
xchg word [esp + 4], dx
jmp 0x7e70ad
mov ch, 0xe5
xchg dword [esp + 4], eax
xchg cx, ax
mov word [esp + 2], sp
inc dl
lea eax, [esi*4]
jmp 0x7e7158
mov byte [esp + 0x10], ch
lea eax, [edi*4]
pop ecx
lea edx, reloc.WINMM.dll_midiStreamOut
xchg word [esp + 0xb], cx
lea edx, [edx + esi]
jmp 0x7e70c3
mov dx, 0x7e7
pop word [esp + 8]
lea edx, [ecx*4]
xchg cl, dl
lea eax, [eax*4]
mov eax, dword [esp + 5]
jmp 0x7e7099
xchg dl, al
mov dword [esp + 1], edi
mov al, 0xcb
rdtsc
sub ecx, eax
push di
jmp 0x7e716f
pop edx
mov dx, word [esp + 6]
bsr dx, sp
mov eax, ecx
push word [esp + 6]
xchg byte [esp + 4], ch
jmp 0x7e7142
sets dh
xchg dx, cx
mov eax, 0xa8220587
rcr cl, cl
mov dx, 0x6919
pop word [esp + 8]
jmp 0x7e71c5
add esp, 8
xchg word [esp + 3], ax
bswap eax
xchg byte [esp + 4], ah
pushfd
jmp 0x7e7050
btr eax, edx
mov byte [esp + 9], bh
mov dh, bl
sub esp, 0x1a
rdtsc
jmp 0x7e743f
mov dword [esp + 5], eax
mov eax, 0x37eb4fc5
mov eax, dword [esp + 8]
push word [esp + 0xa]
mov dword [esp + 4], esp
push word [esp + 0xc]
jmp 0x7e71af
push dword [esp + 0x21]
mov cx, si
call fcn.007e71f5
bsf eax, esp
xchg ch, ah
mov ah, 0x5b
pop ecx
pop cx
bswap eax
jmp 0x7e720b

Function at 0x7e7341
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 0x16]
rdtsc
mov ah, byte [esp + 0xc]
mov word [esp + 5], dx
jmp 0x7e735d
sete al
inc ecx
jmp 0x7e732b
rcr ecx, cl
mov al, 4
push dword [esp + 0x14]
pop word [esp + 0x15]
rdtsc
jmp 0x7e73ae
xchg byte [esp + 0x12], al
mov word [esp + 0x13], bx
bt dx, bp
cmp eax, 0xe4e3f05e
mov dx, word [esp]
mov cx, 0x73b1
jmp 0x7e7347
bswap edx
push word [esp + 0xc]
mov word [esp + 0x12], ax
call fcn.007e7406
and bl, byte [ebp - 0x54]
mov edi, 0x66310f86
pop dword [esp + 9]
rdtsc
pop word [esp + 9]
pop eax
mov dh, 0x92
not dx
btc eax, eax
jmp 0x7e7398
Function at 0x7e757c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 7], edx
pop cx
mov cx, word [esp + 1]
lea ecx, [ebx - 0xb0]
neg edx
jmp 0x7e75a3
mov ah, byte [esp + 0x1a]
rol cl, cl
mov cl, byte [esp + 4]
or cx, bp
rdtsc
jmp 0x7e7561
not dl
pop eax
mov dl, byte [esp + 4]
not ah
std
add esp, 0
jmp 0x7e75b4
sub esp, 0xd
xchg ecx, eax
mov cl, dl
pop ecx
bsf ax, ax
lea esp, [esp + 0xd]
jmp 0x7e758d
xchg byte [esp], dl
pop dword [esp]
pop cx
neg ax
lea ecx, [ecx*4]
bsr edx, eax
jmp 0x7e7610
pop dx
mov cx, 0x3bec
pop word [esp + 0xb]
xchg dx, ax
lea ecx, reloc.WINMM.dll_midiStreamOut
cld
jmp 0x7e7638
mov cl, bl
cmc
push dword [esp + 7]
mov ecx, ebx
bsr ecx, edx
mov cl, byte [esp + 8]
jmp 0x7e75eb
pop cx
add ax, 0xbe28
clc
lea ecx, reloc.WINMM.dll_midiStreamOut
shr ecx, 0x12
jmp 0x7e764e
pop word [esp]
pop word [esp]
mov byte [esp + 7], bh
lea eax, [eax + edi]
bswap ecx
pop dword [esp]
jmp 0x7e7622
mov dword [esp], esi
cld
xchg cl, dh
xchg word [esp + 1], cx
mov ecx, dword [esp + 2]
mov dh, byte [esp]
jmp 0x7e76cb
bsf ecx, edi
mov ecx, 0xf03763bd
xchg ch, cl
rdtsc
jmp 0x7e769f
lea eax, [esi*4]
cld
pop word [esp]
jmp 0x7e76b4
mov ax, 0xfe89
stc
xchg ah, cl
shl edx, 7
mov ecx, 0xd54d804b
pop word [esp]
