joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..reloc]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x41666b
Capabilities:
Authenticate hmac

Disassembly:
mov al, 0xfd
in eax, dx
popal
invalid
out dx, al
mov edi, 0xc2b5d661
loopne 0x4165b4
ret 0xb4e0
push ebp
push ebx
sub byte [ecx], bl
inc ebx
push 1
push eax
iretd
sbb dword [ebx + 0x6a], eax
add dword [eax - 0x31], edx
shr byte cs:[0x723bcfe9], 0x74
out 0x33, eax
test byte [esp + ebx*8 + 0x38], 0xa9
pop edi
sub al, 0x93
jne 0x4165fd
dec edi
fcmovnb st(0), st(0)
dec edi
jo 0x416675
and al, byte [ecx + 0x3bb6952d]
mov bh, 0x86
xor al, 0xd4
mov dh, 0xd2
cmp eax, 0xd84826b4
mov byte [edi - 0x4b443756], dl
mov dword [0x3b80a7ae], eax
mov byte [0xe90e65bd], al
and eax, dword [edi - 0x26]
fcom qword [ebx - 0x75f91c59]
salc
fst dword [esi]
ljmp 0xdf09
mov dword [esi + 0x531ed186], eax
jnp 0x4165f8
loope 0x416603
salc
dec ebx
clc
arpl cx, si
xchg esp, eax
cwde
inc eax
lds eax, [edx - 0x43]
lea ebp, [edx + 0x5c]
test dword [ebp + edi*2 - 5], edi
jl 0x416703
sti
jae 0x4166fc
jbe 0x416684
insw word es:[edi], dx
dec ebp
push ds
add ebp, esi
sbb dl, byte [esi - 0x7a7c40b8]
xchg ebx, eax
adc byte [ebx], al
je 0x4166b6
out dx, al
inc ecx
dec ebx
mov esi, 0xd8eab768
inc edi
or byte [edi - 0x20a9763c], ch
mov word [eax], ds
xchg esi, eax
adc esp, dword [ecx + 0x49]
mov cl, 0xcc
and esp, dword [ebp - 0x58b81b19]
out 0xe4, eax
inc edi
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
or dword [ecx - 0x4c], eax
mov eax, 0xa7b6f79e
in al, 0x8d
and eax, 0xd87a4e0f
nop
je 0x41669e
push es
call 0x2eae6dc9
jecxz 0x41672a
mov ebx, dword [ecx + 0x20]
sbb al, 0xae
adc ch, byte [ebx + eax*8 - 0x3d]
std
push edi
cmp ah, ch
fld qword [esi*4 - 0x5ec928fd]
out 0xfb, al
int1
cmc
sub ebx, eax
lahf
ret
inc esi
jge 0x4166b4
dec ebp
mov al, 0xbb
pop ecx
pop ecx
shl dword [edi - 0x64], 1
inc ecx
wait
fld xword [edx - 0x3bdc731d]
xchg edi, eax
fdivr dword [ecx + 0x3c]
mov word [ebx], gs
mov al, 0xe8
daa
or byte [esi - 0x79], cl
salc
xor bl, ch
push ss
inc esp
invalid
int 0x36
in al, dx
call 0x4fe46a58
cwde
out 0x23, al
rcr edi, 0xe5
and ah, byte [esi]
adc bh, dh
lcall 0xd2af, 0xacc7c212
xchg ebx, eax
sti
mov byte [0xa12ce976], al
sbb byte [ebx - 0x18f12103], ah
cmp edi, esi
clc
and cl, byte [eax - 0x7c5f903a]
add al, 0x91
xchg esi, eax
push eax
mov cl, 0x83
sbb eax, 0x6983941c
or dword [ecx + 0x78], 0xfffffff2
or byte [edi], dh
sbb eax, dword [edi*8 - 0x7eabd9ea]
int3

Function at 0x44a880
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test esi, esi
je 0x44a8d2
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a8c6
mov edx, dword [0x652f44]
push 0x652c78
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret
Function at 0x46031b
Capabilities:
Encode data using xor

Disassembly:
invalid
fidiv word [ebx - 0x5bdd90d]
sbb eax, 0x6ad9c0c9
adc byte [edx], bl
mov dl, 0x14
inc edx
sbb eax, edx
adc dword [ecx + 0x298609ee], esp
fdiv dword [edi - 0x4c]
and dword [esi + edi*4], edx
add al, 0xd
movhlps xmm4, xmm7
das
out 0x17, al
cmp eax, dword [ebp + edx*2 + 0x74]
or al, 0xe8
lahf
or dl, byte [ebp - 0x6f]
arpl word [esi + 0x5cd5907b], di
push esp
fdiv qword [edi + 0x422dbd6e]
dec edx
xchg dword [ecx + 0x1eb0d7c4], eax
mov al, 0x1e
cmpsd dword [esi], dword es:[edi]
mov byte [0x24954476], al
jb 0x4603c2
test al, 0x72
xor eax, 0xce3c274e
xlatb
fistp qword [ecx + 0xe]
jg 0x46035d
insd dword es:[edi], dx
mov dword [0x7f2a16fc], eax
popfd
pop ebp
cli
jecxz 0x460308
invalid
