joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403015
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403024
pop dword [ebp - 0x30]
mov eax, 0x403024
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x9287b941
add dword [ebp - 0x40], 0xbbca8c0a
mov dword [ebp - 0x3c], 0x3e67420f
add dword [ebp - 0x3c], 0xf3cc0a36
mov dword [ebp - 0x38], 0x59680ad0
sub dword [ebp - 0x38], 0xd1bc6a2
mov dword [ebp - 0x34], 0xf3f71e77
add dword [ebp - 0x34], 0xc08e189
lea eax, [ebp - 0x40]
push eax
mov eax, 0x39b7e878
sub eax, 0x39776800
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x1a5fc538
sub dword [ebp - 0x40], 0xa5ed5be2
mov dword [ebp - 0x3c], 0xb13b6f56
add dword [ebp - 0x3c], 0x9030f21f
mov dword [ebp - 0x38], 0xd7ac1b10
add dword [ebp - 0x38], 0x8bc3515c
mov dword [ebp - 0x34], 0xc5a9fdc1
add dword [ebp - 0x34], 0x3a56023f
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xf2767c5e
sub eax, 0xf235fbe2
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x393c0
push 0
call eax
mov ecx, 0x22d97481
sub ecx, 0x22d923b8
mov ebx, eax
mov esi, 0xc259fa0
sub esi, 0xbe00da0
add esi, dword [ebp - 0x30]
mov edi, 0xf038439a
xor dword [ebp - 0x1c], ecx
mov edx, dword [esi]
xor edx, edi
add dword [ebp - 8], edx
mov dword [ebx], edx
xor dword [ebp - 8], 0xb4720c39
add ebx, 0xd732d7c2
add ebx, 0x28cd2842
add esi, 0x8a794baf
add esi, 0x7586b455
loop 0x40313b
add eax, 0xe4316641
sub eax, 0xe430304a
mov ebx, eax
add eax, 0xff23cad3
sub eax, 0xff23cace
mov ecx, 0x68c8d0a1
add ecx, 0x97772f5f
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10006fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10006fbf
pop dword [ebp - 0xc]
mov eax, 0x10006fbf
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x2ecf2658
add dword [ebp - 0x1c], 0x1f831ef3
mov dword [ebp - 0x18], 0x27c2dad6
add dword [ebp - 0x18], 0xa70716f
mov dword [ebp - 0x14], 0xe1f28a32
add dword [ebp - 0x14], 0x6a59b9fc
mov dword [ebp - 0x10], 0x978f3420
add dword [ebp - 0x10], 0x6870cbe0
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xb1d37c08
add eax, 0x5e30a42c
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x9b60a750
add dword [ebp - 0x1c], 0xd911c206
mov dword [ebp - 0x18], 0x9b1c7bda
sub dword [ebp - 0x18], 0x59b01a65
mov dword [ebp - 0x14], 0x5ad53198
add dword [ebp - 0x14], 0x89a3ad4
mov dword [ebp - 0x10], 0x1500f4ac
add dword [ebp - 0x10], 0xeaff0b54
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x47845
push 0
call eax
mov ecx, 0xddea28f8
add ecx, 0x22162097
mov edi, eax
mov ebx, 0xd6c6afac
sub ebx, 0xc6c131ac
add ebx, dword [ebp - 0xc]
mov edx, 0xe431aa25
xor dword [ebp - 4], ecx
mov esi, dword [ebx]
sub dword [ebp - 4], 0xa0be3930
add esi, edx
mov dword [ebp - 8], 0x4e2122d6
mov dword [edi], esi
add dword [ebp - 4], edi
add edi, 4
add ebx, 4
loop 0x100070d1
add eax, 0x1190f
mov ebx, eax
add eax, 0x44872bff
add eax, 0xbb78d406
mov ecx, 0xfb924739
sub ecx, 0xeb924739
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10006fb0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.10006fb0
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10006fb0
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x2a30dd20
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a353dc6
call fcn.2a302657
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30de11
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30ddca
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30ddc7
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30dd8e
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30ddf1
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30de46
test di, di
jne 0x2a30de43
push esi
push dword [ebx + 0x18]
call fcn.2a33e632
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30de46
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a33e632
xor ecx, ecx
jmp 0x2a30de46
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30decd
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a33e632
mov edi, dword [0x2a36bb18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36bb0c]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x2a35835c]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [0x2a35835c]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a33e632
cmp dword [ebp - 0x14], 0
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a33e632
test al, al
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a33ed32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a33e632
