joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c680
Capabilities:
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a19b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c9144]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x10]
push eax
call fcn.0041b8b0
mov dword [ebp - 4], 0
mov ecx, dword [0x4d2da8]
push ebx
push ecx
push 0x4ab8d0
lea edi, [ebp - 0x10]
call fcn.00417250
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
call fcn.0041b8b0
mov byte [ebp - 4], 1
mov eax, esi
test esi, esi
jne 0x47c6e6
mov eax, ebx
push eax
mov eax, dword [0x4d2d94]
push eax
push 0x4ab8d0
lea edi, [ebp - 0x14]
call fcn.00417250
mov ecx, dword [ebp - 0x10]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
je 0x47c776
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x47c776
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c744
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x47c763
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c798
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x47c7b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47fc00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1a00
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push esi
push edi
mov eax, dword [0x4c9144]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov dword [ebp - 0x2c], esp
push esp
mov ecx, 0x4ab684
call fcn.0041be20
push ecx
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], esp
push esp
mov ecx, 0x4ab684
call fcn.0041be20
push ecx
mov dword [ebp - 0x24], esp
push esp
mov ecx, 0x4ab65c
mov byte [ebp - 4], 1
call fcn.0041be20
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.00418320
add esp, 0x10
mov dword [ebp - 4], 2
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
push ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x58], vtable.CDlgDownload.0
call fcn.0041be20
lea edx, [ebp - 0x34]
push edx
mov ecx, str.http:__download.msgpluslive.net_setup_MsgPlus3_Setup.exe
mov byte [ebp - 4], 4
call fcn.0041be20
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.00480190
cmp eax, 1
jne 0x47fd61
xor eax, eax
push 0x44
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.0048bb40
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0xa0], 0x44
cmp dword [eax - 4], 1
jle 0x47fd0a
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004173b0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0xa0]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x47fd39
mov eax, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [ebp - 0x20]
push ecx
call edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00489835
add esp, 8
cmp eax, esi
jl 0x47fda6
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ecx - 8]
jg 0x47fda6
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov word [ecx + eax*2], dx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004787e0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x47fd93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00417580
int3
Function at 0x482490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0a08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push edi
mov eax, dword [0x4c9144]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041b8b0
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], esp
push esp
mov ecx, str.EdtDestination
call fcn.0041be20
lea ebx, [ebp - 0x18]
mov edi, esi
call fcn.00471aa0
lea edi, [ebp - 0x14]
mov ebx, eax
call fcn.00482650
mov eax, dword [ebp - 0x14]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov edi, esp
call fcn.004175b0
add eax, 0x10
mov dword [edi], eax
push 1
push ecx
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x388]
mov ebx, dword [0x4d2918]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.BrowseForDir
push eax
push ecx
call fcn.0041b1b0
mov edx, dword [esi + 0x3bc]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 4], 0
call fcn.004176e0
add esp, 0x14
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4825e3
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4825ba
mov ecx, dword [ebp - 0x10]
cmp dword [ecx - 0xc], 0
jl 0x482583
push str.Messenger_Plus_
push ecx
call fcn.00489e59
mov ecx, dword [ebp - 0x10]
add esp, 8
test eax, eax
je 0x482583
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4825ba
mov edx, dword [ecx - 0xc]
lea eax, [edx - 1]
test eax, eax
js 0x48263c
cmp eax, edx
jg 0x48263c
cmp word [ecx + eax*2], 0x5c
je 0x4825ad
mov edx, 0x4ab668
lea eax, [ebp - 0x10]
call fcn.00418b00
mov edx, 0x4abb10
lea eax, [ebp - 0x10]
call fcn.00418b00
push ecx
mov dword [ebp - 0x1c], esp
push esp
mov ecx, str.EdtDestination
call fcn.0041be20
lea ebx, [ebp - 0x1c]
mov edi, esi
call fcn.00471aa0
mov edx, dword [ebp - 0x10]
mov eax, dword [eax]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x482603
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x482629
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00417580
int3
Function at 0x482650
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ebx]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [eax + 1]
test esi, esi
jns 0x48266b
push 0x80070057
call fcn.00417580
mov eax, dword [edi]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, esi
or ecx, edx
jge 0x482687
mov eax, esi
mov ecx, edi
call fcn.00417470
mov eax, dword [edi]
push esi
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4826ae
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x4826b2
push ecx
push eax
call fcn.00489835
add esp, 8
test eax, eax
js 0x482661
