joyce8/EMBER2024-capa huggingface dataset:
Function at 0x25603f80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x2561e74b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push edi
xor ebx, ebx
cmp ebp, ebx
mov edi, ecx
mov eax, dword [edi + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
jle 0x25604112
cmp ebp, dword [edi + 0xc]
je 0x25604112
lea ecx, [ebp + ebp*2]
lea edx, [ecx*8 + 4]
push esi
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x30], ebx
je 0x25604002
push 0x25522466
push 0x25604410
push ebp
lea esi, [eax + 4]
push 0x18
push esi
mov dword [eax], ebp
call fcn.2561c189
mov dword [esp + 0x38], esi
jmp 0x25604006
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], 0xffffffff
cmp dword [edi + 0x14], ebx
jle 0x256040dc
mov dword [esp + 0x18], ebx
jmp 0x25604020
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
call fcn.25604350
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [edi]
mov dword [esp + 0x24], ecx
push eax
mov ecx, edi
mov dword [esp + 0x24], eax
call dword [edx + 4]
xor edx, edx
div ebp
mov ecx, dword [esp + 0x38]
lea eax, [edx + edx*2]
lea esi, [ecx + eax*8]
mov eax, dword [esi + 0xc]
add eax, 8
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, dword [esi + 0xc]
mov ebx, eax
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [ebx + 8]
push ecx
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 0x10]
xor ecx, ecx
add esp, 0x10
cmp eax, ecx
jne 0x2560409e
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], ecx
jmp 0x256040d1
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
cmp eax, ecx
je 0x256040aa
mov dword [eax], ebx
mov eax, dword [esi + 8]
mov dword [ebx], eax
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
mov dword [ebx + 4], eax
mov edx, dword [esi + 8]
mov dword [edx + 4], ebx
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jne 0x256040c7
mov dword [esi], ebx
mov eax, dword [esi + 0x10]
inc eax
mov dword [esi + 8], ebx
mov dword [esi + 0x10], eax
cmp dword [edi + 0x14], ecx
jne 0x25604020
xor ebx, ebx
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x25604100
mov ecx, dword [eax - 4]
lea esi, [eax - 4]
push 0x25522466
push ecx
push 0x18
push eax
call fcn.2561c20b
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], eax
mov dword [edi + 0xc], ebp
pop esi
mov ecx, dword [esp + 0x24]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x25606991
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
mov eax, dword [ecx + 0x10]
push esi
xor esi, esi
sub eax, esi
push edi
je 0x25606a28
dec eax
je 0x25606a0d
dec eax
je 0x256069e9
dec eax
jne 0x25606a47
mov eax, 0x256757b0
lea edx, [ecx + 0xc0]
mov edi, dword [eax]
mov dword [edx], edi
mov edi, dword [eax + 4]
mov dword [edx + 4], edi
add eax, 8
add edx, 8
cmp eax, 0x256757f0
jl 0x256069b8
mov dword [ecx + 0x100], esi
mov dword [ecx + 0x104], esi
mov dword [ecx + 0x108], esi
mov dword [ecx + 0x10c], esi
jmp 0x25606a47
mov eax, 0x256754f0
lea edx, [ecx + 0xc0]
mov edi, dword [eax]
mov dword [edx], edi
mov edi, dword [eax + 4]
mov dword [edx + 4], edi
add eax, 8
add edx, 8
cmp eax, 0x25675530
jl 0x256069f4
jmp 0x256069cf
