joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ed78
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4817d8
cmp dword [edi], 0
jne 0x43edf4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4817d4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x47e934
mov ecx, 2
call fcn.00402908
mov edx, 0x43ed50
lea eax, [esi + 5]
call fcn.0043ed70
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0043ed70
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43edc9
mov dword [0x4817d4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43ef18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43ef68]
test si, 4
je 0x43ef2c
or bl, 1
test si, 8
je 0x43ef36
or bl, 4
test si, 1
je 0x43ef40
or bl, 8
test si, 2
je 0x43ef4a
or bl, 0x10
test si, 0x10
je 0x43ef54
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ef63
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x43ef6c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43efa4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ef85
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43ef94
or bl, 4
test esi, 0x20000000
je 0x43ef9f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x445648
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4457ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40f558]
call fcn.00402f38
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403b5c
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4457c3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004351a8
test al, al
je 0x4457b6
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4457fc
lea eax, [ebp - 0x254]
call fcn.004094d0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4457b6
xor eax, eax
push ebp
push 0x4457af
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x445834
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x445798
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403d88
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x445798
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403d88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4457b6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4456b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.00413018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4457f4
lea eax, [ebp - 0x260]
call fcn.00403b5c
ret
Function at 0x4460f8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44610f
add esp, 0xfffffff0
call fcn.004032a8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00417568
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40f02c]
call fcn.00402f38
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x40f02c]
call fcn.00402f38
mov dword [ebx + 0x90], eax
xor eax, eax
mov dword [ebx + 0x48], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x44], 0x80000018
mov dword [ebx + 0x60], 0x1f4
mov byte [ebx + 0x64], 1
xor eax, eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x85], 1
mov dl, 1
mov eax, dword [0x4192f4]
call fcn.00420344
mov esi, eax
mov dword [ebx + 0x80], esi
push 0x446280
mov eax, dword [0x47fc94]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004206e8
mov eax, dword [ebx + 0x80]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x447ba4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47fc94]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c768
test eax, eax
je 0x4461ff
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408de8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c790
test eax, eax
je 0x446213
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x74]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403d88
mov eax, dword [0x47fb20]
cmp byte [eax], 0
jne 0x446244
mov eax, ebx
call fcn.0044636c
mov byte [ebx + 0x41], 1
mov byte [ebx + 0x42], 1
mov byte [ebx + 0x43], 1
mov byte [ebx + 0x86], 1
xor eax, eax
mov dword [ebx + 0x88], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x446276
call fcn.00403300
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4465c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4817a8]
cmp dword [eax + 0x24], 0
je 0x446658
cmp dword [ebx + 0x7c], 0
jne 0x446655
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44655c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x78]
cmp dword [eax + 8], 0
je 0x446655
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x446624
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x78]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x446655
