joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044f0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404720
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404573
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404720
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404573
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40473c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4045fc
xor eax, eax
push ebp
push 0x4045f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404338
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4045da
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40475c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4045da
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4045fc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404716
cmp byte [ebp - 0xd], 0
jne 0x404643
cmp byte [ebp - 0x12], 0
je 0x404716
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40465c
dec ebx
cmp byte [ebx], 0x2e
je 0x40466b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40465b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404716
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4046a8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404716
cmp byte [ebp - 0xd], 0
je 0x404716
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404716
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4048ac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404912
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403e88
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c0c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4048fc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404919
lea eax, [ebp - 0x10]
call fcn.00403c34
ret

Function at 0x406714
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40674d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403d24
jmp 0x406756
mov eax, ebx
mov edx, esi
call fcn.00403c88
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406760
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406781
mov al, byte [esp]
jmp 0x406783
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406e08
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406c80
mov eax, dword [0x4093b4]
cmp byte [eax], 0
je 0x406e84
mov eax, dword [0x409304]
call fcn.004029cc
call fcn.0040262c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405c08
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406ecc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x406eba
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4092e4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x40a660]
call fcn.004042fc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x407878
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4078dc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403e88
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00405adc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4078e3
lea eax, [ebp - 0xc]
call fcn.00403c34
ret
Function at 0x1002b09
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001708
call fcn.01002d68
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1002b46
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002b46
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002b5e
cmp eax, 0x20b
je 0x1002b4b
mov dword [ebp - 0x1c], ebx
jmp 0x1002b72
cmp dword [ecx + 0x84], 0xe
jbe 0x1002b46
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1002b6c
cmp dword [ecx + 0x74], 0xe
jbe 0x1002b46
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1005054], 0xffffffff
or dword [0x1005058], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1005050]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100504c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100505c], eax
call fcn.01002d60
cmp dword [0x1005030], ebx
jne 0x1002bcd
push fcn.01002d60
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01002d49
push 0x1005010
push 0x100500c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1005048]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1005044]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1005008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x1002c63
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1002c37
cmp al, 0x22
jne 0x1002c29
cmp byte [esi], 0x22
jne 0x1002c40
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1002c4a
cmp al, 0x20
jbe 0x1002c3c
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x1002c6e
movzx eax, word [ebp - 0x50]
jmp 0x1002c71
cmp byte [esi], 0x20
jbe 0x1002c40
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1002c63
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1002c8e
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002cc3
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01002da3
ret
Function at 0x403394
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x51a008], 0x8088405
inc edx
mov dword [ebx + 0x51a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x424778
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42477e
ret