mov eax, 0x256754d0
lea edx, [ecx + 0x14]
mov edi, dword [eax]
mov dword [edx], edi
add eax, 4
add edx, 4
cmp eax, 0x256754f0
jl 0x25606a15
jmp 0x25606a41
mov eax, 0x256753bc
lea edx, [ecx + 0x14]
mov edi, dword [eax]
mov dword [edx], edi
add eax, 4
add edx, 4
cmp eax, 0x256753d0
jl 0x25606a30
mov dword [ecx + 0x34], esi
mov dword [ecx + 0x38], esi
pop edi
mov dword [ecx + 4], esi
pop esi
ret
Function at 0x2560f2c7
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [esi], 0x534350
push edi
push 0x14
pop eax
mov dword [ebx + 0x1c], eax
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 8], eax
mov al, byte [0x256e5f44]
and word [ebx + 0x18], 0
mov byte [ebx + 0x14], al
mov word [ebx + 0x16], 0x12
mov al, byte [ebx + 0x16]
mov byte [esi + 0xe], al
mov ax, word [ebx + 0x18]
mov word [esi + 0xc], ax
mov al, byte [ebx + 0x14]
mov byte [esi + 0xf], al
mov ax, word [ebx + 0x20]
mov word [esi + 0x10], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edi, dword [ebp + 8]
mov word [ebx + 0x22], ax
push 0
mov word [esi + 0x12], ax
push dword [edi + 4]
mov ecx, ebx
push dword [edi]
call fcn.2561242b
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push 0x14
push esi
call dword [eax + 0x14]
cmp dword [ebp + 0xc], 0x14
je 0x2560f416
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x7c]
mov ecx, eax
xor eax, eax
inc eax
call fcn.2561050c
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 0x7c]
mov edi, str.xg_
mov esi, eax
call fcn.256103b4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x7c]
push 3
pop ecx
cmp dword [eax + 8], ecx
je 0x2560f38c
mov dword [eax + 8], ecx
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x7c]
mov edx, dword [eax]
and dword [eax + 0x61], 0
lea ecx, [eax + 0x65]
push ecx
mov ecx, eax
call dword [edx + 0x18]
push dword [ebp + 0xc]
mov eax, dword [ebx]
push 0x14
push str._IXStream__A_ecrire__u___ecrit__u_
mov ecx, ebx
call dword [eax + 0x7c]
mov esi, eax
call fcn.256108ef
mov eax, dword [ebx]
add esp, 0xc
mov ecx, ebx
call dword [eax + 0x64]
push eax
mov eax, dword [ebx]
push 0x6d69
mov ecx, ebx
call dword [eax + 0x7c]
push eax
mov ecx, edi
call fcn.2561068a
mov eax, dword [ebx]
add esp, 0xc
mov ecx, ebx
call dword [eax + 0x64]
push eax
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 0x7c]
mov ecx, eax
call fcn.25610a11
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x7c]
push eax
lea esi, [ebp - 0x81]
call fcn.2547fb6a
push 0x25692ac0
mov eax, esi
push eax
call sub.MSVCRT.dll__CxxThrowException
add dword [edi], 0x14
adc dword [edi + 4], 0
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x2560f675
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.MSVCRT.dll__beginthread]
push edi
push 0xa
pop ebp
mov ebx, 0x10000
mov edi, 0x2560f617
jmp 0x2560f69b
test ebp, ebp
je 0x2560f6b5
push 0x28
dec ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0x14]
push ebx
push edi
call esi
add esp, 0xc
cmp eax, 0xffffffff
je 0x2560f68e
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
xor eax, eax
jmp 0x2560f6ae
Function at 0x256190b8
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esp + 8], 2
push ebx
push esi
push edi