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x78]
call fcn.00410a60
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x446630
inc dword [ebx + 0x7c]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x446fa8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x446fdd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c40
jmp 0x446fe7
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.00403bf4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x447ed4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x447f0c
mov eax, esi
call fcn.00430ee8
test al, al
je 0x447f0c
mov eax, dword [ebx + 0x6c]
call fcn.00430ac0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x447f0c
push 0
mov eax, dword [ebx + 0x6c]
call fcn.00430ac0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45f157
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x47f87e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45f1af
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x47f89f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45f1a5
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x45f1b3
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4718f4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f8c
xor eax, eax
push ebp
push 0x47198f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00408b5c
test al, al
je 0x471979
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00408a24
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x471965
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47196c
mov eax, dword [ebp - 0xc]
call fcn.00408aec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471996
lea eax, [ebp - 4]
call fcn.00403b5c
ret
Function at 0x4730c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00403f8c
mov eax, dword [ebp - 8]
call fcn.00403f8c
mov eax, dword [ebp + 8]
call fcn.00403f8c
xor eax, eax
push ebp
push 0x47319c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4731b4
call fcn.00403de0
lea eax, [ebp - 8]
mov edx, 0x4731b4
call fcn.00403de0
lea eax, [ebp + 8]
mov edx, 0x4731b4
call fcn.00403de0
mov bl, 1
push 1
lea eax, [ebp + 8]
call fcn.00403fa8
push eax
lea eax, [ebp - 8]
call fcn.00403fa8
push eax
lea eax, [ebp - 4]
call fcn.00403fa8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jae 0x473179
xor ebx, ebx
push 0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x4731c0
call fcn.00403e24
mov eax, dword [ebp - 0xc]
mov cx, word [0x4731d4]
mov dl, 1
call fcn.0044b1b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4731a3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403b80
lea eax, [ebp + 8]
call fcn.00403b5c
ret
Function at 0x66bc41
Capabilities:
Execute anti-debugging instructions

Disassembly:
call eax
jl 0x66bb7c
jmp 0x66bb7c
push edi
pushal
jg 0x66bb84
push esi
pop esi
popal
push eax
push eax
push edx
rdtsc
pop edx
pop eax
jl 0x66bb94
pop eax
pop edi
pushfd
push ecx
mov dword [esp], 0x3ffb6e38
inc dword [esp]
sub dword [esp], 0x6dbb85ff
sub dword [esp], 0xb2400cc7
inc dword [esp]
add dword [esp], 0x5dfd460a
add dword [esp], 0x66ebcbb4
sub dword [esp], 0x79dfe249
push edi
mov dword [esp], ecx
mov ecx, 0x94f6f6f2
add dword [esp + 4], ecx
pop ecx
push ebp
mov dword [esp], 0x59f1fad4
xor dword [esp], 0x76dfbdfc
shl dword [esp], 6
shr dword [esp], 3
push esi
mov esi, 0x569f15ce
sub dword [esp + 4], esi
pop esi
xor dword [esp], 0xbd6cd28d
shl dword [esp], 4
sub dword [esp], 0x7e13c997
xor dword [esp], 0x7dcdff8a
push eax
mov dword [esp], 0x32ff6b63
not dword [esp]
dec dword [esp]
push edx
mov edx, 0x4f7f6a3e
add dword [esp + 4], edx
pop edx
dec dword [esp]
not dword [esp]
and dword [esp], 0x6fd6415a
xor dword [esp], 0x1e6b69a2
mov dword [esp], eax
push ebp
mov ebp, esp
add ebp, 4
push eax
mov eax, 4
sub ebp, eax
mov eax, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
xchg dword [esp], ebp
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
push dword [esp]
pop eax
add esp, 4
add esp, 4
push dword [esp + 8]
mov ebx, dword [esp]
push esi
push esp
pop esi
add esi, 4
push edx
mov edx, 4
add esi, edx
pop edx
xchg dword [esp], esi
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
push eax
push esp
pop eax
add eax, 4
add eax, 4
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
mov esp, dword [esp]
mov eax, dword [esp]
push edx
mov edx, esp
add edx, 4
push eax
mov eax, 4
add edx, eax
pop eax
push edx
