joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e1b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x100f103c
sub eax, eax
test esi, esi
je 0x1009e290
sub eax, 1
test ecx, ecx
je 0x1009e28e
test esi, 3
je 0x1009e1ee
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1009e1d3
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x1009e275
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1009e1fc
mov ecx, edx
test ecx, ecx
je 0x1009e28e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1009e27b
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x100a7e10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100f1964]
jne 0x100a7e1a
repz ret
jmp fcn.100b6c43

Function at 0x100b3a0c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x100b3a3d
call fcn.100a3e1f
mov dword [eax], esi
call fcn.100a3e0c
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.100a8ebc
add esp, 0x14
push 0x16
pop eax
jmp 0x100b3a92
test dword [ebp + 0xc], 0xfffffff9
jne 0x100b3a19
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100b3a6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100a3e32
pop ecx
call fcn.100a3e0c
mov eax, dword [eax]
jmp 0x100b3a92
test al, 0x10
jne 0x100b3a90
test al, 1
je 0x100b3a90
test byte [ebp + 0xc], 2
je 0x100b3a90
call fcn.100a3e1f
mov dword [eax], 5
call fcn.100a3e0c
mov dword [eax], 0xd
jmp 0x100b3a61
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100c27f1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100ab6c3
and dword [ebp - 4], 0
cmp dword [0x100f43a0], 0
mov ebx, eax
jne 0x100c28a2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100c2953
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100c2953
push eax
call fcn.100ab651
mov dword [esp], 0x100d70fc
push edi
mov dword [0x100f43a0], eax
call esi
push eax
call fcn.100ab651
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100f43a4], eax
call esi
push eax
call fcn.100ab651
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100f43a8], eax
call esi
push eax
call fcn.100ab651
pop ecx
mov dword [0x100f43b0], eax
test eax, eax
je 0x100c28a2
push 0x100d70b4
push edi
call esi
push eax
call fcn.100ab651
pop ecx
mov dword [0x100f43ac], eax
mov eax, dword [0x100f43ac]
cmp eax, ebx
je 0x100c28fa
cmp dword [0x100f43b0], ebx
je 0x100c28fa
push eax
call fcn.100ab6cc
push dword [0x100f43b0]
mov esi, eax
call fcn.100ab6cc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100c28fa
test edi, edi
je 0x100c28fa
call esi
test eax, eax
je 0x100c28f1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100c28f1
test byte [ebp - 0xc], 1
jne 0x100c28fa
or dword [ebp + 0x10], 0x200000
jmp 0x100c2933
mov eax, dword [0x100f43a4]
cmp eax, ebx
je 0x100c2933
push eax
call fcn.100ab6cc
pop ecx
test eax, eax
je 0x100c2933
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100c2933
mov eax, dword [0x100f43a8]
cmp eax, ebx
je 0x100c2933
push eax
call fcn.100ab6cc
pop ecx
test eax, eax
je 0x100c2933
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100f43a0]
call fcn.100ab6cc
pop ecx
test eax, eax
je 0x100c2953
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100c2955
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408b8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408c1c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408c1c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408bcf
test edx, 3
jne 0x408bbe
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408bc9
jmp 0x408bcf
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408bcf
cmp dword [ecx - 8], 1
je 0x408bd9
mov edx, ebx
or edx, 3
call fcn.004051ac
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408beb
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404a60

Function at 0x408c28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408cb8
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408cb8
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408c6b
test edx, 3
jne 0x408c5a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408c65
jmp 0x408c6b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408c6b
cmp dword [ecx - 8], 1
je 0x408c75
mov edx, ebx
or edx, 3
call fcn.004051ac
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408c87
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404a60

Function at 0x425e14
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x425e1a
ret
Function at 0x462760
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46278e
mov eax, ebx
call fcn.00463214
cmp dword [ebx + 0x40], 0
je 0x462787
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4627ff
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4627f1
cmp dword [ebx + 8], 0
je 0x4627b0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4627c2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4627f1
cmp dword [ebx + 8], 0
je 0x4627a3
cmp eax, 3
je 0x4627d5
dec eax
jne 0x4627a3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4627a3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4627a3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46281d
cmp dword [ebx + 0x14], 0xcc
je 0x46281d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00462828
pop ebx
ret

Function at 0x476998
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
movzx eax, word [ebp - 0xa]
dec eax
test eax, eax
jl 0x4769f5
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
xor al, byte [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x4a85a0]
mov edx, dword [ebp - 0x14]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4769c4
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x478270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4782cc
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x14]
mov edx, dword [ebp - 0x18]
xor al, byte [edx]
and eax, 0xff
mov edx, dword [0x4a975c]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x4782a0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x47f848
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x47f8f4
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x20]
and eax, 0xffff
or eax, 2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov edx, dword [ebp - 0x14]
xor edx, 1
imul edx, dword [ebp - 0x14]
shr edx, 8
xor al, dl
mov edx, dword [ebp - 0x18]
mov byte [edx], al
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
call fcn.00476a04
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and eax, 0xff
add dword [ebp - 0x24], eax
imul eax, dword [ebp - 0x24], 0x8088405
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
shr eax, 0x18
mov edx, dword [ebp - 0x20]
call fcn.00476a04
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x18]
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x47f88b
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x28]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x10], edx
mov esp, ebp
pop ebp
ret