jmp 0x7e7689
mov ax, word [esp + 1]
bswap ecx
mov cl, al
call fcn.007e7746
inc edi
je 0x7e7715
inc ebp
dec ebp
inc ebx
push eax
add byte [ebx - 0x2c99dbfc], cl
ror dword [ebx + reloc.WINMM.dll_midiStreamOut], 1
mov eax, dword [esp]
rcl cx, cl
mov edx, esi
lea esp, [esp]
push word [esp + 1]
sbb eax, ebp
jmp 0x7e7662
mov ch, 0
add byte [eax], al
add byte [edi], cl
sahf
sar edi, 0x74
and al, 1
jmp 0x7e776b
stc
rcr ah, cl
lea esp, [esp + 0x18]
lea ecx, [ebx*4]
jmp 0x7e796d
push word [esp + 5]
xchg dword [esp + 6], ecx
push dword [esp + 6]
pop word [esp + 4]
sub esp, 0x12
pop dx
jmp 0x7e7755
neg dx
pop dx
std
call fcn.007e779d
bswap edx
cld
mov word [esp + 4], cx
mov ax, 0xc252
xchg dl, ah
pop eax
jmp 0x7e77b3
setg dh
mov dl, ch
xchg dx, ax
xchg word [esp], ax
mov ax, word [esp + 4]
stc
jmp 0x7e77ff

Function at 0x7e7a64
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7e7b92
mov byte [esp + 3], ch

Function at 0x7e8109
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cx, dx
mov dx, word [esp + 0xc]
setnp ah
mov word [esp + 0xa], bp
jmp 0x7e8119
mov ax, si
xchg word [esp + 0xa], dx
xchg edx, edi
pop dword [esp + 6]
jmp 0x7e80f3
mov word [esp + 2], bx
xchg byte [esp], dl
mov al, dl
push word [esp + 6]
mov esi, 0x59462feb
push word [esp + 4]

Function at 0x7e8527
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7e8553
mov dword [esp], ebp
xchg dx, bp
pushal
rdtsc
cpuid
jmp 0x7e85a2
not esi
xchg byte [esp + 2], dl
mov ch, ah
lea eax, [esp + ebx]
mov byte [esp], dh
mov ebx, 0x8c186246
jmp 0x7e8529
cpuid
setb bl
cpuid
mov esi, 0x845b48cc
xchg ch, ah
mov eax, ebp
jmp 0x7e85cb
lea edx, reloc.WINMM.dll_midiStreamOut
not ax
pop esi
mov dword [esp + 0xc], ecx
popal
rdtsc
jmp 0x7e8586
push si
lea edi, [esi*4]
mov word [esp], si
call fcn.007e85e6
cdq
clc
invalid
xchg esi, ebx
mov si, 0x4d48
lea ebx, [ebx + 0x90]
mov esi, dword [esp]
lea ebx, [ebp*4]
sets ah
jmp 0x7e85b5
Function at 0x7eb3dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dh
clc
mov bl, 0xda
mov bl, byte [esp + 4]
mov bl, 0xde
mov bh, 0xbe
jmp 0x7eb3e0
lea edx, [edx*4]
pop bx
mov ebp, dword [esp + 4]
rdtsc
jmp 0x7eb3f0
inc ax
jmp 0x7eb3b7
mov dword [esp], edx
cpuid
mov ch, bl
mov ebx, esi
add esp, 0
cpuid
jmp 0x7eb3c6
not ebx
mov word [esp + 3], bp
rdtsc
pop cx
xchg di, dx
mov bh, 0xbf
jmp 0x7eb4ed
xchg word [esp + 6], dx
pop word [esp + 2]
mov ebx, 0xaa430296
jmp 0x7eb456
pop word [esp + 6]
lea ebp, [edi + ebp]
xchg ecx, eax
adc di, ax
dec ebx
mov byte [esp + 9], dl
jmp 0x7eb417
setp cl
not di
mov bx, word [esp + 2]
bsr ebp, ebp
jmp 0x7eb494
mov ax, 0x708f
lea esp, [esp + 3]
xchg al, ch
pop dword [esp]
push dword [esp + 2]
cmc
jmp 0x7eb440
xchg word [esp + 3], bp
mov dl, byte [esp + 4]
xchg dword [esp + 4], ebx
lea edx, [esi*4]
mov edi, 0x717d41cd
mov bh, 0x21
jmp 0x7eb42d
lea eax, [eax + edi]
mov si, 0x1d87
push word [esp]
lea ecx, [ebx*4]
xchg byte [esp], bh
sub esp, 0x1d
jmp 0x7eb4d3
mov word [esp + 2], ax
mov ax, 0x5649
push word [esp + 3]
pushfd
pop ax
mov di, sp
jmp 0x7eb477
