joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e839058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1e8391a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1e83907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e83906a
add dl, dl
jne 0x1e839089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e8390dc
xor eax, eax
add dl, dl
jne 0x1e839096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e83917d
add dl, dl
jne 0x1e8390a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e8390b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e8390bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e8390c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1e8390d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1e839075
mov eax, 1
add dl, dl
jne 0x1e8390ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e8390f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e8390e1
sub eax, ebx
mov ebx, 1
jne 0x1e839128
mov ecx, 1
add dl, dl
jne 0x1e83910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1e839119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e839105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e839075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1e83913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1e83914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e839136
cmp eax, 0x7d00
jae 0x1e83916d
cmp eax, 0x500
jb 0x1e839168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e839075
cmp eax, 0x7f
ja 0x1e839170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e839075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1e83919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1e839075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100063c0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x1005b1b0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.1000a250
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.1000a2f0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.1000d1bf
add esp, 0x68
ret

Function at 0x10006b00
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x1005b1b0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.10008db0
add esp, 8
test eax, eax
jne 0x10006b6b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.1000d1bf
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x10006b80
push esi
lea ecx, [esp + 0x14]
call fcn.1000a250
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.1000a2f0
test edi, edi
je 0x10006b9e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.1000d1bf
add esp, 0x6c
ret

Function at 0x10006c10
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x1005b1b0]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10008fb0
add esp, 4
test eax, eax
jne 0x10006c6e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.1000d1bf
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.1000a2f0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1000d1bf
add esp, 0x64
ret

Function at 0x10006c90
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x1005b1b0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.100090a0
add esp, 8
test eax, eax
jne 0x10006d0f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.1000d1bf
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.10009e30
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.1000d1bf
add esp, 0x74
ret
Function at 0x791dff
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf077ec1c
jmp 0x791e2c
mov dword [esp + 0x28], ebp
jmp 0x791df9
push dword [esp + 2]
mov dword [esp + 0x28], ebp
call 0x791dff
pop es
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x791e4b
pushfd
push dword [esp + 2]
jnp 0x791df1
push dword [esp + 2]
jmp 0x791ddb
cpuid
mov bh, byte [esp]
not di
setae ch
jmp 0x791ea2
pushfd
jmp 0x791755
lea edi, [esp]
cpuid
jmp 0x791f2a
call 0x791e7d
pushal
not byte [ecx - 0x62f35da0]
or eax, 0x6c66a754
jg 0x791ec1
int1