push dword [esp + 4]
mov edx, dword [esp]
add esp, 4
pop dword [esp]
pop esp
jmp 0x5d3a2b
Function at 0x6895c99c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6895caa0
jmp 0x6895cb93
jmp 0x6895cc86
jmp 0x6895cd79
jmp 0x6895ce6c
jmp 0x6895cf5f
jmp 0x6895d052
jmp 0x6895d145
jmp 0x6895d238
jmp 0x6895d32b
jmp 0x6895d41e
jmp 0x6895d511
jmp 0x6895d604
jmp 0x6895d6f7
jmp 0x6895d7ea
jmp 0x6895d8dd
jmp 0x6895d9d0
jmp 0x6895dac3
jmp 0x6895dbb6
jmp 0x6895dca9
jmp 0x6895dd9c
jmp 0x6895de8f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6895df88
jmp 0x6895e07b
jmp 0x6895e16e
jmp 0x6895e261
jmp 0x6895e354
jmp 0x6895e447
jmp 0x6895e53a
jmp 0x6895e62d
jmp 0x6895e720
jmp 0x6895e813
jmp 0x6895e906
jmp 0x6895e9f9
jmp 0x6895eaec
jmp 0x6895ebdf
jmp 0x6895ecd2
jmp 0x6895edc5
jmp 0x6895eeb8
jmp 0x6895efab
jmp 0x6895f09e
jmp 0x6895f191
jmp 0x6895f284
jmp 0x6895f377
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6895f484
jmp 0x6895f577
jmp 0x6895f66a
jmp 0x6895f75d
jmp 0x6895f850
jmp 0x6895f943
jmp 0x6895fa36
jmp 0x6895fb29
jmp 0x6895fc1c
jmp 0x6895fd0f
jmp 0x6895fe02
jmp 0x6895fef5
jmp 0x6895ffe8
jmp 0x689600db
jmp 0x689601ce
jmp 0x689602c1
jmp 0x689603b4
jmp 0x689604a7
jmp 0x6896059a
jmp 0x6896068d
jmp 0x68960780
jmp 0x68960873
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6896096f
jmp 0x68960a62
jmp 0x68960b55
jmp 0x68960c48
jmp 0x68960d3b
jmp 0x68960e2e
jmp 0x68960f21
jmp 0x68961014
jmp 0x68961107
jmp 0x689611fa
jmp 0x689612ed
jmp 0x689613e0
jmp 0x689614d3
jmp 0x689615c6
jmp 0x689616b9
jmp 0x689617ac
jmp 0x6896189f
jmp 0x68961992
jmp 0x68961a85
jmp 0x68961b78
jmp 0x68961c6b
jmp 0x68961d5e
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x68961e6a
jmp 0x68961f5d
jmp 0x68962050
jmp 0x68962143
jmp 0x68962236
jmp 0x68962329
jmp 0x6896241c
jmp 0x6896250f
jmp 0x68962602
jmp 0x689626f5
jmp 0x689627e8
jmp 0x689628db
jmp 0x689629ce
jmp 0x68962ac1
jmp 0x68962bb4
jmp 0x68962ca7
jmp 0x68962d9a
jmp 0x68962e8d
jmp 0x68962f80
jmp 0x68963073
jmp 0x68963166
jmp 0x68963259
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x68963366
jmp 0x68963459
jmp 0x6896354c
jmp 0x6896363f
jmp 0x68963732
jmp 0x68963825
jmp 0x68963918
jmp 0x68963a0b
jmp 0x68963afe
jmp 0x68963bf1
jmp 0x68963ce4
jmp 0x68963dd7
jmp 0x68963eca
jmp 0x68963fbd
jmp 0x689640b0
jmp 0x689641a3
jmp 0x68964296
jmp 0x68964389
jmp 0x6896447c
Function at 0x68998f6b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6934f018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6934f018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6899907e
jmp 0x68999171
jmp 0x68999264
jmp 0x68999357
jmp 0x6899944a
jmp 0x6899953d
jmp 0x68999630
jmp 0x68999723
jmp 0x68999816
jmp 0x68999909
jmp 0x689999fc
jmp 0x68999aef
jmp 0x68999be2
jmp 0x68999cd5
jmp 0x68999dc8
jmp 0x68999ebb
jmp 0x68999fae
jmp 0x6899a0a1
jmp 0x6899a194
jmp 0x6899a287
jmp 0x6899a37a
jmp 0x6899a46d
mov dword [ebp - 0x14], 0
jmp 0x6899a567
jmp 0x6899a65a
jmp 0x6899a74d
jmp 0x6899a840
jmp 0x6899a933
jmp 0x6899aa26
jmp 0x6899ab19
jmp 0x6899ac0c
jmp 0x6899acff
jmp 0x6899adf2
jmp 0x6899aee5
jmp 0x6899afd8
jmp 0x6899b0cb
jmp 0x6899b1be
jmp 0x6899b2b1
jmp 0x6899b3a4
jmp 0x6899b497
jmp 0x6899b58a
jmp 0x6899b67d
jmp 0x6899b770
jmp 0x6899b863
jmp 0x6899b956
mov dword [ebp - 0x18], 0
jmp 0x6899ba50
jmp 0x6899bb43
jmp 0x6899bc36
jmp 0x6899bd29
jmp 0x6899be1c
jmp 0x6899bf0f
jmp 0x6899c002
jmp 0x6899c0f5
jmp 0x6899c1e8
jmp 0x6899c2db
jmp 0x6899c3ce
jmp 0x6899c4c1
jmp 0x6899c5b4
jmp 0x6899c6a7
jmp 0x6899c79a
jmp 0x6899c88d
jmp 0x6899c980
jmp 0x6899ca73
jmp 0x6899cb66
jmp 0x6899cc59
jmp 0x6899cd4c
jmp 0x6899ce3f
mov dword [ebp - 0x10], 0
jmp 0x6899cf39
jmp 0x6899d02c
jmp 0x6899d11f
jmp 0x6899d212
jmp 0x6899d305
jmp 0x6899d3f8
jmp 0x6899d4eb
jmp 0x6899d5de
jmp 0x6899d6d1
jmp 0x6899d7c4
jmp 0x6899d8b7
jmp 0x6899d9aa
jmp 0x6899da9d
jmp 0x6899db90
jmp 0x6899dc83
jmp 0x6899dd76
jmp 0x6899de69
jmp 0x6899df5c
jmp 0x6899e04f
jmp 0x6899e142
jmp 0x6899e235
jmp 0x6899e328
mov dword [ebp - 0x10], 0
jmp 0x689a4be6
jmp 0x6899e427
jmp 0x6899e51a
jmp 0x6899e60d
jmp 0x6899e700
jmp 0x6899e7f3
jmp 0x6899e8e6
jmp 0x6899e9d9
jmp 0x6899eacc
jmp 0x6899ebbf
jmp 0x6899ecb2
jmp 0x6899eda5
jmp 0x6899ee98
jmp 0x6899ef8b
jmp 0x6899f07e
jmp 0x6899f171
jmp 0x6899f264
jmp 0x6899f357
jmp 0x6899f44a
jmp 0x6899f53d
jmp 0x6899f630
jmp 0x6899f723
jmp 0x6899f816
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6934f014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6899f91a