cpuid
mov ax, 0x2d6f
mov word [esp + 3], di
add ah, ah
cld
jmp 0x7eb519
xchg word [esp + 2], si
mov cx, 0xbfec
mov word [esp + 3], cx
dec ch
push edx
setge cl
jmp 0x7eb4bd
cmp ch, 0xf9
mov esi, ebx
xchg dword [esp + 0x15], ecx
pop word [esp + 0x18]
xchg dl, bl
jmp 0x7eb5ab
lea edx, [eax*4]
mov ebp, esi
xchg dx, ax
pop word [esp + 0xc]
mov dx, 0x62c7
jmp 0x7eb503
xchg dh, ah
push dword [esp + 0xb]
pop di
dec bp
not ecx
xchg dword [esp + 0xa], esi
jmp 0x7eb53e
add esp, 0xb
clc
xchg dword [esp + 6], esi
std
inc ch
not ebp
jmp 0x7eb55f

Function at 0x7eb737
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebp
or ebx, 0xf10a6f0b
pushfd
sub esp, 0xb
mov word [esp + 6], bp
xchg word [esp + 0xc], dx
jmp 0x7eb752
bts si, di
pop word [esp + 2]
sub esp, 4
std
lea esp, [esp + 0xa]
or bp, cx
jmp 0x7eb6fc
mov byte [esp + 9], cl
call fcn.007eb782
jmp 0x7eb76c
push eax
xchg byte [esp + 0xd], dh
rdtsc
mov ecx, edi
neg ebx
pop ebx
jmp 0x7eb7d3
pop ax
lea ebx, [edx*4]
mov ah, ch
mov dl, byte [esp + 7]
push dword [esp + 6]
push word [esp + 3]
jmp 0x7eb72e
mov ax, si
mov al, byte [esp + 5]
xchg word [esp + 0x10], dx
pop dword [esp + 8]
jmp 0x7eb739
cpuid
lea esp, [esp + 3]
lea eax, [esp + 0x61]
pop si
sub bx, 0x4cd9
call 0x7eb737
mov edi, 0x2fdcb525
lcall 0xcba3, 0xf6647d4
sub esp, 9
mov word [esp + 3], di
lea esi, [ebx - 0x92]
xchg edx, edi
mov dh, byte [esp + 1]
jmp 0x7eb718
mov cx, 0xe1ef
btr bp, bx
sub esp, 0x13
pop ebp
rdtsc
jmp 0x7eb81c
inc dh
mov bp, 0xe466
lea esi, [edi + ebp]
mov word [esp + 7], bx
mov ebp, dword [esp]
setle bh
jmp 0x7eb7bd
xchg word [esp + 5], bx
lea esi, [eax*4]
push dword [esp + 0x12]
mov ah, bh
dec cx
popal
jmp 0x7eb806
Function at 0x7eba49
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], ah
bsr bp, dx
pop dword [esp]
jmp 0x7eba57
mov cx, 0x5660
cpuid
mov bh, cl
cpuid
inc ch
jmp 0x7eba33
mov ecx, 0x44c75c44
add esp, 2
bswap esi
xchg ebp, esi
mov ah, byte [esp + 3]
pushal
jmp 0x7eba8d
mov bp, word [esp + 0xc]
mov word [esp + 0x12], cx
lea edx, reloc.WINMM.dll_midiStreamOut
popal
mov edi, 0x455225ef
add esp, 2
jmp 0x7eba77

Function at 0x7ebf40
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, 0xde30
shr edx, 0xe
lea edx, [edx + edi]
mov si, word [esp]
rcr ax, 1
mov ch, bl
jmp 0x7ebd0d
pop ecx
mov dh, ah
not bl
mov bl, byte [esp]
mov di, 0xf517
mov al, 0x92
jmp 0x7ebc64
lea ecx, [ebx + edi]
mov ebp, ebx
dec si
bt bx, bx
mov ah, 2
mov bl, byte [esp]
jmp 0x7ebcbe
mov ch, dh
cld
xchg ah, cl
xchg dh, bh
lea ecx, reloc.WINMM.dll_midiStreamOut
mov bp, word [esp]
jmp 0x7ebc94
adc ch, bl
mov esi, 0x3d5c22ab
mov dl, 0x36
rdtsc
inc bp
cpuid
jmp 0x7ebcef
xchg bp, ax
rdtsc
btc si, ax
sets bh
btr eax, ebx
bswap ebp
jmp 0x7ebcaa
sub esp, 9
mov dx, di
xor bp, di
xchg dh, ch
mov word [esp + 6], cx
neg bh
jmp 0x7ebdec
mov edx, ebx
mov al, 0x5c
setg dh
mov bx, cx
stc
mov ch, cl
jmp 0x7ebcdd
rdtsc
bswap edx
lea eax, [ebx - 0xcf]
bt edi, ecx
xchg ebp, eax
lea esp, [esp]
jmp 0x7ebd94
lea edx, [esi*4]
cld
std
pop edx
mov cl, ch
adc esi, edx
