joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100905e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jbe 0x10090669
mov eax, dword [eax + edi + 0x78]
xor ebx, ebx
add eax, edi
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
add edx, edi
mov esi, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 0x24]
add edx, edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
test esi, esi
je 0x10090669
nop dword [eax]
mov eax, esi
sub eax, ebx
shr eax, 1
add eax, ebx
mov dword [ebp - 4], eax
mov edx, dword [ecx + eax*4]
add edx, edi
mov eax, edx
lea ecx, [eax + 1]
mov dword [ebp - 8], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10090638
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
push eax
push edx
mov edx, dword [ebp + 0xc]
call fcn.1007e580
add esp, 8
test eax, eax
je 0x10090672
mov ecx, dword [ebp - 4]
cmovle esi, dword [ebp - 4]
cmovle ecx, ebx
mov ebx, ecx
mov ecx, dword [ebp - 0xc]
cmp esi, ebx
jne 0x10090620
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100137b
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x100143f
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x100143f
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1001447
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x10013c2
call fcn.010020f3
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x100144c
lea esi, [ebx + 0xa]
push esi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x10013b2
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x10013f0
call fcn.010020f3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10013b7
mov ecx, eax
test esi, esi
je 0x10013fd
mov byte [ecx], 0
inc ecx
dec esi
jne 0x10013f6
push ebx
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x100141f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10013e2
push edi
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x10013e2
call dword [sym.imp.USER32.dll_CloseClipboard]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
inc eax
jmp 0x100144e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.010020f3
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x10014ed
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
cmp dword [ebp + 8], esi
je 0x100159a
cmp dword [ebp + 0xc], esi
je 0x100159a
mov ebx, 0x400
mov eax, edi
sub eax, esi
cmp eax, ebx
jae 0x1001543
add edi, ebx
cmp dword [ebp - 4], 0
lea eax, [edi + 0xa]
push eax
jne 0x1001536
call fcn.01002406
mov dword [ebp - 4], eax
jmp 0x1001543
lea eax, [ebp - 4]
push eax
call fcn.0100275c
test eax, eax
je 0x100158d
push 0
lea eax, [ebp - 8]
push eax
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 4]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100156a
add esi, dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x1001518
sub edi, esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp - 4]
lea eax, [esi + eax]
je 0x1001580
mov byte [eax], 0
inc eax
dec edi
jne 0x1001579
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
jmp 0x10015a4
lea eax, [ebp - 4]
push eax
call fcn.010026e1
push 0xe
jmp 0x100159c
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1001a90
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10056e0
call fcn.01001c44
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100649c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10018a5
cmp eax, esi
jne 0x1001898
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10018a8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100187f
xor esi, esi
inc esi
mov eax, dword [0x1006498]
cmp eax, esi
jne 0x10018bb
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10018f6
mov eax, dword [0x1006498]
test eax, eax
jne 0x10018f0
mov dword [0x1006498], esi
push 0x1001190
push 0x1001184
call fcn.010017fc
pop ecx
pop ecx
test eax, eax
je 0x10018f6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10019c0
mov dword [0x1006040], esi
mov eax, dword [0x1006498]
cmp eax, esi
jne 0x100191a
push 0x1001180
push 0x1001178
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006498], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1001927
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10064a0], ebx
je 0x1001948
push 0x10064a0
call fcn.01001bb9
pop ecx
test eax, eax
je 0x1001948
push ebx
push 2