jl 0x256192d7
mov ebx, dword [esp + 0x18]
cmp ebx, 2
jg 0x256192d7
mov edi, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.bCanCompareEx
push edi
call esi
test eax, eax
mov dword [0x256e5e50], eax
je 0x256192d7
push str.wAjouteEx
push edi
call esi
test eax, eax
mov dword [0x256e5e4c], eax
je 0x256192d7
push str.wSoustraitEx
push edi
call esi
test eax, eax
mov dword [0x256e5e48], eax
je 0x256192d7
push str.wMultiplieEx
push edi
call esi
test eax, eax
mov dword [0x256e5e44], eax
je 0x256192d7
push str.wDiviseEx
push edi
call esi
test eax, eax
mov dword [0x256e5e40], eax
je 0x256192d7
push str.wModuloEx
push edi
call esi
test eax, eax
mov dword [0x256e5e3c], eax
je 0x256192d7
push str.nComparaisonEx
push edi
call esi
test eax, eax
mov dword [0x256e5e38], eax
je 0x256192d7
push str.nEgaliteEx
push edi
call esi
test eax, eax
mov dword [0x256e5e34], eax
je 0x256192d7
push str.nSuperieurEx
push edi
call esi
test eax, eax
mov dword [0x256e5e30], eax
je 0x256192d7
push str.nInferieurEx
push edi
call esi
test eax, eax
mov dword [0x256e5e2c], eax
je 0x256192d7
push str.nPresqueEgalEx
push edi
call esi
test eax, eax
mov dword [0x256e5e28], eax
je 0x256192d7
push str.nSoupleEgalEx
push edi
call esi
test eax, eax
mov dword [0x256e5e24], eax
je 0x256192d7
push str.nCommencePar
push edi
call esi
test eax, eax
mov dword [0x256e5e20], eax
je 0x256192d7
push str.nCommenceParSoupleEx
push edi
call esi
test eax, eax
mov dword [0x256e5e1c], eax
je 0x256192d7
push str.nCommenceParTresSoupleEx
push edi
call esi
test eax, eax
mov dword [0x256e5e18], eax
je 0x256192d7
push str.nETLogiqueEx
push edi
call esi
test eax, eax
mov dword [0x256e5e14], eax
je 0x256192d7
push str.nOULogiqueEx
push edi
call esi
test eax, eax
mov dword [0x256e5e10], eax
je 0x256192d7
push str.nNONLogiqueEx
push edi
call esi
test eax, eax
mov dword [0x256e5e0c], eax
je 0x256192d7
push str.nNegationEx
push edi
call esi
test eax, eax
mov dword [0x256e5e08], eax
je 0x256192d7
push str.nAdditionEx
push edi
call esi
test eax, eax
mov dword [0x256e5e04], eax
je 0x256192d7
push str.nSoustractionEx
push edi
call esi
test eax, eax
mov dword [0x256e5e00], eax
je 0x256192d7
push str.nMultiplicationEx
push edi
call esi
test eax, eax
mov dword [0x256e5dfc], eax
je 0x256192d7
push str.nDivisionEx
push edi
call esi
test eax, eax
mov dword [0x256e5df8], eax
je 0x256192d7
push str.nModuloEx
push edi
call esi
test eax, eax
mov dword [0x256e5df4], eax
je 0x256192d7
mov eax, dword [esp + 0x14]
mov dword [0x256e5f70], eax
xor eax, eax
mov dword [0x256e5f6c], edi
mov dword [0x256e5f74], ebx
inc eax
jmp 0x256192d9
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x2561a8dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
lea eax, [ebp - 0xc]
push esi
push eax
call sub.MSVCRT.dll_strcpy
xor dl, dl
cmp byte [esi], dl
pop ecx
pop ecx
je 0x2561a913
lea ecx, [ebp - 0xc]
push 8
mov byte [esi], dl
mov eax, esi
sub ecx, esi
pop esi
push ebx
mov bl, byte [ecx + eax]
xor bl, 0xb1
mov byte [eax], bl
inc eax
dec esi
mov byte [eax], dl
jne 0x2561a904
pop ebx
pop esi
leave
ret
Function at 0x10007470
Capabilities:
Encode data using xor