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x482661
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
pop esi
ret
Function at 0x483f40
Capabilities:
Create thread

Disassembly:
mov ecx, esi
mov dword [eax], 1
call fcn.00469860
cmp eax, 0xffffffff
jne 0x483f83
cmp byte [esi + 0x152], 0
je 0x483f72
cmp byte [esi + 0x151], 0
jne 0x483f72
mov byte [esi + 0x152], 0
mov byte [esi + 0x118], 1
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 1
push 2
mov ecx, esi
call eax
or eax, 0xffffffff
ret
push 0
push 0
push esi
push 0x484340
push 0
push 0
call fcn.0048ae22
add esp, 0x18
test eax, eax
jne 0x483fcb
cmp byte [esi + 0x152], al
je 0x483fba
cmp byte [esi + 0x151], al
jne 0x483fba
mov byte [esi + 0x152], al
mov byte [esi + 0x118], 1
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
push 1
push 2
mov ecx, esi
call eax
or eax, 0xffffffff
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret

Function at 0x484410
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x4c9144]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x3c0], 0
je 0x484510
push 0x114
lea eax, [esp + 0x14]
push 0
push eax
mov byte [edi + 0x3c0], 0
call fcn.0048bb40
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x20], 2
jne 0x484510
mov eax, dword [esp + 0x14]
cmp eax, 6
ja 0x48448f
jne 0x484510
cmp dword [esp + 0x18], 1
jb 0x484510
mov eax, dword [edi + 0x3c4]
lea esi, [edi + 0x3c4]
test eax, eax
je 0x4844a7
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
push esi
push 0x4a877c
push 1
push 0
push 0x4a878c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4844c6
mov dword [esi], 0
cmp dword [esi], 0
je 0x484510
mov eax, dword [esi]
test eax, eax
jne 0x4844db
push 0x80004003
call fcn.00487440
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
test eax, eax
jns 0x4844ec
call fcn.00484850
mov esi, dword [esi]
test esi, esi
jne 0x4844fc
push 0x80004003
call fcn.00487440
mov ecx, dword [edi + 0x3bc]
mov edx, dword [ecx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
push 2
push edx
push esi
call eax
push ecx
mov dword [esp + 0x10], esp
push esp
mov ecx, str.PrgInstall
call fcn.0041be20
lea ebx, [esp + 0x10]
call fcn.00471aa0
mov esi, dword [ebp + 8]
mov ecx, dword [eax]
push 0
push esi
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [edi + 0x3c4], 0
je 0x48459e
mov eax, dword [edi + 0x3c4]
test eax, eax
jne 0x48455a
push 0x80004003
call fcn.00487440
mov ecx, dword [edi + 0x3bc]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
mov edx, dword [edx + 0x24]
push 0
push 0x64
push 0
push esi
push ecx
push eax
call edx
cmp esi, 0x64
jb 0x48459e
mov eax, dword [edi + 0x3c4]
test eax, eax
jne 0x48458c
push 0x80004003
call fcn.00487440
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [edi + 0x3c4], 0
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00487efe
mov esp, ebp
pop ebp
ret 4
Function at 0x487e06
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4ce034], 0
push esi
push edi
jne 0x487d7c
call fcn.00487ce8
test eax, eax
je 0x487dc1
mov eax, dword [0x4ce034]
cmp eax, 1
jne 0x487d9d
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x487dc1
jmp 0x487e03
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x487e03
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x487dc5
xor eax, eax
jmp 0x487e03
mov eax, dword [esi]
push dword [0x4ce034]
call edi
mov edi, eax
test edi, edi
je 0x487de7
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x487e03
lea edi, [esi + 0xff0]
push esi
push dword [0x4ce034]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x487ded
mov eax, esi
pop edi
pop esi
ret
jmp 0x487d68

Function at 0x487efe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c9144]
jne 0x487f08
repz ret
jmp fcn.0048bbba
Function at 0x497253
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c9144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048d086
and dword [ebp - 0x14], 0
cmp dword [0x4cedc0], 0
mov dword [ebp - 0x18], eax
jne 0x497306
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4973ae
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4aaaf0
push ebx
call edi
test eax, eax
je 0x4973ae
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4aaae0
push ebx
mov dword [0x4cedc0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4cedc4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4cedc8], eax
call edi
push eax
call esi
mov dword [0x4cedd0], eax
test eax, eax
je 0x497306
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4cedcc], eax
mov eax, dword [0x4cedcc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x49735f
cmp dword [0x4cedd0], ecx
je 0x49735f
push eax
call esi
push dword [0x4cedd0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49735f
test ebx, ebx
je 0x49735f
call edi
test eax, eax
je 0x497356
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x497356
test byte [ebp - 8], 1
jne 0x49735f
or dword [ebp + 0x10], 0x200000
jmp 0x497392
mov eax, dword [0x4cedc4]
cmp eax, dword [ebp - 0x18]
je 0x497392
push eax
call esi
test eax, eax
je 0x497392
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x497392
mov eax, dword [0x4cedc8]
cmp eax, dword [ebp - 0x18]
je 0x497392
push eax
call esi
test eax, eax
je 0x497392
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4cedc0]
call esi
test eax, eax
je 0x4973ae
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4973b0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00487efe
leave
ret
Function at 0x408720
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408bac
