joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100efc70
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100efc7d
xor eax, eax
jmp 0x100efc84
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x1c
call fcn.1009d9b0
test eax, eax
je 0x100efcc8
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xffffffff
mov dword [eax], 0x10041660
mov dword [eax + 4], 2
mov dword [eax + 0x18], 0x11
mov dword [eax + 0x18], edi
ret
mov byte [esi + 0x248], 1
xor eax, eax
ret

Function at 0x100f08b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100f08bd
xor eax, eax
jmp 0x100f08c4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
push 0x10
push 0x1c
call fcn.1009d9b0
test eax, eax
je 0x100f090b
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xffffffff
mov dword [eax], 0x100415f0
mov dword [eax + 4], 5
mov dword [eax + 0x18], 0
mov dword [eax + 0x18], esi
mov dword [esi + 0x10], eax
ret
mov byte [edi + 0x248], 1
xor eax, eax
ret

Function at 0x100f5a90
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [edi + 4], esi
jbe 0x100f5abc
push ebx
xor ebx, ebx
lea ecx, [ecx]
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + ebx + 0x10]
test ecx, ecx
je 0x100f5ab2
push 1
call fcn.1009d9b0
inc esi
add ebx, 0x18
cmp esi, dword [edi + 4]
jb 0x100f5aa0
pop ebx
mov esi, dword [edi + 0xc]
test esi, esi
je 0x100f5aec
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x100f5ada
xor eax, eax
push esi
push eax
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push esi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
ret

Function at 0x1014ccf0
Capabilities:
Get thread local storage value

Disassembly:
cmp word [esi], 0
je 0x1014cd3a
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x1014cd03
xor eax, eax
jmp 0x1014cd0a
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
movzx ecx, word [esi]
cmp ecx, dword [eax + 0x128]
ja 0x1014cd2f
mov edx, dword [edi]
add ecx, ecx
push ebx
mov ebx, dword [eax + 0x124]
test edx, edx
je 0x1014cd2e
mov eax, dword [ebx + ecx*8 - 0xc]
mov dword [edx], eax
mov dword [ebx + ecx*8 - 0xc], edx
pop ebx
mov word [esi], 0
mov dword [edi], 0
ret
Function at 0x1014cd40
Capabilities:
Get thread local storage value

Disassembly:
cmp word [esi + 0x4c], 0
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
je 0x1014cd92
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x1014cd5b
xor eax, eax
jmp 0x1014cd5e
push eax
call edi
movzx ecx, word [esi + 0x4c]
cmp ecx, dword [eax + 0x128]
ja 0x1014cd85
mov edx, dword [esi + 0xc]
add ecx, ecx
push ebx
mov ebx, dword [eax + 0x124]
test edx, edx
je 0x1014cd84
mov eax, dword [ebx + ecx*8 - 0xc]
mov dword [edx], eax
mov dword [ebx + ecx*8 - 0xc], edx
pop ebx
mov word [esi + 0x4c], 0
mov dword [esi + 0xc], 0
cmp word [esi + 0x4e], 0
je 0x1014cddb
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x1014cda6
xor eax, eax
jmp 0x1014cda9
push eax
call edi
movzx ecx, word [esi + 0x4e]
cmp ecx, dword [eax + 0x128]
ja 0x1014cdce
mov edx, dword [esi + 0x14]
mov edi, dword [eax + 0x124]
add ecx, ecx
test edx, edx
je 0x1014cdce
mov eax, dword [edi + ecx*8 - 0xc]
mov dword [edx], eax
mov dword [edi + ecx*8 - 0xc], edx
mov word [esi + 0x4e], 0
mov dword [esi + 0x14], 0
pop edi
ret

Function at 0x10150660
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x101506a6
mov eax, dword [0x101f3dec]
test eax, eax
js 0x101506a6
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x101506a5
push 0x50
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x1c]
add esp, 0xc
test eax, eax
je 0x1015069f
mov dword [eax], esi
mov dword [edi + 0x1c], esi
pop edi
ret
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
pop edi
ret

Function at 0x1015eb00
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x1015eb38
push edi
mov edi, dword [esi]
test edi, edi
je 0x1015eb33
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x1015eb21
xor eax, eax
jmp 0x1015eb28
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push edi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
ret

Function at 0x10163b70
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x10163b85
xor eax, eax
mov dword [eax + 8], esi
mov dword [eax + 0xc], eax
mov dword [eax + 0x10], eax
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov dword [eax + 8], esi
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
ret

Function at 0x10163bb0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x10163bf9
mov eax, dword [0x101f3dec]
push edi
test eax, eax
jns 0x10163bc2
xor edi, edi
jmp 0x10163bcb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
push 0x108
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x10]
add esp, 0xc
test eax, eax
je 0x10163bf2
mov dword [eax], esi
mov dword [edi + 0x10], esi
pop edi
ret
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
pop edi
ret
Function at 0x10166010
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x10166048
push edi
mov edi, dword [esi]
test edi, edi
je 0x10166043
mov eax, dword [0x101f3dec]
test eax, eax
jns 0x10166031
xor eax, eax
jmp 0x10166038
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
push edi
push 0
push dword [eax]
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
mov dword [esi + 4], 0
mov dword [esi], 0
ret

