joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4143e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x4143fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414401
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4143f0
mov eax, 1
add ebx, ebx
jne 0x414413
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414408
jne 0x414424
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414408
xor ecx, ecx
sub eax, 3
jb 0x414438
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4144aa
mov ebp, eax
add ebx, ebx
jne 0x414443
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414450
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414474
inc ecx
add ebx, ebx
jne 0x414460
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414455
jne 0x414471
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414455
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414494
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414485
jmp 0x4143f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414494
add edi, ecx
jmp 0x4143f6
pop esi
mov edi, esi
mov ecx, 0x304
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4144b2
cmp byte [edi], 1
jne 0x4144b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4144b7
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414526
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x141b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14230]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4144e4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14234]
or eax, eax
je 0x414520
mov dword [ebx], eax
add ebx, 4
jmp 0x414501
call dword [esi + 0x14244]
mov ebp, dword [esi + 0x14238]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41455a
sub esp, 0xffffff80
jmp 0x407a18
Function at 0x59f7bc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004099f8
xor eax, eax
push ebp
push 0x59f8fb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x59f8ce
xor edx, edx
push ebp
push 0x59f8c7
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x59f809
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x59f89c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x59f88b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
test eax, eax
je 0x59f84e
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.0040a944
lea ecx, [esi + 2]
mov edx, ebx
call fcn.0040690c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59f892
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x7688a4]
mov dl, 1
mov eax, dword [0x441afc]
call fcn.0044f7f8
call fcn.00408fa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59f902
lea eax, [ebp - 4]
call fcn.00409914
ret

Function at 0x5c573c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.005c57ec
test eax, eax
je 0x5c5777
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.005c57ec
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409a9c
jmp 0x5c5785
mov ecx, esi
mov edx, 0x5c57a4
mov eax, ebx
call fcn.005c56c4
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.00409cf4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5c893e
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports
Terminate process

Disassembly:
sub esp, 0x18
mov ecx, dword fs:[0x30]
mov eax, dword [ecx + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
test edx, edx
je 0x5c894e
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov esi, dword [0x7675c0]
mov ebp, dword [ecx + 0xc]
xor ebx, ebx
mov dword [esp + 4], edx
add ebp, 0xc
mov ebp, dword [ebp]
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x5c896f
test esi, esi
je 0x5c89bc
movzx eax, word [ecx]
mov edx, ebx
test eax, eax
je 0x5c89b8
mov dword [esp + 8], esi
mov eax, ebx
movzx edi, word [ecx + eax*2]
cmp edi, 0x41
jl 0x5c899e
cmp edi, 0x5a
lea esi, [edi + 0x20]
cmovle edi, esi
dec esi
invalid
inc eax
movzx esi, di
add edx, esi
movzx edi, word [ecx + eax*2]
test edi, edi
jne 0x5c898c
nop dword [eax + eax]
mov esi, dword [esp + 8]
cmp esi, edx
jne 0x5c896f
mov edx, dword [esp + 4]
mov ebx, dword [ebp + 0x18]
mov eax, dword [0x7675b4]
cmp dword [eax], 0
je 0x5c8a14
movzx ebp, word [edx]
Function at 0x5db250
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00409914
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5db2a2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5db29b
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040aa00
jmp 0x5db2a2
mov eax, esi
call fcn.00409914
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5e09a4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5e0b03
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x766144], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x536740]
call fcn.00538808
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5e0ad9
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.005388f0
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040aa00
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5e0b1c
call fcn.0040abb0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00538b7c
test al, al
je 0x5e0ac3
lea ecx, [ebp - 4]
mov edx, 0x5e0b90
mov eax, dword [ebp - 0xc]
call fcn.005393a8
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0045178c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5e0ac3
xor edx, edx
push ebp
push 0x5e0abc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5e0ba8
mov eax, dword [ebp - 8]
push eax
call fcn.00411010
test eax, eax
je 0x5e0aa5
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5e0aa5
call fcn.005e0930
test eax, eax
je 0x5e0a95
mov eax, dword [ebx + 0x50]
jmp 0x5e0a98
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x766144]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e0ac3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e0ae0
mov eax, dword [ebp - 0xc]
call fcn.00407bf8
ret

