joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bf40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 4], esi
cmp edx, 0x30
ja case.default.0x1001bf55
jmp dword [edx*4 + 0x1001c1a8]
push 7
push str.Unarmed
jmp 0x1001c185
push 0xd
push str.Brass_Knuckle
jmp 0x1001c185
push 9
push str.Golf_Club
jmp 0x1001c185
push 0xa
push str.Nightstick
jmp 0x1001c185
push 5
push str.Knife
jmp 0x1001c185
push 0xc
push str.Baseball_Bat
jmp 0x1001c185
push 6
push str.Shovel
jmp 0x1001c185
push 8
push str.Pool_Cue
jmp 0x1001c185
push 6
push str.Katana
jmp 0x1001c185
push 8
push str.Chainsaw
jmp 0x1001c185
push 7
push str.Dildo_1
jmp 0x1001c185
push 7
push str.Dildo_2
jmp 0x1001c185
push 0xa
push str.Vibrator_1
jmp 0x1001c185
push 0xa
push str.Vibrator_2
jmp 0x1001c185
push 7
push str.Flowers
jmp 0x1001c185
push 4
push str.Cane
jmp 0x1001c185
push 7
push str.Grenade
jmp 0x1001c185
push 8
push str.Tear_Gas
jmp 0x1001c185
push 0x10
push str.Molotov_Cocktail
jmp 0x1001c185
push 6
push str.Rocket
jmp 0x1001c185
push 0xd
push str.Rocket_Homing
jmp 0x1001c185
push 0xd
push str.Freefall_Bomb
jmp 0x1001c185
push 6
push str.Pistol
jmp 0x1001c185
push 0xf
push str.Silenced_Pistol
jmp 0x1001c185
push 0xc
push str.Desert_Eagle
jmp 0x1001c185
push 7
push str.Shotgun
jmp 0x1001c185
push 0x11
push str.Sawed_Off_Shotgun
jmp 0x1001c185
push 7
push str.SPAS_12
jmp 0x1001c185
push 9
push str.Micro_Uzi
jmp 0x1001c185
push 3
push 0x10040d2c
jmp 0x1001c185
push 5
push str.AK_47
jmp 0x1001c185
push 2
push 0x10040d38
jmp 0x1001c185
push 5
push str.TEC_9
jmp 0x1001c185
push 0xd
push str.Country_Rifle
jmp 0x1001c185
push 0xc
push str.Sniper_Rifle
jmp 0x1001c185
push 0xf
push str.Rocket_Launcher
jmp 0x1001c185
push 0x16
push str.Rocket_Launcher_Homing
jmp 0x1001c185
push 0xc
push str.Flamethrower
jmp 0x1001c185
push 7
push str.Minigun
jmp 0x1001c185
push 0xe
push str.Satchel_Charge
jmp 0x1001c185
push 9
push str.Detonator
jmp 0x1001c185
push 9
push str.Spray_Can
jmp 0x1001c185
push 0x11
push str.Fire_Extinguisher
jmp 0x1001c185
push 6
push str.Camera
jmp 0x1001c185
push 0x14
push str.Night_Vision_Goggles
jmp 0x1001c185
push 0x10
push str.Infrared_Goggles
jmp 0x1001c185
push 9
push str.Parachute
jmp 0x1001c185
push 0xd
push str.Unused_Weapon
jmp 0x1001c185
push 6
push str.Armour
jmp 0x1001c185
push 0xe
push str.Unknown_Weapon
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.10004a70
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001cd80
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001ce7a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1001ce73
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x1001ce59
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1001ce59
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1001ce59
mov edx, dword [esi]
test edx, edx
jne 0x1001ce22
push 0x200
push edx
push dword [0x10053560]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1001ce73
jmp 0x1001ce4d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1001ce4d
shl eax, 3
push eax
push edx
push 0
push dword [0x10053560]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1001ce73
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1001cde1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1001cebf
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1001cebf
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001ceb9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.1001cc10
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1001ce86
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100383c0
mov esp, ebp
pop ebp
ret

Function at 0x1001ced0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x1001cf1c
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1001cf0b
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1001cf04
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x1001cee1
pop edi
push dword [ebx]
push 0
push dword [0x10053560]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x1001cf20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1004a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10053870]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1001cf81
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100383c0
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1001cfa2
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1001cfc3
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1001cfc3
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1001cfbd
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1001cfc3
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.100383c0
mov esp, ebp
pop ebp
ret
Function at 0x1001d020
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x10053878]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x1001d111
mov eax, dword [0x10053870]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x1001d065