Function at 0x101c5760
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101f3dec]
test eax, eax
js 0x101c57a7
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x101c57a7
push edi
mov edi, dword [eax + 0x20]
mov dword [eax + 0x20], esi
lea ecx, [eax + 0x24]
mov edx, 0xf
jmp 0x101c5790
mov dword [ecx], 0
mov dword [ecx + 4], 0
add ecx, 8
dec edx
jne 0x101c5790
mov eax, edi
pop edi
ret
xor eax, eax
ret

Function at 0x101e5681
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push esi
push 0x10001838
mov esi, ecx
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x101e56b2
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jle 0x101e5744
and eax, 0xffff
or eax, 0x80070000
pop esi
ret
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x1000182c
push eax
call edi
mov dword [esi], eax
test eax, eax
je 0x101e5731
push 0x10001820
push dword [esi + 0x1c]
call edi
mov dword [esi + 4], eax
test eax, eax
je 0x101e5731
push 0x10001810
push dword [esi + 0x1c]
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x101e5731
push 0x10001804
push dword [esi + 0x1c]
call edi
mov dword [esi + 0xc], eax
test eax, eax
je 0x101e5731
push 0x100017f8
push dword [esi + 0x1c]
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x101e5731
push 0x100017f0
push dword [esi + 0x1c]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x101e5731
push 0x100017e4
push dword [esi + 0x1c]
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x101e5731
xor eax, eax
jmp 0x101e5743
push dword [esi + 0x1c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
and dword [esi + 0x1c], 0
mov eax, 0x80004005
pop edi
pop esi
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408afe
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408afe
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408afe
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408afe
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408afe
mov dword [0x41203c], eax
call fcn.00408afe
test eax, eax
jge 0x402550
push 8
call fcn.00408afe
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408afe
pop ecx
push 1
call fcn.00408afe
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408afe
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408afe
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408afe
jmp 0x402495

Function at 0x408afe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x408b0d
pop dword [ebp - 8]
mov eax, 0x408b0d
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x36854
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x8831f03a
add ecx, 0x77ce4d0d
xor edi, edi
add edi, eax
mov esi, 0x413bc4
add esi, dword [ebp - 8]
mov ebx, 0xf884c308
add ebx, 0x657b160d
sub dword [ebp - 4], edi
mov edx, dword [esi]
add dword [ebp - 4], edx
sub edx, ebx
xor dword [ebp - 4], 0x7bc31ab8
mov dword [edi], edx
xor dword [ebp - 4], 0xa3d431d1
add edi, 0x4f1bba7f
sub edi, 0x4f1bba7b
add esi, 0x5136e2af
sub esi, 0x5136e2ab
loop 0x408b5e
add eax, 0x6044bc82
sub eax, 0x6043d493
mov ebx, eax
add eax, 0x9e143e72
add eax, 0x61ebc193
mov ecx, 0xd9187dd6
sub ecx, 0xd8d87dd6
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x408962
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
and edi, eax
mov edi, 0x415fb9db
call fcn.00408989
mov eax, eax
xor dword [esi], ebx
sub eax, eax
inc esi
sub eax, eax
inc edi
cmp esi, ecx
jne fcn.00408962
sub eax, 0x65ad1fda
dec edi
ret
Function at 0x401460
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], 0
mov dword [esp], str.Shell_TrayWnd
call sym._FindWindowW_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
nop
leave
ret

Function at 0x4014e2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.GetAbsolutePath
test eax, eax
je 0x401547
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x10c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
jmp 0x40155a
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_resolve_absolute_path_for__s_n
call sym._printf
nop
leave
ret

Function at 0x40155d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x164
lea edx, [ebp - 0x13c]
mov eax, 0
mov ecx, 0xb
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x13c], 0x2c
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetWindowTextA_12
sub esp, 0xc
test eax, eax
je 0x401672
mov dword [esp + 4], str.Chromium
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x401672
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._SetForegroundWindow_4
sub esp, 4
mov dword [esp], 0
call sym._GetSystemMetrics_4
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [esp], 1
call sym._GetSystemMetrics_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [esp + 0x18], 0x40
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._SetWindowPos_28
sub esp, 0x1c
lea eax, [ebp - 0x13c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetWindowPlacement_8
sub esp, 8
mov eax, dword [ebp - 0x134]
cmp eax, 3
je 0x401672
mov dword [esp + 4], 3
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
mov eax, 1
mov edi, dword [ebp - 4]
leave
ret 8
Function at 0x40167e
Capabilities:
Enumerate gui resources