Function at 0x5e0c0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5e0c53
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5e0c36
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5e0c47
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5e0c53
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x643028
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
cmp ebx, dword [ecx]
sal dword [ebp - 0x422ce5bd], cl
xor ebx, dword [ebx]
aad 0xed
out 0xc7, eax
inc edi
push 0x609554ac
lodsd eax, dword [esi]
mov cl, 0x3f
pop esp
pop ebx
enter 0x2ccb, 0x78
fdivr st(5)
cmp cl, ah
wait
mov esp, 0x30ce466a
jne 0x6430ac
enter 0xfffffffffffff447, 0xffffffffffffffa0
lds ebx, [eax + 0x4725e8f3]
push 0xbdd31a5b
inc ebx
sbb edx, ebx
lodsd eax, dword [esi]
xor ebx, dword [ecx]
aad 0xf5
inc edi
mov dword [edi + 0x68], 0x609d54ad
scasb al, byte es:[edi]
mov cl, 0xbb
inc edi
pop ebx
enter 0x2ccb, 0x74
fdivr st(5)
lodsd eax, dword [esi]
push edx
dec esi
or ch, bl
adc dword [ebp + edx*4 + 0x64], 0xffffffad
push esp
popfd
pushal
scasb al, byte es:[edi]
push esi
lea ecx, [eax - 0x54]
push esp
xchg ebp, eax
push eax
lodsd eax, dword [esi]
push esp
popfd
inc eax
scasb al, byte es:[edi]
mov cl, 0x77
inc eax
pop ebx
enter 0x2ccb, 0x70
fdivr st(5)
sub cl, ah
mov dword [ebp + 0x49ed446d], edi
push 0xf08d905b
pop ebx
leave
inc edi
push 0x69000e22
pop ebx
leave
inc edi
ja 0x6430cb
invalid
imul ebx, dword [ebx - 0x37], 0x16117747
push ss
aas
out dx, al
and al, 0x3d
invalid
pop eax
int1
loopne 0x6430b4
inc esi
push 0x6095545b
lodsd eax, dword [esi]
push esi
popfd
invalid
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ax, word [0x406188]
mov cl, byte [0x40618a]
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SoftwareElaborate_BytesVirtualCloneDriveSettings
push 0x80000001
mov word [esp + 0x14], ax
mov byte [esp + 0x16], cl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401069
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0
push str.LocaleName
push edx
mov dword [esp + 0x20], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 4]
push ecx
push 0x408900
push str._smanual_sindex.html
push 0x408a08
call esi
add esp, 0x10
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push 0x408a08
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4010bb
test eax, eax
je 0x4010bb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0xc
ret
push 0x408900
push str._smanualenindex.html
push 0x408a08
call esi
add esp, 0xc
pop esi
add esp, 0xc
ret

Function at 0x4010e0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 0x104
push 0x408900
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401101
mov eax, 0x14
ret 0x10
mov eax, 0x408900
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401110
sub eax, edx
dec eax
je 0x401134
mov cl, 0x5c
mov edi, edi
cmp byte [eax + 0x408900], cl
je 0x40112d
dec eax
jne 0x401120
jmp 0x401134
mov byte [eax + 0x408901], 0
call section..text
push 5
push 0x408900
push 0
push 0x408a08
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
ret 0x10