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30def1
mov eax, dword [0x2a36b7ac]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [0x2a35835c]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30df25
push eax
mov eax, dword [0x2a36bb38]
cmp word [ebx + 0x196], cx
je 0x2a30df0f
mov esi, dword [eax + 0x124]
jmp 0x2a30df15
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [0x2a35835c]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302bc2
ret
Function at 0x2a32caab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35572a
call fcn.2a304215
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32cccc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a33e632
add esp, 0x10
test eax, eax
js 0x2a32ccc6
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32cb4f
push edi
call fcn.2a32df9a
pop ecx
test al, al
je 0x2a32cb4f
mov eax, edi
call fcn.2a352aa0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32cb61
push edi
lea ecx, [ebp - 0x424]
call fcn.2a33e632
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a33e632
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32ccc6
push 0x60
push ebx
push eax
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32cbb9
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32cbb9
call fcn.2a32b317
mov ebx, eax
jmp 0x2a32cc95
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32cbe0
call fcn.2a32b317
jmp 0x2a32cc88
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32cbd6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32cc13
mov ebx, 0x8007000e
jmp 0x2a32cc8a
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a33e632
jmp 0x2a32cc39
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32cc0c
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a33e632
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a33e632
mov ebx, eax
test edi, edi
je 0x2a32cc95
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32ccae
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccbe
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32ccb4
mov eax, ebx
jmp 0x2a32ccfa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32cce1
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccf1
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32cce7
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30424f
ret 0x10
Function at 0x2a33e632
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x2a33e641
pop dword [ebp - 0x10]
mov eax, 0x2a33e641
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x15c6b975
add dword [ebp - 0x20], 0x388b8bd6
mov dword [ebp - 0x1c], 0x8a391add
add dword [ebp - 0x1c], 0xa7fa3168
mov dword [ebp - 0x18], 0xf9868f8e
add dword [ebp - 0x18], 0x52c5b4a0
mov dword [ebp - 0x14], 0xc2d32f9
sub dword [ebp - 0x14], 0xc2d32f9
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xac164e6c
add dword [ebp - 0x20], 0xc85c1aea
mov dword [ebp - 0x1c], 0x3594904e
sub dword [ebp - 0x1c], 0xf4282ed9
mov dword [ebp - 0x18], 0x38a735f9
add dword [ebp - 0x18], 0x2ac83673
mov dword [ebp - 0x14], 0xfa309627
add dword [ebp - 0x14], 0x5cf69d9
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x4b2e4
push 0
call eax
mov ecx, 0xb81016b
add ecx, 0xf47f491a
mov edi, eax
mov esi, 0x2a37f600
add esi, dword [ebp - 0x10]
mov ebx, 0x72ac0638
add dword [ebp - 0xc], 0x389e04d1
mov edx, dword [esi]
xor dword [ebp - 8], esi
xor edx, ebx
mov dword [edi], edx
add dword [ebp - 0xc], edi
add edi, 0x7d38732e
sub edi, 0x7d38732a
add esi, 0x73bda553
sub esi, 0x73bda54f
loop 0x2a33e748
add eax, 0x11ce7
xor ebx, ebx
add ebx, eax
add eax, 0x5c6208a9
sub eax, 0x5c6208a4
mov ecx, 0x961de8ac
sub ecx, 0x6bede8ac
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40569c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405a88
mov byte [esp], al
cmp byte [esp], 0
jne 0x405825
test edi, edi
je 0x405825
mov byte [esp + 1], 0
test ebp, ebp
jle 0x40575c
call sub.kernel32.dll_GetTickCount_1
mov dword [esp + 4], eax
test ebp, ebp
jle 0x405737
cmp edi, 0xffffffff
je 0x4056fb
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4056fb
mov byte [esp], 0
jmp 0x405825
mov ebx, dword [esi]
cmp ebx, 1
jg 0x405737
test ebx, ebx
jne 0x405730
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402580
test eax, eax
jne 0x405730
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405825
pause
dec ebp
test ebp, ebp
jg 0x4056e0
cmp edi, 0xffffffff
je 0x40575c
call sub.kernel32.dll_GetTickCount_1
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40575a
mov byte [esp], 0