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x1001d048
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x1001d111
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.1001cd80
mov ecx, dword [0x10053878]
add esp, 4
cmp esi, ecx
jae 0x1001d0c5
imul edi, esi, 0x2c
mov eax, dword [0x10053870]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1001d0ba
mov edx, ebx
mov ecx, esi
call fcn.1001cf20
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d0c2
mov ecx, dword [0x10053878]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x1001d091
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1001d111
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1001d102
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001d0f6
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x1001d0d5
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x10053560]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100210a0
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x3c
mov eax, dword [0x100410f4]
xor ecx, ecx
cmp dword [0x1004bba8], 2
movups xmm0, xmmword [str.el]
mov dword [esp + 0x2c], eax
mov al, byte [0x100410f8]
push esi
movups xmmword [esp + 0x20], xmm0
mov byte [esp + 0x34], al
jl 0x10021210
movaps xmm0, xmmword [0x10042790]
mov eax, 4
movaps xmm4, xmmword [0x10042690]
movaps xmm3, xmmword [0x100427d0]
movaps xmm6, xmmword [str.5555::::]
movd xmm5, eax
mov eax, 0x1f
movaps xmmword [esp + 0x10], xmm0
mov edx, dword [esp + 0x10]
movd xmm7, eax
nop
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x10042780]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [esp + ecx + 0x20]
xorps xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [esp + ecx + 0x20], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x10042780]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [esp + ecx + 0x24]
xorps xmm1, xmm0
movd dword [esp + ecx + 0x24], xmm1
add ecx, 8
cmp ecx, 0x10
jl 0x10021110
cmp ecx, 0x15
jge 0x10021238
nop dword [eax + eax]
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x35
sub dl, al
add dl, 0x30
xor byte [esp + ecx + 0x20], dl
inc ecx
cmp ecx, 0x15
jl 0x10021210
lea eax, [esp + 0x20]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
cmovne ecx, esi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10031470
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x100314a1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10031490
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10032770
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d193
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea edx, [edi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], ecx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x1003286f
test cl, 0x10
jne 0x1003286f
mov al, 1
jmp 0x10032871
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov esi, dword [esi + 0x18]
sar ecx, 3
cmp esi, ecx
jae 0x10032895
lea ecx, [esi*8]
mov dword [edx + 4], ecx
jmp 0x100328c7
jbe 0x100328c7
mov eax, dword [edx + 8]
sar eax, 3
cmp esi, eax
jbe 0x100328ac
push ecx
push esi
mov ecx, edx
call fcn.10034330
jmp 0x100328c7
sub esi, ecx
je 0x100328c4
shl esi, 3
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [edi + 0x40]
add ebx, esi
mov dword [edx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10037fef
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10037fca
pop esi
leave
ret 8
Function at 0x1b008769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1b00c190
cmp edx, dword [eax]
je 0x1b00878b
add eax, 8
inc ecx
cmp eax, 0x1b00c220
jl 0x1b00877c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1b00c190]
jne 0x1b0088b9
mov eax, dword [0x1b00cbb0]
cmp eax, 1
je 0x1b008893
test eax, eax
jne 0x1b0087bc
cmp dword [0x1b00c0e4], 1
je 0x1b008893
cmp edx, 0xfc
je 0x1b0088b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1b0087f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1b009670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1b009490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1b008836
lea eax, [ebp - 0x1a4]
push eax
call fcn.1b009490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1b00b45c
push edi
call fcn.1b009f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1b009670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1b009680
lea eax, [ebp - 0xa0]
push 0x1b00b43c
push eax
call fcn.1b009680
push dword [esi + 0x1b00c194]
lea eax, [ebp - 0xa0]
push eax
call fcn.1b009680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1b009e75
add esp, 0x2c
pop edi
jmp 0x1b0088b9
lea eax, [ebp + 8]
lea esi, [esi + 0x1b00c194]
push 0
push eax
push dword [esi]
call fcn.1b009490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x417aac
Capabilities:
Encode data using xor

Disassembly:
in al, 0xff
inc dword [ebx + ebx*8 + 0x106a0f75]
push 0xfc3018
call 0xbb5f8e
salc
in al, 0x79
invalid
Function at 0x408664
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4352e4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x408681