push ebx
call dword [0x10064a0]
push dword [0x1006028]
push dword [0x100602c]
push dword [0x1006024]
call fcn.0100174b
add esp, 0xc
mov dword [0x100603c], eax
cmp dword [0x1006030], ebx
jne 0x10019a6
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1006040], ebx
jne 0x10019b4
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100603c]
call fcn.01001c89
ret
call fcn.01001d91
jmp 0x100185d
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
test dh, bh
ja 0x401006
mov bl, 0x88
mov al, ah
push 0
cmp edx, 0xe892
je 0x401018
imul esi, edx
pop ecx
bswap edi
imul ebx, edi, 0xf1799945
lea esi, [0xc60cf161]
mov dh, ah
lea eax, [0xffff2dd4]
lea ebp, [0xc50297df]
xor eax, 0xd795
mov bh, 0xd4
xadd ecx, eax
add ecx, 0x5c0
bswap ebx
dec ah
imul eax, eax
cmp ecx, 0x1b5
jb 0x401019
lea eax, [0xcabf6779]
push edi
dec esi
call 0x40107e
movsx edx, ax
mov ebp, 0xb43424fa
xor esi, 0x64b2
cmp ebp, 0xf0dd
jno 0x40107e
mov eax, 0x5a114786
imul ecx, ebp, 0x4eccc7f6
movsx esi, bp
mov edx, edx
push 0x43a9
neg esi

Function at 0x4011d0
Capabilities:
Terminate process

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 0x407040
call sub.msys_intl_8.dll_libintl_gettext
mov ebx, eax
call sub.msys_2.0.dll___errno
mov dword [esp + 8], ebx
mov eax, dword [eax]
mov dword [esp], 1
mov dword [esp + 4], eax
call sub.msys_2.0.dll_error
lea esi, [esi]
Function at 0x4016e0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40175b
mov dword [esp + 4], 0x2f
mov dword [esp], ebx
call sub.msys_2.0.dll_strrchr
test eax, eax
je 0x401743
lea edx, [eax + 1]
mov ecx, edx
sub ecx, ebx
cmp ecx, 6
jle 0x401743
mov ecx, 7
lea esi, [eax - 6]
mov edi, str._.libs_
repe cmpsb byte [esi], byte es:[edi]
seta cl
sbb cl, 0
test cl, cl
jne 0x401743
cmp byte [eax + 1], 0x6c
jne 0x401757
cmp byte [edx + 1], 0x74
jne 0x401757
cmp byte [edx + 2], 0x2d
jne 0x401757
lea ebx, [eax + 4]
mov eax, dword [sym.imp.msys_2.0.dll_program_invocation_short_name]
mov dword [eax], ebx
mov eax, dword [sym.imp.msys_2.0.dll_program_invocation_name]
mov dword [0x40c02c], ebx
mov dword [eax], ebx
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov ebx, edx
jmp 0x401743
call sub.msys_2.0.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x37
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.A_NULL_argv_0__was_passed_through_an_exec_system_call._n
call sub.msys_2.0.dll_fwrite
call sub.msys_2.0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x403e50
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [esp], 0
call fcn.004041f0
mov dword [esp + 0x2c], eax
test eax, eax
je 0x403fad
mov esi, eax
mov edi, str.US_ASCII
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
seta al
sbb al, 0
test al, al
je 0x403f01
mov esi, dword [esp + 0x2c]
mov edi, 0x40840a
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
seta al
sbb al, 0
test al, al
je 0x403ef5
xor ebp, ebp
mov edi, 0x17
jmp 0x403eb4
je 0x403fba
mov edi, esi
cmp ebp, edi
jae 0x403ee2
lea eax, [edi + ebp]
mov esi, eax
and eax, 0xfffffffe
shr esi, 1
add eax, esi
lea ebx, [eax*8 + str.CP1361]
mov eax, dword [esp + 0x2c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msys_2.0.dll_strcmp
test eax, eax
jns 0x403ea8
lea ebp, [esi + 1]
cmp ebp, edi
jb 0x403eb4
mov edx, dword [esp + 0x2c]
mov eax, 0x4083e1
cmp byte [edx], 0
cmovne eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LC_ALL
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x403fcd
cmp byte [eax], 0
je 0x403fcd
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x403f5a
lea ebx, [eax + 1]
mov dword [esp + 4], 0x40
mov dword [esp], ebx
mov dword [esp + 0x2c], ebx
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x403ef5
sub eax, ebx
mov esi, eax
cmp eax, 0xc
jbe 0x404008
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ebx, [esp + 0x33]
mov dword [esp + 0xc], str.CP_u
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0xd
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msys_2.0.dll___sprintf_chk
mov dword [esp + 8], 0xd
mov dword [esp + 4], ebx
mov dword [esp], 0x40c180
call sub.msys_2.0.dll___strcpy_chk
mov dword [esp + 0x2c], 0x40c180
jmp 0x403e86
mov dword [esp + 0x2c], 0x4083e0
jmp 0x403e9f
lea eax, [ebx + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LC_CTYPE