jmp 0x7ebd74
rcl bp, 0xd
inc bl
mov ax, 0x1232
lea ebx, reloc.WINMM.dll_midiStreamOut
and dx, di
mov bp, si
jmp 0x7ebd1c
mov esi, 0xa252db0e
bsf di, dx
mov byte [esp + 0xb], dl
mov word [esp + 3], dx
cpuid
call fcn.007ebd5e
mov dh, 0x31
mov eax, dword [reloc.WINMM.dll_midiStreamOut]
sub esp, 0x18
pop bx
rdtsc
mov byte [esp + 0x15], bh
xchg bp, ax
mov edx, ebp
jmp 0x7ebd30
xchg byte [esp], dh
mov bx, 0xb5f
mov bp, word [esp + 5]
lea esp, [esp + 1]
setg ch
add esp, 7
jmp 0x7ebd46
mov edi, 0x5e15a780
jmp 0x7ebc84

Function at 0x7ebfae
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7ebfeb
lea esp, [esp + 0x39]
mov ah, byte [esp + 4]
sub esp, 0x15
pop di
xchg esi, ebx
mov dword [esp + 0xa], eax
jmp 0x7ec061
mov bp, 0x49b2
push word [esp + 0x14]
sub esp, 0x18
xchg dword [esp + 3], ebx
rdtsc
and cx, 0x2689
jmp 0x7ebfb0
mov eax, dword [esp + 2]
stc
cpuid
lea ecx, [ebp*4]
jmp 0x7ec045
xchg byte [esp], bh
shr cl, 6
btr bx, bp
cmc
pushfd
mov eax, edx
jmp 0x7ec01f
lea ebp, [esi*4]
mov eax, 0x56590df8
mov dx, 0xd29c
pop edx
jmp 0x7ec08d
add esp, 0x18
add esp, 0
lea edx, [edx*4]
bswap eax
rol al, cl
btc ebp, eax
jmp 0x7ec035
bsf esi, esi
mov bx, word [esp]
not bx
mov si, cx
xchg ah, dl
jmp 0x7ec17b
mov eax, 0x91bcc59a
lea eax, [eax*4]
lea esp, [esp]
cpuid
mov bl, 0x40
rdtsc
jmp 0x7ec077
xchg cl, dl
cpuid
not bx
lea eax, [edx*4]
inc dl
xchg cx, si
jmp 0x7ec0c6
rdtsc
adc edx, 0x5cea818f
setp bl
btc ecx, eax
btc bp, si
xchg edi, eax
jmp 0x7ec0dc
Function at 0x7ec20b
Capabilities:
Access peb ldr_data
Get number of processors
Parse pe header

Disassembly:
call fcn.007eb141
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x7ec256
jmp 0x7ec1f5
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x7eb13c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7ec223
Function at 0x446294
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x461de0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00446229
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042f3b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4462e3
cmp dword [ebp - 0x1c], 5
jb 0x4462fb
jmp 0x4462f7
cmp dword [ebp - 0x10], 1
jne 0x4462fb
cmp dword [ebp - 0x1c], 4
ja 0x4462f7
jne 0x4462fb
cmp dword [ebp - 0x18], 0
jbe 0x4462fb
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x450d0c
call fcn.004460fd
test eax, eax
jge 0x44631c
mov byte [0x466760], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042f39b
add ebp, 0x78
leave
ret

Function at 0x2d43700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02d4378f
jae 0x2d4370e
xor ecx, ecx
call fcn.02d4378f
jae 0x2d4373d
xor eax, eax
call fcn.02d4378f
jae 0x2d4374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02d4378f
adc al, al
jae 0x2d4372f
jne 0x2d43779
stosb byte es:[edi], al
jmp 0x2d43711
call fcn.02d4379b
sub ecx, ebx
jne 0x2d43756
call fcn.02d43799
jmp 0x2d43775
lodsb al, byte [esi]
shr eax, 1
je 0x2d43783
adc ecx, ecx
jmp 0x2d43772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02d43799
cmp eax, 0x7d00
jae 0x2d43772