and byte [edx - 0x4fe39721], bl
mov ebp, 0xfc6493fe
adc eax, 0xd76e03cd
sub esp, dword [ecx]
sub dword [esi + 0xc], esp
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
sar dword [esi + 0xfdf5fc7], cl
xor ecx, 0x98730ca5
add dword [ebx - 0x567c144f], esi
pop esi
rcr dword [edx], 0x74
mov edx, 0x9b61611a
das
dec ecx
outsd dx, dword [esi]
cmpsb byte [esi], byte es:[edi]
adc al, 0xc3
inc esi
cwde
fisttp word [edx]
popal
out dx, al
inc esp
invalid

Function at 0x480d30
Capabilities:
Encode data using xor

Disassembly:
dec ecx
xchg ebp, eax
sbb al, 0xc9
mov edx, 0x25b6eb7a
in eax, dx
push ds
rol byte [ebp + 0x46], 0xaa
out dx, al
mov byte [edi - 0x2e225a26], 0x40
dec eax
pop ss
xchg ecx, eax
xchg bh, bh
xor al, 0x6c
mov cs, word [esp + ebx*2 + 0x7b7f0489]
stosd dword es:[edi], eax
mov bh, 0xe3
adc edx, ecx
mov es, ebx
loope 0x480d40
stosd dword es:[edi], eax
mov byte [eax - 0x7c8db421], bl
invalid

Function at 0x55dda0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor dword [ebx - 0x4d710a57], 0xffffffd2
adc ah, al
mov eax, dword [0x9e77616c]
fld st(1)
lodsb al, byte [esi]
mov eax, dword [0x31f4ba9c]
invalid
ror esi, cl
mov ah, 0x21
and ecx, 0x5c
mov bl, 0x61
mov al, 0x6c
push edx
mov dl, bl
das
shr byte [ebp - 0x7d], cl
loopne 0x55dd55
aam 0xa8
leave
test al, 0xc9
std
or eax, 0x460354b0
test eax, 0x406e40c9
sbb eax, 0x857b360
inc esp
inc ebx
jno 0x55dde7
xchg ebx, esi
jg 0x55ddd4
std
cmp ebx, esp
or dword [ecx], edx
adc dword [edx], edx
into
adc cl, dh
in eax, 0x8e
xor dword [edi], 0x18
jae 0x55ddd5
mov edx, cs
xchg ebx, eax
sahf
jmp 0xbc647bb1
add bh, ch
dec eax
movsd dword es:[edi], dword [esi]
pushfd
jp 0x55ddb5
invalid
Function at 0x58685c
Capabilities:
Check for software breakpoints

Disassembly:
insd dword es:[edi], dx
loopne 0x58689d
loopne 0x58686f
add byte [ebp + 0x79c2160e], cl
int3
inc esp
xor esp, dword [eax + 0x54df6b66]
xchg edx, eax
ficomp word [ebx + esi*8 + 3]
dec ebp
cmp eax, 0x30ff8c81
cmp al, 0xcc
fisttp word [esi + ecx*4]
jecxz 0x5868f6
sahf
lahf
bound esi, qword [esi - 0x10]
popfd
mov al, 0x2e
pop eax
inc edx
outsd dx, dword [esi]
mov ss, esp
mov ch, 0x9f
push cs
in al, dx
or al, 0x7e
inc dword [eax - 0x14]
inc eax
in al, dx
pop edx
jmp 0x9ed69656
sub dh, cl
into
insd dword es:[edi], dx
mov esp, 0x49cea81d
jecxz 0x5868a7
mov esp, 0xddd0f37e
sahf
pop ebp
xor al, 0x1c
dec esp
test al, 0xa6
inc esi
push esi
test eax, 0x55f36fff
or al, 0x29
or al, 0x29
pop esi
psrlq mm3, qword [ecx + 0x2de6e1c8]
pushal
lds edx, [ebx + esi*2 + 0x6f321e02]
cmp al, 0x6d
retf
pushal
popal
arpl word [edx + 0x3a2d22ca], si
push ds
sub al, 0xec
salc
push ds
mov al, 0x19
cmpsd dword [esi], dword es:[edi]
loop 0x5868a6
mov dword [0xbbd41ac], eax
mov esp, 0xfc328caa
inc eax
mov dword [0x49d139a0], eax
sti
rcr eax, 0xf9
add ah, byte [eax]
lfs ebp, [esi]
dec edx
or ch, byte [esi]
outsd dx, dword [esi]
inc ebp
pop ss
pushfd
dec eax
xchg edx, eax
jp 0x5868c4
popal
mov ebp, 0x29345eda
cli
mov esi, 0xdfd57d15
pop es
pushfd
mov bl, dh
jmp 0x6e12b551
Function at 0x5f901c
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0xeeb2fbcc
jbe 0x5f9001
inc esp
mov ebx, fs
cmp dl, byte [esi + 0x28447280]
jecxz 0x5f8ff1
xchg esi, eax
xor byte [edx + 0x44], 0x28
jb 0x5f9006
dec edx
mov si, 0xfe24
cmpsd dword [esi], dword es:[edi]
invalid
dec ebp
pop ebp
xchg byte [esi - 0x4f835114], al
cmp ch, ah
movsd dword es:[edi], dword [esi]
lea edx, [edi - 0x72]
dec ecx
imul esp, dword [esi + ecx*2 - 0x1b], 0x26
pop ebp
push ebx
jl 0x5f8fb5