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x403fe6
cmp byte [eax], 0
jne 0x403f1e
mov dword [esp], str.LANG
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x403f5a
cmp byte [eax], 0
je 0x403f5a
jmp 0x403f1e
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], 0xd
mov dword [esp + 4], eax
mov dword [esp], 0x40c180
call sub.msys_2.0.dll___memcpy_chk
mov byte [esi + 0x40c180], 0
mov dword [esp + 0x2c], 0x40c180
jmp 0x403ef5
Function at 0x6701b4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00670140
ret
Function at 0x409042
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 0x88
dec eax
mov esi, dword [0x821a]
fld xword [ecx]
mov ecx, 8
mov edi, edx
dec eax
mov eax, dword [esi]
dec eax
mov dword [esp + 0x78], eax
xor eax, eax
fstp xword [esp + 0x20]
call fcn.0040e222
dec eax
test eax, eax
dec eax
mov ebx, eax
je 0x40917e
dec eax
lea ecx, [esp + 0x60]
dec eax
lea edx, [esp + 0x50]
dec esp
lea eax, [esp + 0x74]
fld xword [esp + 0x20]
fstp xword [esp + 0x50]
call fcn.0040d0b2
fldz
fld xword [esp + 0x60]
fucomi st(1)
fstp st(1)
jb 0x4091c9
fld1
fucomi st(1)
jbe 0x4091cd
fnstcw word [esp + 0x3e]
movzx eax, word [esp + 0x3e]
inc ecx
mov ecx, 2
inc ecx
mov eax, 2
or ah, 0xc
mov word [esp + 0x3c], ax
fld dword [0x7e7d]
fmul st(2), st(0)
fxch st(2)
fld st(0)
fldcw word [esp + 0x3c]
fistp dword [esp + 0x38]
fldcw word [esp + 0x3e]
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x20], eax
dec eax
mov edx, eax
fild qword [esp + 0x20]
fsubp st(1)
fldz
fxch st(1)
fucomi st(1)
jb 0x4091d3
fxch st(2)
fucomi st(2)
jbe 0x4091dd
fxch st(2)
fmulp st(3)
fxch st(2)
fld st(0)
fldcw word [esp + 0x3c]
fistp dword [esp + 0x38]
fldcw word [esp + 0x3e]
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x20], eax
fild qword [esp + 0x20]
fsubp st(1)
fucomi st(2)
fstp st(2)
jb 0x4091e7
fucomi st(1)
jbe 0x4091ed
shl edx, 0x10
or edx, eax
inc ecx
cmp ecx, 1
inc edx
mov dword [ebx + eax*4 - 4], edx
inc ecx
mov eax, 1
jne 0x4091b5
fstp st(0)
fstp st(0)
mov edx, dword [ebx + 4]
test edx, edx
jne 0x4091c2
mov eax, dword [ebx]
xor ebp, ebp
test eax, eax
inc eax
setne ch
mov eax, dword [esp + 0x74]
dec ecx
mov ebp, ebx
inc esp
lea esp, [eax - 0x40]
dec eax
lea edx, [esp + 0x40]
inc ecx
mov ecx, edi
dec ecx
mov eax, ebx
inc esp
mov ecx, esp
dec eax
mov dword [esp + 0x40], ebp
dec esp
mov dword [esp + 0x48], ebp
call fcn.004089d2
dec eax
mov edi, dword [esp + 0x78]
dec eax
xor edi, dword [esi]
jne 0x4091f6
dec eax
add esp, 0x88
pop ebx
pop esi
pop edi
pop ebp
inc ecx
pop esp
inc ecx
pop ebp
ret
inc ecx
mov ecx, 1
jmp 0x4090d3
mov ebp, 2
jmp 0x409173
fstp st(0)
jmp 0x4091f1
fstp st(0)
fstp st(0)
jmp 0x4091f1
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x4091f1
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x4091f1
fstp st(0)
fstp st(0)
jmp 0x4091f1
fstp st(0)
fstp st(0)
call fcn.0040e0d2
call fcn.0040e0a2
nop
nop word [eax + eax]
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x12c3a8c
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
mov ss, word [ebx]
cld
invalid
test byte [eax - 0x3ffd1d9d], ah
in al, dx
and eax, 0xb6510432
push ecx
and dword [ecx], ecx
jnp 0x401097
sub byte [ebx - 0x59b7efec], ch
adc al, 0x28
in al, 0x4c
pushal
push edx
stc
sti
cmp al, 0x48
mov ebp, 0x731d4a4b
push esi
in al, dx
retf
Function at 0x4075b8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a558
test esi, esi
jne 0x4075ee
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a6f0
jmp 0x40760c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004074fc
mov edi, eax
test esi, esi
je 0x40760c
cmp dword [ebx], 0
je 0x40760c
dec esi
jmp 0x4075f5
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4090a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00409560
mov byte [esp], al
cmp byte [esp], 0
jne 0x409229
test edi, edi
je 0x409229
mov byte [esp + 1], 0
test ebp, ebp
jle 0x409169
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x409144
cmp edi, 0xffffffff
je 0x409105
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409105
mov byte [esp], 0
jmp 0x409229
cmp dword [esi], 1
jg 0x409144
cmp dword [esi], 0
jne 0x409136
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x409136
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x409229