invalid
mov ebp, dword [esp + 0x2c]
mov esi, 0x10be3472
bswap ebx
inc eax
je 0x791e67
jne 0x791e51
mov dl, 0x2b
mov ebx, 0xce952dde
pop ecx
xchg dword [esp], esi
bsr bx, dx
cmc
setnp bh
mov ch, byte [esp]
setl ah
jmp 0x791ef9
lea esp, [esp + 2]
mov dword [esp + 0x20], esp
jmp 0x791e1f
cmp ecx, esi
lea eax, reloc.WINMM.dll_midiStreamStop
mov eax, edi
push dword [esp]
ret 4
lea esi, [esi - 0x1b]
mov cl, byte [esp]
lea ebx, [esi*4]
rol ax, 7
xchg dword [esp], esi
mov ah, 0x23
jmp 0x791ee3
neg ax
jge 0x791f39
mov dx, bx
jmp 0x791f3c
setns ah
sub esp, 0xc0
mov esi, esp
xchg al, dh
jmp 0x791f14
mov dx, bx
mov ecx, ebp
setge bl
jmp 0x792367
lea ebx, [edx + ebp]
call fcn.007923b3
mov byte [ecx], dl
and eax, 0x920aa013
add byte [edi - 0x6e], ah
and byte [ebx - 0x77a999f6], dl
cmp al, 0x24
push si
mov byte [esp], bh
lea esp, [esp + 2]
xchg ebx, eax
mov edx, dword [esp]
cmc
jmp 0x792392
rol ebp, 0
jmp 0x79270e
jo 0x792351
lea ebx, [edx + ebp]
jmp 0x792378
inc bh
lea edx, [ebx + esi]
jmp 0x792427
lea edx, [ebx + esi]
inc ah
bt ax, di
bswap eax
jmp 0x792435
lea eax, reloc.WINMM.dll_midiStreamStop
and dx, 0xff62
jge 0x7923ed
inc bh
jmp 0x7923f8
inc ah
bt ax, di
bswap eax
jmp 0x792435
add ebp, 0x6895b37
not bl
neg bx
jno 0x7924fe
jo 0x7924af
out 0xe, eax
cdq
clc
fisttp dword [edi]
mov esp, 0x6dbc0c1
bsf eax, ecx
rcr bl, 6
not ebp
jmp 0x792416
mov dh, byte [esp]
jmp 0x792501
lea eax, reloc.WINMM.dll_midiStreamStop
mov al, dl
jmp 0x792540
mov dh, byte [esp]
call fcn.0079246d
jle 0x7924e7
lea eax, reloc.WINMM.dll_midiStreamStop
mov al, dl
jmp 0x792540
xchg edx, eax
jmp 0x7925f2
add ebp, dword [edi]
neg ax
jnp 0x79252a
xchg edx, eax
neg eax
bsr ebx, ecx
jmp 0x792599
seto al
rdtsc
jmp 0x79244d
neg eax
bsr ebx, ecx
jmp 0x792599
bsf ebx, ecx
jns 0x792562
seto al
rdtsc
bsf eax, ecx
rcr bl, 6
jmp 0x792453
Function at 0x791ed6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf077ec1c
jmp 0x791e2c
mov dword [esp + 0x28], ebp
jmp 0x791df9
push dword [esp + 2]
mov dword [esp + 0x28], ebp
call 0x791dff
pop es
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x791e4b
pushfd
push dword [esp + 2]
jnp 0x791df1
push dword [esp + 2]
jmp 0x791ddb
cpuid
mov bh, byte [esp]
not di
setae ch
jmp 0x791ea2
pushfd
jmp 0x791755
lea edi, [esp]
cpuid
jmp 0x791f2a
call 0x791e7d
pushal
not byte [ecx - 0x62f35da0]
or eax, 0x6c66a754
jg 0x791ec1
int1
invalid
mov ebp, dword [esp + 0x2c]
mov esi, 0x10be3472
bswap ebx
inc eax
je 0x791e67
jne 0x791e51
mov dl, 0x2b
mov ebx, 0xce952dde
pop ecx
xchg dword [esp], esi
bsr bx, dx
cmc
setnp bh
mov ch, byte [esp]
setl ah
jmp 0x791ef9
lea esp, [esp + 2]
mov dword [esp + 0x20], esp
jmp 0x791e1f
cmp ecx, esi
lea eax, reloc.WINMM.dll_midiStreamStop
mov eax, edi
push dword [esp]
ret 4
lea esi, [esi - 0x1b]
mov cl, byte [esp]
lea ebx, [esi*4]
rol ax, 7
xchg dword [esp], esi
mov ah, 0x23
jmp 0x791ee3
neg ax
jge 0x791f39
mov dx, bx
jmp 0x791f3c
setns ah
sub esp, 0xc0
mov esi, esp
xchg al, dh
jmp 0x791f14
mov dx, bx
mov ecx, ebp
setge bl
jmp 0x792367
lea ebx, [edx + ebp]
call fcn.007923b3
mov byte [ecx], dl
and eax, 0x920aa013
add byte [edi - 0x6e], ah
and byte [ebx - 0x77a999f6], dl
cmp al, 0x24
push si
mov byte [esp], bh
lea esp, [esp + 2]
xchg ebx, eax
mov edx, dword [esp]
cmc
jmp 0x792392
rol ebp, 0
jmp 0x79270e
jo 0x792351
lea ebx, [edx + ebp]
jmp 0x792378
inc bh
lea edx, [ebx + esi]
jmp 0x792427
lea edx, [ebx + esi]
inc ah
bt ax, di
bswap eax
jmp 0x792435
lea eax, reloc.WINMM.dll_midiStreamStop
and dx, 0xff62
jge 0x7923ed
inc bh
jmp 0x7923f8
inc ah
bt ax, di
bswap eax
jmp 0x792435
add ebp, 0x6895b37
not bl
neg bx
jno 0x7924fe
jo 0x7924af
out 0xe, eax
cdq
clc
fisttp dword [edi]
mov esp, 0x6dbc0c1
bsf eax, ecx
rcr bl, 6
not ebp
jmp 0x792416
mov dh, byte [esp]
jmp 0x792501
lea eax, reloc.WINMM.dll_midiStreamStop
mov al, dl
jmp 0x792540
mov dh, byte [esp]
call fcn.0079246d
jle 0x7924e7
lea eax, reloc.WINMM.dll_midiStreamStop
mov al, dl
jmp 0x792540
xchg edx, eax
jmp 0x7925f2
add ebp, dword [edi]
neg ax
jnp 0x79252a
xchg edx, eax
neg eax
bsr ebx, ecx
jmp 0x792599
seto al
rdtsc
jmp 0x79244d
neg eax
bsr ebx, ecx
jmp 0x792599
bsf ebx, ecx
jns 0x792562
seto al
rdtsc
bsf eax, ecx
rcr bl, 6
jmp 0x792453

Function at 0x79c0b1
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x7827da
pushfd
or dword [esp], reloc.WINMM.dll_midiStreamStop
popfd
cpuid
nop
jmp 0x7827f1
pop ebx
ret
jmp 0x7827ce
Function at 0x889384
Capabilities:
Packed with generic packer

Disassembly:
call fcn.0088811a
push dword [esp + 3]
pop word [esp]
push word [esp + 5]
pop dword [esp]
mov dword [esp], ecx
mov dword [esp + 0x24], esi
call fcn.0088928a
mov eax, dword fs:[0x30]
jmp 0x889342
pushal
mov byte [esp + 8], dh
lea esp, [esp + 0x13]
lea esp, [esp + 1]
mov dword [esp + 0x24], ebp
pushfd
jmp 0x8892b6
mov eax, dword [eax + 8]
push eax
jmp 0x888115
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x889316
mov byte [esp], al
mov dword [esp + 0x1c], esp
jmp 0x8892ec

Function at 0x1001495
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001918
call fcn.01001624
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1002370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1001250
cmp eax, esi
jne 0x1001243
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001253
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100122a
xor esi, esi
inc esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x1001266
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001295
mov eax, dword [0x100236c]
test eax, eax
jne 0x100128f
mov dword [0x100236c], esi
push 0x10010a0
push 0x1001094
call fcn.0100118c
pop ecx
pop ecx
test eax, eax
je 0x1001295
jmp 0x10013b9
mov dword [0x1002034], esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x10012b9
push 0x1001090
push 0x1001088
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100236c], 2
cmp dword [ebp - 0x20], ebx
jne 0x10012c6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1002374], ebx
je 0x10012e7
push 0x1002374
call fcn.01001599
pop ecx
test eax, eax
je 0x10012e7
push ebx
push 2
push ebx
call dword [0x1002374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x10013b9
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1001351
cmp cx, bx
je 0x100130c
cmp dword [ebp - 0x1c], ebx
jne 0x1001351
movzx ecx, word [eax]
cmp cx, bx
je 0x1001321
cmp cx, 0x20
ja 0x1001321
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x100130c
test byte [ebp - 0x40], 1
je 0x100132d
movzx ecx, word [ebp - 0x3c]
jmp 0x1001330
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1002030], eax
cmp dword [0x1002024], ebx
jne 0x1001396
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1001362
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x10012f6
cmp dword [0x1002034], ebx
jne 0x10013a4
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002030]
jmp 0x10013c5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001669
ret
call fcn.01001771
jmp 0x10011ed
Function at 0x4023a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4023cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409890
add esp, 4
or eax, 0xffffffff
jmp 0x4023fa
mov ecx, dword [ebp - 4]
and ecx, 1
test ecx, ecx
je 0x4023f8
mov edx, dword [ebp + 0xc]
and edx, 2
test edx, edx
je 0x4023f8
mov dword [0x42cc98], 0xd
mov dword [0x42cc9c], 5
or eax, 0xffffffff
jmp 0x4023fa
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10048f1
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
xor ebx, ebx
cmp eax, ebx
je 0x1004911
cmp eax, 1
je 0x1004911
push 6
pop eax
jmp 0x1004aea
push edi
cmp dword [esi + 0x7ac], ebx
jne 0x1004952
lea eax, [ebp - 4]
push eax
call fcn.01004259
push dword [ebp - 4]
mov edi, eax
push edi
push 0x1001980
push dword [0x100a31c]
call fcn.01008041
add esp, 0x10
cmp edi, ebx
jne 0x1004952
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
jmp 0x1004ae9
lea edi, [esi + 0x54]
cmp dword [edi + 0x3c], ebx
je 0x1004988
cmp dword [edi + 0x58], ebx
je 0x1004988
mov ecx, edi
call fcn.01005812
lea ecx, [esi + 0xbc]
cmp dword [ecx], ebx
je 0x1004988
mov eax, dword [edi]
push 3
xor edx, edx
pop ebx
dec eax
div ebx
imul edx, edx, 0xc
push dword [edx + edi + 4]
call fcn.0100596e
xor ebx, ebx
cmp dword [esi + 0x44], ebx
jne 0x1004a57
lea ecx, [esi + 0xbc]
call fcn.01003e52
test eax, eax
je 0x10049a7
push 0x10018e8
jmp 0x10049bb
lea ecx, [esi + 0x1c4]
call fcn.01003ec2
test eax, eax
je 0x10049d0
push 0x1001860
push dword [0x100a31c]
call fcn.01008041
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x1004ae9
push dword [esi + 0x1e4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1004ae6
cmp dword [edi + 0x3c], ebx
je 0x1004a27
cmp dword [edi + 0x58], ebx
je 0x1004a27
push dword [esi + 0x80]
mov eax, dword [edi]
push dword [esi + 0x7c]
xor edx, edx
push 3
pop ecx
dec eax
div ecx
mov eax, dword [edi]
imul edx, edx, 0xc
push dword [edx + edi + 8]
xor edx, edx
dec eax
div ecx
lea ecx, [esi + 0x1e0]
imul edx, edx, 0xc
push dword [edx + edi + 4]
push dword [esi + 0x84]
call fcn.0100699d
mov eax, dword [esi + 0x88]
cmp eax, ebx
jne 0x1004a3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x1d8]
xor edx, edx
mov ecx, 0x3e8
div ecx
lea ecx, [esi + 0x1e0]
push eax
call fcn.01006933
jmp 0x1004ae6
lea ecx, [esi + 0x1c4]
call fcn.01003ec2
test eax, eax
jne 0x1004a85
lea eax, [esi + 0xbc]
cmp dword [eax], ebx
je 0x1004a75
cmp dword [eax + 8], ebx
jne 0x1004a85
lea ecx, [esi + 0x1e0]
call fcn.01006b19
mov dword [esi + 0x44], ebx
jmp 0x1004ae6
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, eax
sub ecx, dword [esi + 0x1dc]
mov eax, 0x7530
cmp ecx, eax
jbe 0x1004ab4
push 0x10017c8
push dword [0x100a31c]
call fcn.01008041
pop ecx
pop ecx
push 2
jmp 0x1004ae8
sub eax, ecx
mov edi, 0x3e8
xor edx, edx
mov ecx, edi
div ecx
mov ecx, eax
mov eax, dword [esi + 0x88]
push ecx
test eax, eax
jne 0x1004ad6
call ebx
sub eax, dword [esi + 0x1d8]
xor edx, edx
div edi
lea ecx, [esi + 0x1e0]
push eax
call fcn.01006b57
push 6
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10051fa
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
xor esi, esi
inc esi
jmp 0x1005256
cmp dword [ebp - 0x30], 0
jne 0x100522d
cmp dword [ebp - 0x2c], 0x402
jne 0x1005256
mov eax, dword [ebp - 0x28]
jmp 0x1005372
mov eax, dword [edi + 0x1e4]
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x1005256
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x30]
push eax
call ebx
test eax, eax
jne 0x1005216
cmp dword [edi + 0x7ac], eax
je 0x100528f
cmp dword [edi + 0xbc], eax
jne 0x100528f
cmp dword [edi + 0x44], esi
je 0x100528f
push dword [edi + 0x1e4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x100528f
xor esi, esi
jmp 0x10052b6
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [ebp - 4]
cmp eax, 0x3e8
jb 0x10052b6
call ebx
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.010048f1
cmp eax, 6
jne 0x1005372
mov eax, dword [edi + 0x7ac]
xor ebx, ebx
test eax, eax
je 0x10052c6
mov dword [ebp - 0x14], eax
inc ebx
cmp dword [edi + 0x1c8], 0
je 0x10052dc
mov eax, dword [edi + 0x1c4]
mov eax, dword [eax]
mov dword [ebp + ebx*4 - 0x14], eax
inc ebx
test ebx, ebx
je 0x10052e9
mov eax, dword [ebp + ebx*4 - 0x18]
mov dword [ebp + ebx*4 - 0x14], eax
inc ebx
cmp dword [edi + 0x7c0], 0
je 0x10052fe
call fcn.01003fe3
and dword [edi + 0x7c0], 0
neg esi
sbb esi, esi
push 0xff
and esi, 0x3e9
dec esi
push esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 0x102
je 0x100520b
cmp eax, ebx
jae 0x1005377
mov ecx, dword [edi + 0x7ac]
test ecx, ecx
je 0x100534a
cmp dword [ebp + eax*4 - 0x14], ecx
jne 0x100534a
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.01004259
test eax, eax
je 0x10053a9
lea ecx, [edi + 0x1c4]