cmp ah, 5
jae 0x2d43773
cmp eax, 0x7f
ja 0x2d43774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d43711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x2d63700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02d6378f
jae 0x2d6370e
xor ecx, ecx
call fcn.02d6378f
jae 0x2d6373d
xor eax, eax
call fcn.02d6378f
jae 0x2d6374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02d6378f
adc al, al
jae 0x2d6372f
jne 0x2d63779
stosb byte es:[edi], al
jmp 0x2d63711
call fcn.02d6379b
sub ecx, ebx
jne 0x2d63756
call fcn.02d63799
jmp 0x2d63775
lodsb al, byte [esi]
shr eax, 1
je 0x2d63783
adc ecx, ecx
jmp 0x2d63772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02d63799
cmp eax, 0x7d00
jae 0x2d63772
cmp ah, 5
jae 0x2d63773
cmp eax, 0x7f
ja 0x2d63774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d63711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x4076d4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a3cc
test esi, esi
jne 0x40770a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a564
jmp 0x407728
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407618
mov edi, eax
test esi, esi
je 0x407728
cmp dword [ebx], 0
je 0x407728
dec esi
jmp 0x407711
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x409014
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004094d4
mov byte [esp], al
cmp byte [esp], 0
jne 0x40919d
test edi, edi
je 0x40919d
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4090dd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4090b8
cmp edi, 0xffffffff
je 0x409079
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409079
mov byte [esp], 0
jmp 0x40919d
cmp dword [esi], 1
jg 0x4090b8
cmp dword [esi], 0
jne 0x4090aa
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4090aa
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x40919d
lea eax, [esp + 0xc]
call fcn.00408cc8
dec ebp
test ebp, ebp
jg 0x40905e
cmp edi, 0xffffffff
je 0x4090dd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4090db
mov byte [esp], 0
jmp 0x40919d
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409022
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4090dd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409218
mov edx, eax
mov ebx, dword [0x5ff8fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409141
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40913f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409141
xor edi, edi
cmp byte [esp], 0
je 0x409167
mov ebx, dword [esi]
test bl, 1
jne 0x40917d
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409147
mov byte [esp + 1], 1
jmp 0x40917d
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409167
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4090f4
cmp byte [esp], 0
je 0x40919d
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40a064
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5ff05c], 0
je 0x40a0cb
cmp word [0x5ff348], 0xd7b2
jne 0x40a08d
cmp dword [0x5ff350], 0
jbe 0x40a08d
mov eax, 0x5ff344