jmp 0x6899fa0d
jmp 0x6899fb00
jmp 0x6899fbf3
jmp 0x6899fce6
jmp 0x6899fdd9
jmp 0x6899fecc
jmp 0x6899ffbf
jmp 0x689a00b2
jmp 0x689a01a5
jmp 0x689a0298
jmp 0x689a038b
jmp 0x689a047e
jmp 0x689a0571
jmp 0x689a0664
jmp 0x689a0757
jmp fcn.689a084a
mov eax, dword [0x6934f018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6899e334
nop
leave
ret
Function at 0x406790
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004091a4
test esi, esi
jne 0x4067c6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040932c
jmp 0x4067e4
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004066d4
mov edi, eax
test esi, esi
je 0x4067e4
cmp dword [ebx], 0
je 0x4067e4
dec esi
jmp 0x4067cd
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x407ed0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004082a8
mov byte [esp], al
cmp byte [esp], 0
jne 0x408050
test edi, edi
je 0x408050
mov byte [esp + 1], 0
test ebp, ebp
jle 0x407f90
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x407f6b
cmp edi, 0xffffffff
je 0x407f2f
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x407f2f
mov byte [esp], 0
jmp 0x408050
mov ebx, dword [esi]
cmp ebx, 1
jg 0x407f6b
test ebx, ebx
jne 0x407f61
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x407f61
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408050
call 0x4083c8
dec ebp
test ebp, ebp
jg 0x407f14
cmp edi, 0xffffffff
je 0x407f90
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x407f8e
mov byte [esp], 0
jmp 0x408050
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x407ede
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x407f90
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004080bc
mov edx, eax
mov ebx, dword [0x6878f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x407ff4
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x407ff2
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x407ff4
xor edi, edi
cmp byte [esp], 0
je 0x40801a
mov ebx, dword [esi]
test bl, 1
jne 0x408030
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x407ffa
mov byte [esp + 1], 1
jmp 0x408030
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40801a
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x407fa7
cmp byte [esp], 0
je 0x408050
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408e04
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x687058], 0
je 0x408e6b
cmp word [0x687344], 0xd7b2
jne 0x408e2d
cmp dword [0x68734c], 0
jbe 0x408e2d
mov eax, 0x687340
call dword [0x68735c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x408e98
call fcn.00409bb8
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x66a032], 0
jne 0x408e87
push 0
push 0x66a9ea
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x409064
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x66a034], 0
je 0x40908f
mov edx, edi
mov eax, esi
call dword [0x66a034]
mov ebx, eax
jmp 0x4090a0
mov eax, 8
call fcn.004063fc
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x687059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40902c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x4090d0
mov eax, ebx
call fcn.00406418
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40ba24
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40bb89
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004091a4
cmp si, word [0x66aa28]
jb 0x40babc
cmp si, word [0x66ac28]
ja 0x40babc
mov edi, pe_nt_image_headers32
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40babc
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x66aa28]
jae 0x40ba96
mov edi, ebx
dec edi
jmp 0x40bab7
cmp si, word [ebx*8 + 0x66aa28]
jbe 0x40baa6
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40bab7
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x66aa2c]
call fcn.0040b944
jmp 0x40babc
cmp edi, dword [ebp - 8]
jae 0x40ba80
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40bb6b
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40bb6b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00409f5c
push dword [ebp - 0x160]
push 0x40bba4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00409f5c
push dword [ebp - 0x164]
push 0x40bbb4
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00409f5c
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040a194
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bb90
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409204
ret