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call sym.___main
call dbg.hide_taskbar
mov dword [ebp - 0xc], str.ungoogled_chromium_portablepchrome.exe
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dbg.open_exe
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], dbg.EnumWindowsProc@8
call sym._EnumWindows_8
sub esp, 8
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._TranslateMessage_4
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._DispatchMessageA_4
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], dbg.EnumWindowsProc@8
call sym._EnumWindows_8
sub esp, 8
mov dword [esp], 0x64
call sym._Sleep_4
sub esp, 4
jmp 0x4016d1
Function at 0x4022cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40f018
cmp edx, dword [eax]
je 0x4022ef
add eax, 8
inc ecx
cmp eax, 0x40f0a8
jl 0x4022e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40f018]
jne 0x40241d
mov eax, dword [0x40f3dc]
cmp eax, 1
je 0x4023f7
test eax, eax
jne 0x402320
cmp dword [0x40ef6c], 1
je 0x4023f7
cmp edx, 0xfc
je 0x40241d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402357
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00403710
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403800
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40239a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403800
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x405ba0
push edi
call fcn.00403910
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00403710
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403720
lea eax, [ebp - 0xa0]
push 0x405b80
push eax
call fcn.00403720
push dword [esi + 0x40f01c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403720
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040387b
add esp, 0x2c
pop edi
jmp 0x40241d
lea eax, [ebp + 8]
lea esi, [esi + 0x40f01c]
push 0
push eax
push dword [esi]
call fcn.00403800
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x889100
Capabilities:
Encode data using xor

Disassembly:
jmp 0x88910a
pushal
call 0x889110
pop ebp
sub ebp, 0x10
sub ebp, 0x489100
jmp 0x889126
mov eax, 0x489100
add eax, ebp
add eax, 0x4c
mov ecx, 0x615
mov edx, 0x3dc61410
xor byte [eax], dl
inc eax
dec ecx
jne 0x88913d
jmp 0x889150
wait
fstp qword [ebx + 0x10102c99]
adc byte [ecx + 0x1010e8d1], dl
adc byte [ebx], dl
invalid
Function at 0x4070a8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4070ea
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x40710a
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040b294
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x407360
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a6e8
test esi, esi
jne 0x407396
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a870
jmp 0x4073b4
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407244
mov edi, eax
test esi, esi
je 0x4073b4
cmp dword [ebx], 0
je 0x4073b4
dec esi
jmp 0x40739d
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x409338
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004097f8
mov byte [esp], al
cmp byte [esp], 0
jne 0x4094c1
test edi, edi
je 0x4094c1
mov byte [esp + 1], 0
test ebp, ebp
jle 0x409401
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4093dc
cmp edi, 0xffffffff
je 0x40939d
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40939d
mov byte [esp], 0
jmp 0x4094c1
cmp dword [esi], 1
jg 0x4093dc
cmp dword [esi], 0
jne 0x4093ce
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4093ce
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4094c1
lea eax, [esp + 0xc]
call fcn.00408ff4
dec ebp
test ebp, ebp
jg 0x409382
cmp edi, 0xffffffff
je 0x409401
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4093ff
mov byte [esp], 0
jmp 0x4094c1
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409346
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409401
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040953c
mov edx, eax
mov ebx, dword [0x6888fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409465
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x409463
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409465
xor edi, edi
cmp byte [esp], 0
je 0x40948b
mov ebx, dword [esi]
test bl, 1
jne 0x4094a1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40946b
mov byte [esp + 1], 1
jmp 0x4094a1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40948b
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409418
cmp byte [esp], 0
je 0x4094c1
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40a380
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x68805c], 0
je 0x40a3e7
cmp word [0x688348], 0xd7b2
jne 0x40a3a9
cmp dword [0x688350], 0
jbe 0x40a3a9
mov eax, 0x688344
call dword [0x688360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a414
call fcn.0040af30
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x680032], 0
jne 0x40a403
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40a5a8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x680034], 0
je 0x40a5d3
mov edx, edi
mov eax, esi
call dword [0x680034]
mov ebx, eax
jmp 0x40a5e4
mov eax, 8
call fcn.00406f04
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x68805d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a570
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40a614
mov eax, ebx
call fcn.00406f20
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40d3a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40d50d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a6e8
cmp si, word [0x680a10]
jb 0x40d440
cmp si, word [0x680c10]
ja 0x40d440
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40d440
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x680a10]
jae 0x40d41a
mov edi, ebx
dec edi
jmp 0x40d43b
cmp si, word [ebx*8 + 0x680a10]
jbe 0x40d42a
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40d43b
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x680a14]
call fcn.0040d2c8
jmp 0x40d440
cmp edi, dword [ebp - 8]
jae 0x40d404
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40d4ef
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40d4ef
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b294
push dword [ebp - 0x160]
push 0x40d528
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040b294
push dword [ebp - 0x164]
push 0x40d538
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b294
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040b4cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d514
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040a748
ret