jmp 0x405825
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4056aa
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402580
cmp ebx, eax
jne 0x40575c
call sub.kernel32.dll_GetTickCount_1
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405898
mov edx, eax
mov ebx, dword [0x4dd8c8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4057c3
call sub.kernel32.dll_GetTickCount_1
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4057c1
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4057c3
xor edi, edi
cmp byte [esp], 0
je 0x4057ec
mov ebx, dword [esi]
test bl, 1
jne 0x405805
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402580
cmp ebx, eax
jne 0x4057c9
mov byte [esp + 1], 1
jmp 0x405805
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402580
cmp ebx, eax
jne 0x4057ec
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x405776
cmp byte [esp], 0
je 0x405825
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4065a0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4dd050], 0
je 0x406601
cmp word [0x4dd32c], 0xd7b2
jne 0x4065c9
cmp dword [0x4dd334], 0
jbe 0x4065c9
mov eax, 0x4dd328
call dword [fcn.004dd344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push 0x4da792
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40662c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
pop edx
ret
cmp byte [0x4da028], 0
jne 0x40661d
push 0
push 0x4da78c
push 0x4da792
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4067ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4da02c], 0
je 0x4067d7
mov edx, edi
mov eax, esi
call dword [0x4da02c]
mov ebx, eax
jmp 0x4067e8
mov eax, 8
call fcn.00404368
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x4dd051], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406774
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread_1
mov esi, eax
test esi, esi
jne 0x40681d
mov edx, 8
mov eax, ebx
call fcn.00404384
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x408938
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408a9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004068f0
cmp si, word [0x4da7dc]
jb 0x4089d0
cmp si, word [0x4da9dc]
ja 0x4089d0
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x4089d0
mov ebx, dword [ebp - 8]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4da7dc]
jae 0x4089aa
mov edi, ebx
dec edi
jmp 0x4089cb
cmp si, word [ebx*8 + 0x4da7dc]
jbe 0x4089ba
inc ebx
mov dword [ebp - 8], ebx
jmp 0x4089cb
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4da7e0]
call fcn.00408848
jmp 0x4089d0
cmp edi, dword [ebp - 8]
jae 0x408994
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x408a7f
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale_1
test eax, eax
je 0x408a7f
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004072c0
push dword [ebp - 0x160]
push 0x408ab8
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004072c0
push dword [ebp - 0x164]
push 0x408ac8
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004072c0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004074f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408aa4
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406950
ret
Function at 0x408c50
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408d53
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4dfb51
call sub.kernel32.dll_EnterCriticalSection_1
cmp bx, word [0x4dfb6a]
jne 0x408c9c
mov eax, esi
mov edx, 0x4dfb6c
mov ecx, 0x55
call fcn.004072c0
push 0x4dfb51
call sub.kernel32.dll_LeaveCriticalSection_1
jmp 0x408d3d
push 0x4dfb51
call sub.kernel32.dll_LeaveCriticalSection_1
mov eax, esi
call fcn.004068f0
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale_1
test eax, eax
je 0x408d0b
cmp byte [0x4dfb50], 0
je 0x408cd0
mov edx, esi
mov eax, ebx
call fcn.00408b34
jmp 0x408d0b
mov edx, esi
mov eax, ebx
call fcn.00408938
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408d0b
cmp dword [esi], 0
je 0x408cf4
mov eax, esi
mov edx, 0x408d6c
call fcn.00407418
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408938
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407418
push 0x4dfb51
call sub.kernel32.dll_EnterCriticalSection_1
mov word [0x4dfb6a], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407234
push eax
push 0x4dfb6c
call sub.kernel32.dll_lstrcpynW
push 0x4dfb51
call sub.kernel32.dll_LeaveCriticalSection_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d5a
lea eax, [ebp - 4]
call fcn.004068f0
ret