add dh, bl
and al, 0xbf
fiadd dword [ecx - 0x44439362]
salc
stosb byte es:[edi], al
adc edx, dword [eax - 0x5b35ea83]
cwde
insb byte es:[edi], dx
jo 0x5f8fac
mov bh, 0xaa
stosb byte es:[edi], al
cld
imul eax, dword gs:[ebp + 0x35], 0xffffffaf
sub eax, 0xe9405860
xor eax, 0x58602daf
inc eax
jmp 0xded38be1
fdiv st(3), st(0)
jae 0x5f8fe3
sub cl, byte [edi + 0x21]
jnp 0x5f901b
dec edi
and dword [ebx + 0x11], edi
jecxz 0x5f8fc5
loope 0x5f906a
cmp dl, byte [0x40add01c]
imul dword [ebp + 0xd]
push ecx
into
clc
scasb al, byte es:[edi]
inc esp
add dh, byte [esi]
pop ebp
out 0xe1, eax
xchg ebp, eax
shl esi, 0x74
or al, 0xad
aas
mov ah, 0xfb
cld
jns 0x5f90a2
mov ebp, 0x1c13ecd5
jg 0x5f8ffa
pop ecx
cmp esp, ebx
and dword [edx + 0x763025b9], 0x4d
xchg edi, eax
enter 0x5594, 4
fst dword [eax - 0x3e]
adc al, 0x27
xchg esp, eax
pop ebp
fld dword [ebp + 0xd6145f5]
fadd qword [ebx]
or byte [esi - 0x17d3c0e6], ah
out 0x62, al
out 0x55, al
jne 0x5f8ff4
inc ebp
xchg edx, eax
xchg ebp, eax
inc edi
test dword [edi - 0x310129a], edx
or al, 6
push es
invalid
sub eax, 0xdbb224b6
test al, 0x88
in al, 0x13
enter 0xffffffffffffd710, 0xffffffffffffffd8
jecxz 0x5f90ea
mov bl, 0x6f
lodsd eax, dword [esi]
push 0x170d1c
scasd eax, dword es:[edi]
dec eax
or ah, dh
jno 0x5f910e
mov eax, 0xcd137598
mov eax, dword [0xd8b7e3f6]
mov ebp, 0x9e7884c4
dec eax
xor dword [eax + 9], 0xce04b78b
push eax
pop ebp
pop eax
stosb byte es:[edi], al
in al, 0x42
xchg esp, eax
invalid
lea ebp, [0xc455475e]
into
sub eax, 0xcdbc045c
push ebx
invalid
nop
in eax, 0x59
adc eax, 0xac1b4679
pop ebx
lcall 0xd309, 0xb43234fe
sbb ah, byte [ecx]
push ebx
hlt
Function at 0x403644
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x421030], 0x8088405
inc edx
mov dword [0x421030], edx
mul edx
mov eax, edx
ret

Function at 0x40f738
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
xor edx, edx
push ebp
push 0x40eb7d
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [eax], 0x5a4d
je 0x40f761
pop dword fs:[0]
add esp, 8
jmp 0x40f789
lea edx, [eax + 0x3c]
movzx ebx, word [edx]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x40f773
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40f789
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4122a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404554
xor eax, eax
push ebp
push 0x411726
push dword fs:[eax]
mov dword fs:[eax], esp
inc word [ebx + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
lea edx, [ebx + 0x32]
mov cx, word [ebx + 0x30]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x20]
push 0xf
push 1
lea edx, [ebx + 0x3e]
mov ecx, dword [ebp - 4]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x24]
mov dword [ebx + 0x234], eax
add dword [ebx + 0x234], 0xc
movzx esi, word [ebx + 0x30]
mov eax, ebx
call fcn.00412334
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41172d
lea eax, [ebp - 4]
call fcn.00404200
ret
Function at 0x416518
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov dword [ebp - 0x38], 0x10000
xor eax, eax
mov dword [ebp - 0x34], eax
fild qword [ebp - 0x38]
fmul dword [0x415a34]
fistp qword [ebp - 0x38]
wait
call fcn.00405960
mov ebx, eax
call fcn.00405960
cmp ebx, eax
je 0x41653f
rdtsc
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
call fcn.00405960
lea edx, [ebx + 0x3e8]
cmp eax, edx
jb 0x416550
rdtsc
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
fild qword [ebp - 0x40]
fistp qword [ebp - 0x28]
wait
cmp dword [ebp - 4], 0
jae 0x41658b