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4086af
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x40868a
mov dword [ecx*4 + 0x4352e0], eax
inc ecx
cmp ecx, 0x100
jne 0x408683
jmp 0x408675
cmp edx, ebx
je 0x4086c8
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4352e0]
jmp 0x4086af
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x311a4ad7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x4a770826
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x408c58
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00409118
mov byte [esp], al
cmp byte [esp], 0
jne 0x408de1
test edi, edi
je 0x408de1
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408d21
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408cfc
cmp edi, 0xffffffff
je 0x408cbd
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408cbd
mov byte [esp], 0
jmp 0x408de1
cmp dword [esi], 1
jg 0x408cfc
cmp dword [esi], 0
jne 0x408cee
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408cee
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408de1
lea eax, [esp + 0xc]
call fcn.004088f0
dec ebp
test ebp, ebp
jg 0x408ca2
cmp edi, 0xffffffff
je 0x408d21
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408d1f
mov byte [esp], 0
jmp 0x408de1
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408c66
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408d21
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408e5c
mov edx, eax
mov ebx, dword [0x4e78fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408d85
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408d83
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408d85
xor edi, edi
cmp byte [esp], 0
je 0x408dab
mov ebx, dword [esi]
test bl, 1
jne 0x408dc1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408d8b
mov byte [esp + 1], 1
jmp 0x408dc1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408dab
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408d38
cmp byte [esp], 0
je 0x408de1
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409a70
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x4e9b9c
cmp dword [ebp + 0xc], 2
jl 0x409a84
mov ebx, 0x4e9bcc
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x409abc
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x4051f8
mov dword [0x4e701c], eax
mov eax, 0x405200
mov dword [0x4e7020], eax
mov eax, ebx
call fcn.00409954
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x409af1
cmp al, 3
jge 0x409af1
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x409b02
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x409b0d
call dword [ecx + eax*4]
cmp dword [0x4e7040], 0
jne 0x409b23
mov byte [0x4e7048], 1
fnstcw word [0x4e302c]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00409dd0
call fcn.00409a04
ret 4

Function at 0x409d38
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4e7058], 0
je 0x409d9f
cmp word [0x4e7348], 0xd7b2
jne 0x409d61
cmp dword [0x4e7350], 0
jbe 0x409d61
mov eax, 0x4e7344
call dword [0x4e7360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409dcc
call fcn.0040a8b4
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4e3036], 0
jne 0x409dbb
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x409f60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4e3038], 0
je 0x409f8b
mov edx, edi
mov eax, esi
call dword [0x4e3038]
mov ebx, eax
jmp 0x409f9c
mov eax, 8
call fcn.00406dd8
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x4e7059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409f28
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409fcc
mov eax, ebx
call fcn.00406df4
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40dadc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40dc43
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a0a0
cmp si, word [0x4e3a18]
jb 0x40db74
cmp si, word [0x4e3c18]
ja 0x40db74
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40db74
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4e3a18]
jae 0x40db4e
mov edi, ebx
dec edi
jmp 0x40db6f
cmp si, word [ebx*8 + 0x4e3a18]
jbe 0x40db5e
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40db6f
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4e3a1c]
call fcn.0040d9fc
jmp 0x40db74
cmp edi, dword [ebp - 8]
jae 0x40db38
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40dc23
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40dc23
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040aba0
push dword [ebp - 0x160]
push 0x40dc60
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040aba0
push dword [ebp - 0x164]
push 0x40dc70
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040aba0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040addc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dc4a
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040a100
pop eax
jmp eax