Disassembly:
inc edx
xchg ebx, eax
add byte [ebp - 0x7dcd06a], dl
sbb dh, byte [eax + eax*4]
xchg ebp, eax
inc edi
mov ebp, 0x7dd55b57
aad 0x7d
fisubr word [ecx + 0x2f7ec7dc]
cmp dword [eax + 0x7d3a4cd1], edx
lodsd eax, dword [esi]
aad 0xf9
stc
jns sym.Engine.dll_LsaGetSystemAccessAccount
jne 0x1000740e
sub al, 0x3c
push ds
mov eax, dword [0xa1d53f30]
invalid
into
dec esp

Function at 0x10007ad0
Capabilities:
Encode data using xor

Disassembly:
cli
mov dh, 0x96
out dx, al
ja 0x10007b28
imul ecx, edx, 0xffffffef
jno 0x10007b3e
cmc
invalid
dec esi
invalid

Function at 0x100080b0
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x8c
enter 0xffffffffffff9092, 0x69
js 0x10008085
sub dword [edx + 0x58], esi
dec eax
shr byte [edx - 0x71], cl
push eax
mov ebx, 0xdde904
cwde
jb 0x100080a5
retf 0xa382
insb byte es:[edi], dx
inc esp
aas
wait
in al, 0x59
outsd dx, dword [esi]
loope 0x1000807b
xchg esi, eax
add dword [ecx + 0x560cdb17], ecx
mov dword [edi], edx
fisttp dword [esi + edx*2]
or dword [esi + 0x31], ecx
push 0x6d
xor dword [edx + 0x6d], ebp
dec ebp
dec edx
mov dl, dl
xor dword [eax + 0x667440c8], 0x52be045c
enter 0x7440, 0x66
pop esp
add al, 0xbe
push edx
jb 0x100080b7
and al, byte [ecx]
sbb dl, dh
xor dl, byte [edi]

Function at 0x100083c0
Capabilities:
Encode data using xor

Disassembly:
jo 0x100083c9
daa
retf
out dx, al
add edx, 0x65
invalid
mov cl, 0x51

Function at 0x10b564e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10b564ea
pushal
call 0x10b564f0
pop ebp
sub ebp, 0x10
sub ebp, 0xb564e0
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10b56514
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10b5651d
mov eax, 0xb564e0
add eax, ebp
add eax, 0x63
mov ecx, 0x5a4
mov edx, 0xaeade0ba
xor byte [eax], dl
inc eax
dec ecx
jne 0x10b56534
jmp 0x10b56547
xor dword [edi + 0x31], esi
xor eax, dword [esi + 0x3bbababa]
jnp 0x10b56594
mov edx, 0x77b9baba
add bh, byte [edx + edi*4 - 0x6dff4546]
mov edx, 0x584dbaba
mov ecx, 0xb63b3172
mov edx, 0x7fb9baba
aaa
ficomp word [esi - 0x6141ccba]
ljmp 0xd2ba
xor dword [edi], edi
mov dl, 0xba
mov edx, 0xb62f31ba
mov edx, 0x3731baba
stosb byte es:[edi], al
mov edx, 0x537bbaba
mov eax, 0x7839b88b
mov esi, 0x4e3fb5f3
inc ebp
inc ebp
inc ebp
out 0x78, eax
mov dh, 0xba
xor dword [esi], esi
sahf
mov esi, 0xd2bababa
sbb bh, 0x99
mov edx, 0x2b451dd2
mov edx, 0x379e96bb
ficomp word [esi - 0x6149ccba]
push edx
mov edi, 0x53bababa
cmp dword [eax - 0x21c84546], 0xffffff9e
inc esi
xor edx, dword [esi + 0x45e7ee9e]
iretd