fild qword [ebp - 0x28]
fild qword [ebp - 0x38]
faddp st(1)
fistp qword [ebp - 0x28]
wait
mov eax, dword [ebp - 8]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
fild qword [ebp - 0x40]
fistp qword [ebp - 0x30]
wait
cmp dword [ebp - 8], 0
jae 0x4165af
fild qword [ebp - 0x30]
fild qword [ebp - 0x38]
faddp st(1)
fistp qword [ebp - 0x30]
wait
fild qword [ebp - 0x28]
fild qword [ebp - 0x38]
fmulp st(1)
fild qword [ebp - 0x30]
faddp st(1)
fistp qword [ebp - 0x18]
wait
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
fild qword [ebp - 0x40]
fistp qword [ebp - 0x28]
wait
cmp dword [ebp - 0xc], 0
jae 0x4165e4
fild qword [ebp - 0x28]
fild qword [ebp - 0x38]
faddp st(1)
fistp qword [ebp - 0x28]
wait
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
fild qword [ebp - 0x40]
fistp qword [ebp - 0x30]
wait
cmp dword [ebp - 0x10], 0
jae 0x416608
fild qword [ebp - 0x30]
fild qword [ebp - 0x38]
faddp st(1)
fistp qword [ebp - 0x30]
wait
fild qword [ebp - 0x28]
fild qword [ebp - 0x38]
fmulp st(1)
fild qword [ebp - 0x30]
faddp st(1)
fistp qword [ebp - 0x20]
wait
fild qword [ebp - 0x20]
fild qword [ebp - 0x18]
fsubp st(1)
fdiv dword [0x415a38]
call fcn.00403510
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x41ca72
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x10]
mov dword [eax + 0xc], edx
mov edx, dword [ebx + 0x1c]
call fcn.0040aec4
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [0x42021c]
mov edx, dword [edx]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebx + 0x10]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xf8]
mov eax, dword [ebx + 0x10]
add eax, 0x604
mov edx, 0x41ca8c
call fcn.00404254
mov byte [ebx + 0x55], 0
cmp byte [ebx + 0x54], 0
je 0x41d60e
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov edx, dword [ebx + 0x40]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xec]
mov eax, dword [ebx + 0x10]
add eax, 0x53c
mov edx, dword [ebx + 0x44]
call fcn.00404254
mov eax, dword [ebx + 0x10]
add eax, 0x540
mov edx, dword [ebx + 0x48]
call fcn.00404254
cmp dword [ebx + 0x34], 0
je 0x41d5f9
mov eax, dword [ebx + 0x10]
mov byte [eax + 0x544], 1
jmp 0x41d603
mov eax, dword [ebx + 0x10]
mov byte [eax + 0x544], 0
mov edx, dword [ebx + 0x50]
mov eax, dword [ebx + 0x10]
call fcn.0040c6e4
mov eax, dword [ebx + 0x10]
mov dword [eax + 0x4c4], ebx
mov dword [eax + 0x4c0], 0x41cb04
mov dword [eax + 0x4dc], ebx
mov dword [eax + 0x4d8], 0x41ca90
mov dword [eax + 0x4cc], ebx
mov dword [eax + 0x4c8], 0x41cef4
xor edx, edx
push ebp
push 0x41ca5e
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [eax]
call dword [edx + 0x70]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41d668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41d67c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x407380
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4073c2
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x4073e2
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040c3fc
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x4075d8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040b33c
test esi, esi
jne 0x40760e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040b4c4
jmp 0x40762c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040751c
mov edi, eax
test esi, esi
je 0x40762c
cmp dword [ebx], 0
je 0x40762c
dec esi
jmp 0x407615
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x409e88
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040a348
mov byte [esp], al