Function at 0x431ff4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4321a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004050cc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4321bc
call fcn.00404d28
mov eax, ebx
call fcn.00422614
mov edi, eax
dec edi
test edi, edi
jl 0x4320ac
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004225e8
mov edx, dword [0x43fdf8]
call fcn.00403d94
test al, al
je 0x4320a8
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.004225e8
lea edx, [ebp - 0x14]
call fcn.0044f0ac
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004050cc
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404d9c
inc esi
dec edi
jne 0x43205a
mov al, byte [0x4321c0]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4321cc
mov eax, dword [ebp - 0xc]
call fcn.0040df00
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404ab4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044f0ac
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4321bc
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0044f0ac
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4321bc
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4321bc
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4321d8
call fcn.00409f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4321ac
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404a40
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404a40
lea eax, [ebp - 0x14]
call fcn.00404a1c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a40
ret
Function at 0x50829c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov edi, 0xa
mov dword [esp + 4], 7
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.00404cdc
mov ebp, eax
test ebp, ebp
jle 0x5082f0
mov esi, 1
mov eax, dword [esp]
mov eax, dword [eax]
mov bl, byte [eax + esi - 1]
mov eax, edi
sub bl, al
mov eax, dword [esp]
call fcn.00404f34
mov byte [eax + esi - 1], bl
inc edi
dec dword [esp + 4]
add edi, edi
xor edi, dword [esp + 4]
inc esi
dec ebp
jne 0x5082c8
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x518e44
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x518fbc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00518dcc
mov byte [0x56d284], 0
push 0x20
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
mov dl, 1
mov eax, dword [0x417c80]
call fcn.0041bfa4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x518f9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00518fec
xor eax, eax
push ebp
push 0x518f6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00519164
mov eax, dword [ebp - 4]
mov byte [eax + 0x3d], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x518ee1
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.005194ac
inc esi
dec ebx
jne 0x518ed3
cmp byte [0x56d284], 0
je 0x518f0a
cmp dword [0x56d288], 0
jle 0x518f0a
mov eax, 0x3938700
cdq
idiv dword [0x56d288]
mov edx, dword [0x55c4b4]
mov word [edx], ax
jmp 0x518f1e
mov dword [0x56d288], 0x927c0
mov eax, dword [0x55c4b4]
mov word [eax], 0x64
mov eax, dword [0x55c4b4]
mov al, byte [eax]
mov edx, dword [0x55c3a8]
mov byte [edx], al
mov eax, dword [ebp - 4]
call fcn.00518d80
mov edx, dword [0x55b820]
mov dword [edx], eax
lea edx, [ebp - 0xc]
mov eax, dword [0x55b820]
mov eax, dword [eax]
call fcn.00409014
mov edx, dword [ebp - 0xc]
mov eax, dword [0x55bc08]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c4]
call fcn.0044f0dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x518f82
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518fa6
mov eax, dword [ebp - 8]
call fcn.00403c08
mov eax, dword [ebp - 4]
mov byte [eax + 0x3c], 0
ret
Function at 0x5a4df8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x5a4e64
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x5a4ead
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.005bd9a0
add esp, 8
test eax, eax
jne 0x5a4eab
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x5a4eaf
jmp 0x5a4e5b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5ad362
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.005a72f7
add esp, 4
and eax, 0xff
test eax, eax
je 0x5ad3eb
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.005b8140
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x5ad3e9
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x5ad3e9
jmp 0x5ad3eb
jmp 0x5ad36b
mov esp, ebp
pop ebp
ret

Function at 0x5ad84c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x5d57f0]
test eax, eax
jne 0x5ad860
call fcn.005ad794
xor ecx, ecx
mov cl, byte [0x5d57ed]
test ecx, ecx
jne 0x5ad8e7
xor edx, edx
mov dl, byte [0x5d57ec]
test edx, edx
jne 0x5ad8e7
cmp dword [0x5d58f4], 0
je 0x5ad8c2
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0x5d58f4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0x5d58f4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x5d58f4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x5ad8e7
push 0x10001
push 0x5d57f0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x5ad8e7
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x5b08ca
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x5b08da
xor eax, eax
jmp 0x5b0aa3
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x5b0a5b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5d39a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5d39a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5d39a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5d39a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5d39a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5d39a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5d39a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5d39a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x5b08e3
cmp dword [ebp + 0x10], 0
je 0x5b0a9d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x5d39a4]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x5b0a61
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x5ba250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x5d0fb8
cmp edx, dword [eax]
je 0x5ba272
add eax, 8
inc ecx
cmp eax, 0x5d1048
jl 0x5ba263
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x5d0fb8]
jne 0x5ba3a0
mov eax, dword [0x5d5970]
cmp eax, 1
je 0x5ba37a
test eax, eax
jne 0x5ba2a3
cmp dword [0x5d0cf4], 1
je 0x5ba37a
cmp edx, 0xfc
je 0x5ba3a0
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5ba2da
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.005b85b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.005b8330
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x5ba31d
lea eax, [ebp - 0x1a4]
push eax
call fcn.005b8330
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5d4dbc
push edi
call fcn.005b8760
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.005b85b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005b85c0
lea eax, [ebp - 0xa0]
push 0x5d4d9c
push eax
call fcn.005b85c0
push dword [esi + 0x5d0fbc]
lea eax, [ebp - 0xa0]
push eax
call fcn.005b85c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.005bc818
add esp, 0x2c
pop edi
jmp 0x5ba3a0
lea eax, [ebp + 8]
lea esi, [esi + 0x5d0fbc]
push 0
push eax
push dword [esi]
call fcn.005b8330
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret