joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433eac
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
shr dword [ebp + 8], 2
mov eax, dword [ebp + 8]
shr eax, 1
add eax, 3
push esi
mov dword [ecx], eax
xor esi, esi
cmp dword [ebp + 8], esi
lea eax, [eax*8 + 4]
push edi
mov dword [ebp - 0xc], eax
jbe 0x433ee2
mov edi, dword [edx]
mov dword [ecx + esi*4 + 4], edi
inc esi
add edx, 4
cmp esi, dword [ebp + 8]
jb 0x433ed3
cmp esi, eax
jae 0x433fb6
mov eax, esi
sub eax, dword [ebp + 8]
push ebx
lea eax, [ecx + eax*4 + 4]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, esi
div dword [ebp + 8]
mov ebx, dword [ecx + esi*4]
test edx, edx
mov dword [ebp - 8], eax
jne 0x433f54
mov edi, 0xff
mov eax, ebx
and eax, edi
mov dh, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
mov dl, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x10
and eax, edi
movzx eax, byte [eax + str.cw]
mov edi, dword [ebp - 8]
movzx edi, byte [edi + 0x4592a8]
shl edx, 8
or edx, eax
movzx eax, bh
movzx eax, byte [eax + str.cw]
shl edx, 8
xor eax, edi
or edx, eax
mov ebx, edx
jmp 0x433f9c
cmp dword [ebp + 8], 6
jbe 0x433f9c
cmp edx, 4
jne 0x433f9c
mov eax, ebx
shr eax, 0x10
mov edi, 0xff
and eax, edi
movzx eax, byte [eax + str.cw]
mov edx, ebx
shr edx, 0x18
mov ah, byte [edx + str.cw]
movzx edx, bh
movzx edx, byte [edx + str.cw]
shl eax, 8
and ebx, edi
or eax, edx
movzx edx, byte [ebx + str.cw]
shl eax, 8
or eax, edx
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add dword [ebp - 4], 4
xor eax, ebx
mov dword [ecx + esi*4 + 4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x433ef7
pop ebx
pop edi
pop esi
leave
ret

Function at 0x433fba
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
call fcn.00433eac
mov eax, dword [ecx]
lea eax, [eax*8 - 4]
add esp, 4
xor esi, esi
test eax, eax
mov dword [ebp - 4], eax
jbe 0x43403c
push ebx
mov edx, 0xff
push edi
mov eax, dword [ecx + esi*4 + 0x14]
mov edi, eax
shr edi, 0x10
and edi, edx
movzx edi, byte [edi + str.cw]
mov edi, dword [edi*4 + 0x45e828]
movzx ebx, ah
movzx ebx, byte [ebx + str.cw]
xor edi, dword [ebx*4 + 0x45e428]
mov ebx, eax
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
xor edi, dword [ebx*4 + 0x45ec28]
and eax, edx
movzx eax, byte [eax + str.cw]
xor edi, dword [eax*4 + 0x45e028]
inc esi
cmp esi, dword [ebp - 4]
mov dword [ecx + esi*4 + 0x10], edi
jb 0x433fe3
pop edi
pop ebx
pop esi
leave
ret
Function at 0x434442
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, eax
test ebx, ebx
push edi
mov edi, ecx
je 0x4344d9
push 0x10
pop eax
cmp ebx, eax
jb 0x4344d9
sub ebx, eax
add ebx, eax
shr ebx, 4
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [edi]
push dword [esi + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x14]
lea eax, [ebp - 0x14]
call fcn.0043403f
mov eax, dword [esi]
xor eax, dword [ebp - 0x24]
pop ecx
mov dword [edi], eax
mov eax, dword [esi + 4]
xor eax, dword [ebp - 0x20]
add edi, 0x10
mov dword [edi - 0xc], eax
mov eax, dword [esi + 8]
xor eax, dword [ebp - 0x1c]
pop ecx
mov dword [edi - 8], eax
mov eax, dword [esi + 0xc]
xor eax, dword [ebp - 0x18]
dec ebx
mov dword [edi - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
jne 0x43446c
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x4363e5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x458220]
jne 0x4363ef
repz ret
jmp fcn.00438828

Function at 0x437563
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x437590
call fcn.0043769c
mov dword [eax], esi
call fcn.00437689
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004367a1
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x43756c
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4375bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004376af
pop ecx
call fcn.00437689
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4375e6
test al, 1
je 0x4375e6
test byte [esp + 0xc], 2
je 0x4375e6
call fcn.0043769c
mov dword [eax], 5
call fcn.00437689
mov dword [eax], 0xd
jmp 0x4375b6
xor eax, eax
pop esi
ret
Function at 0x4398b9
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x458238]
je 0x4398d4
inc edi
cmp edi, 0x17
jb 0x4398c5
cmp edi, 0x17
jae 0x439a54
push ebp
push 3
call fcn.0043efd2
cmp eax, 1
pop ecx
je 0x439a20
push 3
call fcn.0043efd2
test eax, eax
pop ecx
jne 0x439908
cmp dword [0x4580a0], 1
je 0x439a20
cmp ebx, 0xfc
je 0x439a53
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x45c3f0
push ebp
call fcn.004385c3
add esp, 0xc
test eax, eax
je 0x43993e
push esi
push esi
push esi
push esi
push esi
call fcn.004366a5
add esp, 0x14
push 0x104
mov esi, 0x45c409
push esi
push 0
mov byte [0x45c50d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x439982
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004385c3
add esp, 0xc
test eax, eax
je 0x439982
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004366a5
add esp, 0x14
push esi
call fcn.00436610
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4399c7
push esi
call fcn.00436610
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x45c704
push 0x446a8c
sub ecx, eax
push ecx
push eax
call fcn.0043cc69
add esp, 0x14
test eax, eax
je 0x4399c7
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004366a5
add esp, 0x14
jmp 0x4399c9
xor esi, esi
push 0x446a88
push ebx
push ebp
call fcn.0043ef61
add esp, 0xc
test eax, eax
je 0x4399e9
push esi
push esi
push esi
push esi
push esi
call fcn.004366a5
add esp, 0x14
push dword [edi*8 + 0x45823c]
push ebx
push ebp
call fcn.0043ef61
add esp, 0xc
test eax, eax
je 0x439a0b
push esi
push esi
push esi
push esi
push esi
call fcn.004366a5
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043eda4
add esp, 0xc
jmp 0x439a53
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x439a53
cmp ebp, 0xffffffff
je 0x439a53
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x45823c]
push dword [esi]
call fcn.00436610
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43eda4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00438a32
xor ebx, ebx
cmp dword [0x45cb28], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43ee7a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43ef5a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43ef5a
push eax
call fcn.004389c4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45cb28], eax
call esi
push eax
call fcn.004389c4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45cb2c], eax
call esi
push eax
call fcn.004389c4
mov dword [0x45cb30], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004391d0
test eax, eax
pop ecx
pop ecx
je 0x43ee48
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004366a5
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43ee7a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004389c4
cmp eax, ebx
pop ecx
mov dword [0x45cb38], eax
je 0x43ee7a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004389c4
pop ecx
mov dword [0x45cb34], eax
mov eax, dword [0x45cb34]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43eeff
cmp dword [0x45cb38], ecx
je 0x43eeff
push eax
call fcn.00438a3b
push dword [0x45cb38]
mov esi, eax
call fcn.00438a3b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43eeff
cmp edi, ebx
je 0x43eeff
call esi
cmp eax, ebx
je 0x43eecc
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43eecc
test byte [ebp - 0x18], 1
jne 0x43eeff
lea eax, [ebp - 0x10]
push eax
call fcn.00439207
test eax, eax
pop ecx
je 0x43eee7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004366a5
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43eef6
or dword [ebp + 0x10], 0x200000
jmp 0x43ef3a
or dword [ebp + 0x10], 0x40000
jmp 0x43ef3a
mov eax, dword [0x45cb2c]
cmp eax, dword [ebp - 8]
je 0x43ef3a
push eax
call fcn.00438a3b
cmp eax, ebx
pop ecx
je 0x43ef3a
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43ef3a
mov eax, dword [0x45cb30]
cmp eax, dword [ebp - 8]
je 0x43ef3a
push eax
call fcn.00438a3b
cmp eax, ebx
pop ecx
je 0x43ef3a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45cb28]
call fcn.00438a3b
cmp eax, ebx
pop ecx
je 0x43ef5a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43ef5c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e004]
jne 0x40100a
repz ret
jmp fcn.00401a91

Function at 0x405ebb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040408b
and dword [ebp - 0x14], 0
cmp dword [0x4206fc], 0
mov dword [ebp - 0x18], eax
jne 0x405f6e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406016
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406016
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4206fc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x420700], eax
call edi
push eax
call esi
push 0x41c05c
push ebx
mov dword [0x420704], eax
call edi
push eax
call esi
mov dword [0x42070c], eax
test eax, eax
je 0x405f6e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x420708], eax
mov eax, dword [0x420708]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405fc7
cmp dword [0x42070c], ecx
je 0x405fc7
push eax
call esi
push dword [0x42070c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405fc7
test ebx, ebx
je 0x405fc7
call edi
test eax, eax
je 0x405fbe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405fbe
test byte [ebp - 8], 1
jne 0x405fc7
or dword [ebp + 0x10], 0x200000
jmp 0x405ffa
mov eax, dword [0x420700]
cmp eax, dword [ebp - 0x18]
je 0x405ffa
push eax
call esi
test eax, eax
je 0x405ffa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405ffa
mov eax, dword [0x420704]
cmp eax, dword [ebp - 0x18]
je 0x405ffa
push eax
call esi
test eax, eax
je 0x405ffa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4206fc]
call esi
test eax, eax
je 0x406016
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406018
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x41a310
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x4220dc]
push ebx
push esi
mov esi, dword [0x421dfc]
mov ebx, eax
cmp eax, 0x5dd
jne 0x41a332
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x41f1c0]
call fcn.0041a1f0
cmp dword [0x4220dc], 0x2f
jne 0x41a34d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.0041a230
add esp, 4
cmp dword [0x4220dc], 0x568
pop esi
pop ebx
jne 0x41a37a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x4097c8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40987c
jmp 0x409871
cmp dword [esi + 0x10], 0x1000
jne 0x40985d
test byte [esi + 0x15], 1
jne 0x40985d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40981c
cmp eax, 2
je 0x40981c
cmp eax, 0x10
je 0x40981c
cmp eax, 0x20
jne 0x409831
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409831
mov bl, 1
xor ebp, ebp
jmp 0x409842
mov eax, dword [esi]
add eax, ebp
call fcn.004097c0
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409835
test bl, bl
je 0x40985d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40987c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097f4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x15ff4e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 8]
jp 0x1605dc6
test eax, eax
pushal
mov byte [esp], al
lea esp, [esp + 0x20]
je 0x1601d0f
movsx dx, bl
sal edx, 6
mov esi, dword [eax + 0x3c]
inc dl
add esi, eax
btc dx, 5
test cx, sp
mov edx, dword [esi + 0x78]
test bh, 0xc6
stc
clc
bt ax, 6
test edx, edx
pushal
lea esp, [esp + 0x20]
je 0x1601d0f
or ch, cl
seto ch
cmc
inc ch
add edx, eax
sal cl, cl
bswap cx
jmp 0x2981b86
stc
test eax, eax
pushal
mov byte [esp + 8], 0xb8
lea esp, [esp + 0x20]
je 0x1601d0f
sbb si, di
and si, 0xd
rcl esi, 4
cmc
mov esi, dword [eax + 0x3c]
neg edx
bt esp, 9
test esp, edx
jmp fcn.0160a656
test dh, 0x41
jmp 0x1604d92
add ecx, edx
bt di, dx
test di, 0x641c
mov dword [ebp - 0x10], ecx
test di, 0xcfc9
not ch
shl cl, 6
jge 0x2981b16
mov ecx, dword [ebp + 0xc]
clc
pushal
cmp ecx, 0xffff
pushal
pushfd
mov byte [esp], 0x2b
push dword [esp + 8]
lea esp, [esp + 0x48]
jbe 0x1608ce9
movsx di, dl
not di
shl bh, cl
mov edi, dword [edx + 0x24]
sar cl, 1
sar bl, cl
add edi, eax
neg cl
mov ebx, dword [edx + 0x20]
clc
adc ecx, 0x833a788d
add ebx, eax
movzx cx, bl
test dl, 0xf6
pushal
not cl
mov dword [ebp - 8], 0
or cl, bl
mov ecx, dword [edx + 0x18]
sub esp, 0xffffffe0
shr cx, 4
movsx ecx, al
mov ecx, dword [ebp + 0xc]
jnp 0x1602358
bt si, 5
call fcn.01891054
mov edi, dword [edi + ecx*4]
stc
cmp dx, di
test edi, edi
lea esp, [esp + 0xc]
jg 0x1609a4c
je 0x1601d0f
pushfd
pushfd
mov dword [esp], ecx
lea esp, [esp + 8]
jmp fcn.016032f7
bts cx, cx
mov ecx, dword [esi + 0x7c]
jmp 0x187d388

Function at 0x160bffd
Capabilities:
Encode data using xor

Disassembly:
invalid
push 0xe5f575ef
call 0x1602365
xchg esp, eax
daa
jns 0x160c03c
outsd dx, dword [esi]
dec edi
jne 0x160bfc6
jmp 0xfb39f55c
Function at 0x47181d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x47185c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47185c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47185c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x47185c
cmp dword [ecx + 0x74], 0xe
jbe 0x47185c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x486c60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x486c8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x486c8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x105f0
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov word [ebp - 0x10], 0xc
mov word [ebp - 0xe], 0xe
mov dword [ebp - 0xc], 0x10580
mov dword [ebp - 4], 0
push 0x10590
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
lea eax, [ebp - 0x10]
push eax
push 0x10500
push 0
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x10650
push 0x105a8
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x105c8
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x10e85