cmp byte [esp], 0
jne 0x40a011
test edi, edi
je 0x40a011
mov byte [esp + 1], 0
test ebp, ebp
jle 0x409f51
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x409f2c
cmp edi, 0xffffffff
je 0x409eed
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409eed
mov byte [esp], 0
jmp 0x40a011
cmp dword [esi], 1
jg 0x409f2c
cmp dword [esi], 0
jne 0x409f1e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x409f1e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x40a011
lea eax, [esp + 0xc]
call fcn.00409b44
dec ebp
test ebp, ebp
jg 0x409ed2
cmp edi, 0xffffffff
je 0x409f51
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409f4f
mov byte [esp], 0
jmp 0x40a011
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409e96
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409f51
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040a08c
mov edx, eax
mov ebx, dword [0x8728fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409fb5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x409fb3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409fb5
xor edi, edi
cmp byte [esp], 0
je 0x409fdb
mov ebx, dword [esi]
test bl, 1
jne 0x409ff1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409fbb
mov byte [esp + 1], 1
jmp 0x409ff1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409fdb
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409f68
cmp byte [esp], 0
je 0x40a011
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40afd4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x87205c], 0
je 0x40b03b
cmp word [0x872348], 0xd7b2
jne 0x40affd
cmp dword [0x872350], 0
jbe 0x40affd
mov eax, 0x872344
call dword [0x872360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40b068
call fcn.0040bd7c
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x7fb032], 0
jne 0x40b057
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40b1fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x7fb034], 0
je 0x40b227
mov edx, edi
mov eax, esi
call dword [0x7fb034]
mov ebx, eax
jmp 0x40b238
mov eax, 8
call fcn.00407180
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x87205d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40b1c4
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40b268
mov eax, ebx
call fcn.0040719c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40e700
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40e865
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b33c
cmp si, word [0x7fba20]
jb 0x40e798
cmp si, word [0x7fbc20]
ja 0x40e798
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40e798
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x7fba20]
jae 0x40e772
mov edi, ebx
dec edi
jmp 0x40e793
cmp si, word [ebx*8 + 0x7fba20]
jbe 0x40e782
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40e793
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x7fba24]
call fcn.0040e620
jmp 0x40e798
cmp edi, dword [ebp - 8]
jae 0x40e75c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40e847
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40e847
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040c3fc
push dword [ebp - 0x160]
push 0x40e880
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040c3fc
push dword [ebp - 0x164]
push 0x40e890
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040c3fc
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040c634
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e86c
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040b39c
ret