mov byte [esp], al
cmp byte [esp], 0
jne 0x4088a9
test edi, edi
je 0x4088a9
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4087e9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4087c4
cmp edi, 0xffffffff
je 0x408785
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408785
mov byte [esp], 0
jmp 0x4088a9
cmp dword [esi], 1
jg 0x4087c4
cmp dword [esi], 0
jne 0x4087b6
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4087b6
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4088a9
lea eax, [esp + 0xc]
call fcn.004083dc
dec ebp
test ebp, ebp
jg 0x40876a
cmp edi, 0xffffffff
je 0x4087e9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4087e7
mov byte [esp], 0
jmp 0x4088a9
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40872e
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4087e9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408918
mov edx, eax
mov ebx, dword [0x58a8fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40884d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40884b
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40884d
xor edi, edi
cmp byte [esp], 0
je 0x408873
mov ebx, dword [esi]
test bl, 1
jne 0x408889
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408853
mov byte [esp + 1], 1
jmp 0x408889
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408873
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408800
cmp byte [esp], 0
je 0x4088a9
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4094ec
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x58cb9c
cmp dword [ebp + 0xc], 2
jl 0x409500
mov ebx, 0x58cbcc
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x409538
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x405118
mov dword [0x58a01c], eax
mov eax, 0x405120
mov dword [0x58a020], eax
mov eax, ebx
call fcn.004093d0
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x40956d
cmp al, 3
jge 0x40956d
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40957e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x409589
call dword [ecx + eax*4]
cmp dword [0x58a040], 0
jne 0x40959f
mov byte [0x58a048], 1
fnstcw word [0x581024]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00409838
call fcn.00409480
ret 4

Function at 0x4097a0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x58a05c], 0
je 0x409807
cmp word [0x58a348], 0xd7b2
jne 0x4097c9
cmp dword [0x58a350], 0
jbe 0x4097c9
mov eax, 0x58a344
call dword [0x58a360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409834
call fcn.0040a2f0
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x58102e], 0
jne 0x409823
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4099c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x581030], 0
je 0x4099f3
mov edx, edi
mov eax, esi
call dword [0x581030]
mov ebx, eax
jmp 0x409a04
mov eax, 8
call fcn.00406e6c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x58a05d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409990
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409a34
mov eax, ebx
call fcn.00406e88
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40c740
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40c8a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409b08
cmp si, word [0x581a00]
jb 0x40c7d8
cmp si, word [0x581c00]
ja 0x40c7d8
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40c7d8
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x581a00]
jae 0x40c7b2
mov edi, ebx
dec edi
jmp 0x40c7d3
cmp si, word [ebx*8 + 0x581a00]
jbe 0x40c7c2
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40c7d3
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x581a04]
call fcn.0040c660
jmp 0x40c7d8
cmp edi, dword [ebp - 8]
jae 0x40c79c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40c887
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c887
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a6a8
push dword [ebp - 0x160]
push 0x40c8c0
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a6a8
push dword [ebp - 0x164]
push 0x40c8d0
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a6a8
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040a8e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c8ac
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409b68
ret
Function at 0x40ca58
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cb5c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x58cc14
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x58cc2c]
jne 0x40caa4
mov eax, esi
mov edx, 0x58cc2e
mov ecx, 0x55
call fcn.0040a6a8
push 0x58cc14
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40cb46
push 0x58cc14
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00409b08
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40cb13
cmp byte [0x58cc10], 0
je 0x40cad8
mov edx, esi
mov eax, ebx
call fcn.0040c93c
jmp 0x40cb13
mov edx, esi
mov eax, ebx
call fcn.0040c740
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40cb13
cmp dword [esi], 0
je 0x40cafc
mov eax, esi
mov edx, 0x40cb74
call fcn.0040a800
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040c740
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a800
push 0x58cc14
call sub.kernel32.dll_EnterCriticalSection
mov word [0x58cc2c], bx
mov eax, dword [esi]
call fcn.0040a5ec
mov ecx, eax
mov eax, 0x58cc2e
mov edx, 0xaa
call fcn.0040c5c0
push 0x58cc14
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cb63
lea eax, [ebp - 4]
call fcn.00409b08
ret