call dword [0x5ff360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a0f8
call fcn.0040abe4
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x5f9036], 0
jne 0x40a0e7
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40a28c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x5f9038], 0
je 0x40a2b7
mov edx, edi
mov eax, esi
call dword [0x5f9038]
mov ebx, eax
jmp 0x40a2c8
mov eax, 8
call fcn.00406fcc
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x5ff05d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a254
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40a2f8
mov eax, ebx
call fcn.00406fe8
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40dd68
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40decf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a3cc
cmp si, word [0x5f9a18]
jb 0x40de00
cmp si, word [0x5f9c18]
ja 0x40de00
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40de00
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x5f9a18]
jae 0x40ddda
mov edi, ebx
dec edi
jmp 0x40ddfb
cmp si, word [ebx*8 + 0x5f9a18]
jbe 0x40ddea
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40ddfb
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x5f9a1c]
call fcn.0040dc84
jmp 0x40de00
cmp edi, dword [ebp - 8]
jae 0x40ddc4
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40deaf
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40deaf
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b008
push dword [ebp - 0x160]
push 0x40deec
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040b008
push dword [ebp - 0x164]
push 0x40defc
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b008
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040b240
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ded6
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040a42c
pop eax
jmp eax
Function at 0x40e084
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e18a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x601c18
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x601c30]
jne 0x40e0d0
mov eax, esi
mov edx, 0x601c32
mov ecx, 0x55
call fcn.0040b008
push 0x601c18
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40e172
push 0x601c18
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.0040a3cc
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40e13f
cmp byte [0x601c14], 0
je 0x40e104
mov edx, esi
mov eax, ebx
call fcn.0040df68
jmp 0x40e13f
mov edx, esi
mov eax, ebx
call fcn.0040dd68
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40e13f
cmp dword [esi], 0
je 0x40e128
mov eax, esi
mov edx, 0x40e1a4
call fcn.0040b160
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040dd68
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040b160
push 0x601c18
call sub.kernel32.dll_EnterCriticalSection
mov word [0x601c30], bx
mov eax, dword [esi]
call fcn.0040af6c
mov ecx, eax
mov eax, 0x601c32
mov edx, 0xaa
call fcn.0040dbe4
push 0x601c18
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e191
lea eax, [ebp - 4]
call fcn.0040a3cc
pop eax
jmp eax