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0xcb858b6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0xc99361e
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40720c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409d18
test esi, esi
jne 0x407242
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409ea0
jmp 0x407260
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407150
mov edi, eax
test esi, esi
je 0x407260
cmp dword [ebx], 0
je 0x407260
dec esi
jmp 0x407249
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x408930
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408dbc
mov byte [esp], al
cmp byte [esp], 0
jne 0x408ab9
test edi, edi
je 0x408ab9
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4089f9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4089d4
cmp edi, 0xffffffff
je 0x408995
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408995
mov byte [esp], 0
jmp 0x408ab9
cmp dword [esi], 1
jg 0x4089d4
cmp dword [esi], 0
jne 0x4089c6
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4089c6
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408ab9
lea eax, [esp + 0xc]
call fcn.004085ec
dec ebp
test ebp, ebp
jg 0x40897a
cmp edi, 0xffffffff
je 0x4089f9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4089f7
mov byte [esp], 0
jmp 0x408ab9
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40893e
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4089f9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408b28
mov edx, eax
mov ebx, dword [0x6708fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408a5d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408a5b
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408a5d
xor edi, edi
cmp byte [esp], 0
je 0x408a83
mov ebx, dword [esi]
test bl, 1
jne 0x408a99
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a63
mov byte [esp + 1], 1
jmp 0x408a99
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a83
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408a10
cmp byte [esp], 0
je 0x408ab9
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4096fc
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x672b9c
cmp dword [ebp + 0xc], 2
jl 0x409710
mov ebx, 0x672bcc
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x409748
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x405130
mov dword [0x67001c], eax
mov eax, 0x405138
mov dword [0x670020], eax
mov eax, ebx
call fcn.004095e0
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x40977d
cmp al, 3
jge 0x40977d
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40978e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x409799
call dword [ecx + eax*4]
cmp dword [0x670040], 0
jne 0x4097af
mov byte [0x670048], 1
fnstcw word [0x667028]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00409a48
call fcn.00409690
ret 4

Function at 0x4099b0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x67005c], 0
je 0x409a17
cmp word [0x670348], 0xd7b2
jne 0x4099d9
cmp dword [0x670350], 0
jbe 0x4099d9
mov eax, 0x670344
call dword [0x670360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409a44
call fcn.0040a4c0
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x667032], 0
jne 0x409a33
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x409bd8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x667034], 0
je 0x409c03
mov edx, edi
mov eax, esi
call dword [0x667034]
mov ebx, eax
jmp 0x409c14
mov eax, 8
call fcn.00406e8c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x67005d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409ba0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409c44
mov eax, ebx
call fcn.00406ea8
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40c940
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40caa5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409d18
cmp si, word [0x667a00]
jb 0x40c9d8
cmp si, word [0x667c00]
ja 0x40c9d8
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40c9d8
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x667a00]
jae 0x40c9b2
mov edi, ebx
dec edi
jmp 0x40c9d3
cmp si, word [ebx*8 + 0x667a00]
jbe 0x40c9c2
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40c9d3
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x667a04]
call fcn.0040c860
jmp 0x40c9d8
cmp edi, dword [ebp - 8]
jae 0x40c99c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40ca87
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40ca87
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a878
push dword [ebp - 0x160]
push 0x40cac0
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a878
push dword [ebp - 0x164]
push 0x40cad0
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a878
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040aab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40caac
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409d78
ret
Function at 0x40cc58
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cd5c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x672c14
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x672c2c]
jne 0x40cca4
mov eax, esi
mov edx, 0x672c2e
mov ecx, 0x55
call fcn.0040a878
push 0x672c14
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40cd46
push 0x672c14
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00409d18
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40cd13
cmp byte [0x672c10], 0
je 0x40ccd8
mov edx, esi
mov eax, ebx
call fcn.0040cb3c
jmp 0x40cd13
mov edx, esi
mov eax, ebx
call fcn.0040c940
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40cd13
cmp dword [esi], 0
je 0x40ccfc
mov eax, esi
mov edx, 0x40cd74
call fcn.0040a9d0
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040c940
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a9d0
push 0x672c14
call sub.kernel32.dll_EnterCriticalSection
mov word [0x672c2c], bx
mov eax, dword [esi]
call fcn.0040a7bc
mov ecx, eax
mov eax, 0x672c2e
mov edx, 0xaa
call fcn.0040c7c0
push 0x672c14
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cd63
lea eax, [ebp - 4]
call fcn.00409d18
ret