Capabilities:
Create device object
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10e04]
test eax, eax
mov ecx, 0xbb40
je 0x10e9c
cmp eax, ecx
jne 0x10ebf
mov edx, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, 0x10e04
shr eax, 8
xor eax, dword [edx]
and eax, 0xffff
mov dword [0x10e04], eax
jne 0x10ebf
mov eax, ecx
mov dword [0x10e04], eax
not eax
mov dword [section..data], eax
pop ebp
jmp 0x10b10
Function at 0x404568
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406200
test esi, esi
jne 0x40459e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406358
jmp 0x4045bc
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040444c
mov edi, eax
test esi, esi
je 0x4045bc
cmp dword [ebx], 0
je 0x4045bc
dec esi
jmp 0x4045a5
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405340
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004055f0
mov byte [esp], al
cmp byte [esp], 0
jne 0x4054cc
test edi, edi
je 0x4054cc
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405403
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x4053de
cmp edi, 0xffffffff
je 0x40539f
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40539f
mov byte [esp], 0
jmp 0x4054cc
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4053de
test ebx, ebx
jne 0x4053d4
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402454
test eax, eax
jne 0x4053d4
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4054cc
call 0x405634
dec ebp
test ebp, ebp
jg 0x405384
cmp edi, 0xffffffff
je 0x405403
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405401
mov byte [esp], 0
jmp 0x4054cc
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40534e
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402454
cmp ebx, eax
jne 0x405403
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040553c
mov edx, eax
mov ebx, dword [0x4358f4]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40546a
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405468
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40546a
xor edi, edi
cmp byte [esp], 0
je 0x405493
mov ebx, dword [esi]
test bl, 1
jne 0x4054ac
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402454
cmp ebx, eax
jne 0x405470
mov byte [esp + 1], 1
jmp 0x4054ac
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402454
cmp ebx, eax
jne 0x405493
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x40541d
cmp byte [esp], 0
je 0x4054cc
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x405e98
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x435054], 0
je 0x405eff
cmp word [0x435340], 0xd7b2
jne 0x405ec1
cmp dword [0x435348], 0
jbe 0x405ec1
mov eax, 0x43533c
call dword [0x435358]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x405f2c
call fcn.00406868
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x43302e], 0
jne 0x405f1b
push 0
push 0x4339c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4060bc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x433030], 0
je 0x4060e7
mov edx, edi
mov eax, esi
call dword [0x433030]
mov ebx, eax
jmp 0x4060f8
mov eax, 8
call fcn.004041a8
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x435055], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406084
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40612d
mov edx, 8
mov eax, ebx
call fcn.004041c4
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x407e14
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x407f79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406200
cmp si, word [0x433a00]
jb 0x407eac
cmp si, word [0x433c00]
ja 0x407eac
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x407eac
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x433a00]
jae 0x407e86
mov edi, ebx
dec edi
jmp 0x407ea7
cmp si, word [ebx*8 + 0x433a00]
jbe 0x407e96
inc ebx
mov dword [ebp - 8], ebx
jmp 0x407ea7
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x433a04]
call fcn.00407d24
jmp 0x407eac
cmp edi, dword [ebp - 8]
jae 0x407e70
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x407f5b
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x407f5b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00406b50
push dword [ebp - 0x160]
push 0x407f94
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00406b50
push dword [ebp - 0x164]
push 0x407fa4
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00406b50
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00406d1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f80
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406260
ret