call fcn.01003ec2
test eax, eax
je 0x100520b
push 0x1002020
push dword [0x100a31c]
call fcn.01008041
xor eax, eax
inc eax
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
je 0x100520b
cmp eax, 0xffffffff
jne 0x1005390
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001fc0
jmp 0x1005396
push eax
push 0x1001f70
push dword [0x100a31c]
call fcn.01008041
add esp, 0xc
jmp 0x100520b
push 0x1001e78
push dword [0x100a31c]
call fcn.01008041
xor eax, eax
jmp 0x1005370

Function at 0x1005697
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 0
push ecx
push 0x1005681
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x10056d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002470
call fcn.01005e54
pop ecx
pop ecx
xor eax, eax
jmp 0x10056e6
push 0x10023f8
call fcn.01005e54
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
leave
ret
Function at 0x1006864
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x1001630
mov esi, ecx
push 0x414
push dword [esi + 4]
xor ebx, ebx
inc ebx
mov dword [esi + 0x18], ebx
call edi
push 0x2b37
push dword [0x100a328]
call sub.cmutil.dll_CmLoadStringW
push eax
push ebx
push dword [esi + 4]
mov dword [ebp - 4], eax
call edi
push dword [ebp - 4]
call sub.cmutil.dll_CmFree
push 0x2b38
push dword [0x100a328]
call sub.cmutil.dll_CmLoadStringW
mov ebx, eax
push ebx
push 0x413
push dword [esi + 4]
call edi
push ebx
call sub.cmutil.dll_CmFree
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x415
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 5
push 0x410
push dword [esi + 4]
call edi
push eax
call ebx
push 5
push 0x411
push dword [esi + 4]
call edi
push eax
call ebx
push 5
push 0x412
push dword [esi + 4]
call edi
push eax
call ebx
push 3
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1006bf0
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
and dword [esi + 0x18], 0
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
neg eax
push 0x2b35
mov dword [esi + 0x20], eax
push dword [0x100a328]
call sub.cmutil.dll_CmLoadStringW
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ebx, eax
push ebx
push 1
push dword [esi + 4]
call edi
push ebx
call sub.cmutil.dll_CmFree
push 0x2b36
push dword [0x100a328]
call sub.cmutil.dll_CmLoadStringW
mov ebx, eax
push ebx
push 0x413
push dword [esi + 4]
call edi
push ebx
call sub.cmutil.dll_CmFree
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x410
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
push 0x411
push dword [esi + 4]
call edi
push eax
call ebx
push 0
push 0x412
push dword [esi + 4]
call edi
push eax
call ebx
push 5
push 0x415
push dword [esi + 4]
call edi
push eax
call ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 3
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.01005b20
Function at 0x1006cc9
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, 0x400
cmp dword [0x100a334], ebx
jne 0x1006d23
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 0x11
push edi
mov dword [0x100a334], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x20c]
push eax
call sub.cmutil.dll_CmAtolW
mov dword [0x100a330], eax
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x10033c0
push 0x100
push ebx
push ebx
push 0x104
push eax
call fcn.010045a2
add esp, 0x1c
test eax, eax
jl 0x1006dad
mov eax, dword [ebp + 0x10]
dec eax
push eax
push esi
push ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov eax, dword [0x100a330]
cmp eax, ebx
je 0x1006d95
cmp edi, eax
jbe 0x1006d95
mov ecx, edi
sub ecx, eax
lea eax, [esi + ecx*2 - 2]
push eax
call sub.cmutil.dll_CmIsDigitW
test eax, eax
jne 0x1006d95
sub edi, dword [0x100a330]
mov word [esi + edi*2 - 2], ax
jmp 0x1006dbf
push 0x1003378
push dword [0x100a31c]
call fcn.01008041
mov dword [0x100a334], ebx
jmp 0x1006dbd
push 0x10032f8
push dword [0x100a31c]
call fcn.01008041
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007105
leave
ret 0xc