Function at 0x401440
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4061c0
call fcn.0040226c
push 8
call fcn.00402560
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x408b5c], esi
jne 0x401474
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x408b58], esi
mov al, byte [ebp + 0x10]
mov byte [0x408b54], al
cmp dword [ebp + 0xc], edi
jne 0x4014be
cmp dword [0x409328], edi
je 0x4014ae
mov eax, dword [0x409324]
sub eax, 4
mov dword [0x409324], eax
cmp eax, dword [0x409328]
jb 0x4014ae
mov eax, dword [eax]
cmp eax, edi
je 0x40148f
call eax
jmp 0x40148f
push 0x408020
mov eax, 0x40801c
call fcn.004013be
pop ecx
push 0x408028
mov eax, 0x408024
call fcn.004013be
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4014ef
cmp dword [ebp + 0x10], edi
jne 0x4014fd
mov dword [0x408b5c], esi
push dword [ebp + 8]
call fcn.0040137c
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4014fc
push 8
call fcn.004024ab
pop ecx
ret
call fcn.004022a7
ret
Function at 0x401543
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4082b0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x408038]
je 0x401578
inc eax
cmp eax, 0x13
jb 0x401569
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x408038]
jne 0x40169e
mov eax, dword [0x408b14]
cmp eax, 1
je 0x401676
cmp eax, edx
jne 0x4015a8
cmp dword [0x408034], 1
je 0x401676
cmp ecx, 0xfc
je 0x40169e
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4015de
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00402780
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004029b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x401612
mov eax, edi
push eax
call fcn.004029b0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065b8
push edi
call fcn.00402880
add esp, 0x10
push edi
call fcn.004029b0
push dword [esi + 0x40803c]
mov ebx, eax
call fcn.004029b0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004023d0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00402780
push edi
push ebx
call fcn.00402790
push 0x406598
push ebx
call fcn.00402790
push dword [esi + 0x40803c]
push ebx
call fcn.00402790
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00402683
add esp, 0x2c
jmp 0x40169e
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x40803c]
push dword [esi]
call fcn.004029b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00402a6c
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x1000875a
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x1505
jmp 0x1000877b
push eax
call dword [0x100011e8]
imul edi, edi, 0x21
movzx eax, ax
xor edi, eax
inc esi
pop ecx
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x10008769
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000878b
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x1505
jmp 0x100087b6
mov ecx, dword [ebp + 0xc]
dec dword [ebp + 0xc]
test ecx, ecx
je 0x100087be
push eax
call dword [0x100011e8]
imul edi, edi, 0x21
movzx eax, ax
xor edi, eax
inc esi
pop ecx
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x1000879a
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x419200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x419222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419218
mov eax, 1
add ebx, ebx
jne 0x41923b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419230
jne 0x41924c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419230
xor ecx, ecx
sub eax, 3
jb 0x419260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4192d2
mov ebp, eax
add ebx, ebx
jne 0x41926b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41929c
inc ecx
add ebx, ebx
jne 0x419288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41927d
jne 0x419299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41927d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4192bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4192ad
jmp 0x41921e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4192bc
add edi, ecx
jmp 0x41921e
pop esi
mov edi, esi
mov ecx, 0x156
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4192da
cmp byte [edi], 2
jne 0x4192da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4192df
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41934e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19bbc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c48]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41930c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c4c]
or eax, eax
je 0x419348
mov dword [ebx], eax
add ebx, 4
jmp 0x419329
call dword [esi + 0x19c50]
popal
jmp 0x403c73
Function at 0x408aa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408f60
mov byte [esp], al
cmp byte [esp], 0
jne 0x408c29
test edi, edi
je 0x408c29
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408b69
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408b44
cmp edi, 0xffffffff
je 0x408b05
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408b05
mov byte [esp], 0
jmp 0x408c29
cmp dword [esi], 1
jg 0x408b44
cmp dword [esi], 0
jne 0x408b36
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408b36
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408c29
lea eax, [esp + 0xc]
call fcn.00408778
dec ebp
test ebp, ebp
jg 0x408aea
cmp edi, 0xffffffff
je 0x408b69
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408b67
mov byte [esp], 0
jmp 0x408c29
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408aae
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408b69
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408ca4
mov edx, eax
mov ebx, dword [0x6538fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408bcd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408bcb
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408bcd
xor edi, edi
cmp byte [esp], 0
je 0x408bf3
mov ebx, dword [esi]
test bl, 1
jne 0x408c09
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408bd3
mov byte [esp + 1], 1
jmp 0x408c09
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408bf3
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408b80
cmp byte [esp], 0
je 0x408c29
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409af0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x65305c], 0
je 0x409b57
cmp word [0x653348], 0xd7b2
jne 0x409b19
cmp dword [0x653350], 0
jbe 0x409b19
mov eax, 0x653344
call dword [0x653360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409b84
call fcn.0040a618
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x64a036], 0
jne 0x409b73
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x409d18
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x64a038], 0
je 0x409d43
mov edx, edi
mov eax, esi
call dword [0x64a038]
mov ebx, eax
jmp 0x409d54
mov eax, 8
call fcn.00407000
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x65305d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409ce0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409d84
mov eax, ebx
call fcn.0040701c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40d594
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40d6fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409e58
cmp si, word [0x64aa18]
jb 0x40d62c
cmp si, word [0x64ac18]
ja 0x40d62c
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40d62c
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x64aa18]
jae 0x40d606
mov edi, ebx
dec edi
jmp 0x40d627
cmp si, word [ebx*8 + 0x64aa18]
jbe 0x40d616
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40d627
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x64aa1c]
call fcn.0040d4b0
jmp 0x40d62c
cmp edi, dword [ebp - 8]
jae 0x40d5f0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40d6db
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40d6db
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a918
push dword [ebp - 0x160]
push 0x40d718
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a918
push dword [ebp - 0x164]
push 0x40d728
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a918
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040ab50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d702
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409eb8
pop eax
jmp eax