lea eax, [esp + 0xc]
call fcn.00408d50
dec ebp
test ebp, ebp
jg 0x4090ea
cmp edi, 0xffffffff
je 0x409169
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409167
mov byte [esp], 0
jmp 0x409229
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4090ae
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409169
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004092a4
mov edx, eax
mov ebx, dword [0x8778fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4091cd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4091cb
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4091cd
xor edi, edi
cmp byte [esp], 0
je 0x4091f3
mov ebx, dword [esi]
test bl, 1
jne 0x409209
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4091d3
mov byte [esp + 1], 1
jmp 0x409209
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4091f3
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409180
cmp byte [esp], 0
je 0x409229
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40a1b4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x87705c], 0
je 0x40a21b
cmp word [0x877348], 0xd7b2
jne 0x40a1dd
cmp dword [0x877350], 0
jbe 0x40a1dd
mov eax, 0x877344
call dword [0x877360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a248
call fcn.0040ae18
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x85403a], 0
jne 0x40a237
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40a418
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x85403c], 0
je 0x40a443
mov edx, edi
mov eax, esi
call dword [0x85403c]
mov ebx, eax
jmp 0x40a454
mov eax, 8
call fcn.00407234
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x87705d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a3e0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40a484
mov eax, ebx
call fcn.00407250
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40e66c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40e7d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a558
cmp si, word [0x854a18]
jb 0x40e704
cmp si, word [0x854c18]
ja 0x40e704
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40e704
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x854a18]
jae 0x40e6de
mov edi, ebx
dec edi
jmp 0x40e6ff
cmp si, word [ebx*8 + 0x854a18]
jbe 0x40e6ee
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40e6ff
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x854a1c]
call fcn.0040e588
jmp 0x40e704
cmp edi, dword [ebp - 8]
jae 0x40e6c8
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40e7b3
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40e7b3
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b178
push dword [ebp - 0x160]
push 0x40e7f0
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040b178
push dword [ebp - 0x164]
push 0x40e800
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b178
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040b3b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e7da
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040a5b8
pop eax
jmp eax
Function at 0x40e988
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ea8e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x879c14
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x879c2c]
jne 0x40e9d4
mov eax, esi
mov edx, 0x879c2e
mov ecx, 0x55
call fcn.0040b178
push 0x879c14
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40ea76
push 0x879c14
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.0040a558
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40ea43
cmp byte [0x879c10], 0
je 0x40ea08
mov edx, esi
mov eax, ebx
call fcn.0040e86c
jmp 0x40ea43
mov edx, esi
mov eax, ebx
call fcn.0040e66c
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40ea43
cmp dword [esi], 0
je 0x40ea2c
mov eax, esi
mov edx, 0x40eaa8
call fcn.0040b2d0
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040e66c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040b2d0
push 0x879c14
call sub.kernel32.dll_EnterCriticalSection
mov word [0x879c2c], bx
mov eax, dword [esi]
call fcn.0040b0c4
mov ecx, eax
mov eax, 0x879c2e
mov edx, 0xaa
call fcn.0040e4e8
push 0x879c14
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ea95
lea eax, [ebp - 4]
call fcn.0040a558
pop eax
jmp eax