Function at 0x47f914
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0047f9e0
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
and eax, 0xffff
or eax, 2
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, 1
imul dword [ebp - 0x18]
shr eax, 8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor al, byte [edx + ecx]
mov edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x24], al
mov eax, dword [ebp - 0x14]
mov al, byte [ebp + eax - 0x24]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
call fcn.00476a04
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0xc], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
shr eax, 0x18
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.00476a04
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc
jne 0x47f933
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 0x19]
sete byte [ebp - 0xd]
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4
Function at 0x47f9e0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x12345678
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x23456789
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x34567890
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47fa21
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x47fa91
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
call fcn.00476a04
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0xc], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
shr eax, 0x18
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
call fcn.00476a04
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x47fa32
mov esp, ebp
pop ebp
ret

Function at 0x481ffc
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4820ca
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xc]
or ax, 2
mov word [ebp - 0x12], ax
movzx eax, word [ebp - 0x12]
mov dx, word [ebp - 0x12]
xor dx, 1
movzx edx, dx
imul edx
shr eax, 8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor byte [edx + ecx], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.00476a04
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 8], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 8], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
shr eax, 0x18
mov edx, dword [ebp - 4]
xor al, byte [edx + 0xc]
and eax, 0xff
mov edx, dword [0x4a975c]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xc]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x482022
mov esp, ebp
pop ebp
ret
Function at 0x48d5f8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48d652
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0048d5e8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004861b4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00485dac
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d659
lea eax, [ebp - 4]
call fcn.00404a60
ret
Function at 0x49f5a4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 0x58
call fcn.00403470
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
pop ecx
pop ebp
ret

Function at 0x4014e6
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4014fa
cmp dl, 0xcc
jne 0x401544
inc eax
cmp eax, 0xffffffff
jle 0x4014ed
mov al, byte [ecx]
cmp al, 0x8b
je 0x40150a
cmp al, 0x89
jne 0x401544
cmp byte [ecx + 1], 0xff
jne 0x401544
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x401541
Function at 0x40a19c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040a65c
mov byte [esp], al
cmp byte [esp], 0
jne 0x40a325
test edi, edi
je 0x40a325
mov byte [esp + 1], 0
test ebp, ebp
jle 0x40a265
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x40a240
cmp edi, 0xffffffff
je 0x40a201
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40a201
mov byte [esp], 0
jmp 0x40a325
cmp dword [esi], 1
jg 0x40a240
cmp dword [esi], 0
jne 0x40a232
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40a232
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x40a325
lea eax, [esp + 0xc]
call fcn.00409e4c
dec ebp
test ebp, ebp
jg 0x40a1e6
cmp edi, 0xffffffff
je 0x40a265
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40a263
mov byte [esp], 0
jmp 0x40a325
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40a1aa
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40a265
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040a3a0
mov edx, eax
mov ebx, dword [0x6848fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40a2c9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40a2c7
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40a2c9
xor edi, edi
cmp byte [esp], 0
je 0x40a2ef
mov ebx, dword [esi]
test bl, 1
jne 0x40a305
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40a2cf
mov byte [esp + 1], 1
jmp 0x40a305
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40a2ef
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x40a27c
cmp byte [esp], 0
je 0x40a325
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40b1ec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x68405c], 0
je 0x40b253
cmp word [0x684348], 0xd7b2
jne 0x40b215
cmp dword [0x684350], 0
jbe 0x40b215
mov eax, 0x684344
call dword [0x684360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40b280
call fcn.0040be7c
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x679036], 0
jne 0x40b26f
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40b450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x679038], 0
je 0x40b47b
mov edx, edi
mov eax, esi
call dword [0x679038]
mov ebx, eax
jmp 0x40b48c
mov eax, 8
call fcn.00407004
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x68405d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40b418
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40b4bc
mov eax, ebx
call fcn.00407020
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40ef9c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40f103
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b590
cmp si, word [0x679a38]
jb 0x40f034
cmp si, word [0x679c38]
ja 0x40f034
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40f034
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x679a38]
jae 0x40f00e
mov edi, ebx
dec edi
jmp 0x40f02f
cmp si, word [ebx*8 + 0x679a38]
jbe 0x40f01e
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40f02f
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x679a3c]
call fcn.0040eeb8
jmp 0x40f034
cmp edi, dword [ebp - 8]
jae 0x40eff8
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40f0e3
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40f0e3
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040c1dc
push dword [ebp - 0x160]
push 0x40f120
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040c1dc
push dword [ebp - 0x164]
push 0x40f130
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040c1dc
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040c414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f10a
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040b5f0
pop eax
jmp eax
Function at 0x40f2b8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40f3be
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x686c14
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x686c2c]
jne 0x40f304
mov eax, esi
mov edx, 0x686c2e
mov ecx, 0x55
call fcn.0040c1dc
push 0x686c14
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40f3a6
push 0x686c14
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.0040b590
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40f373
cmp byte [0x686c10], 0
je 0x40f338
mov edx, esi
mov eax, ebx
call fcn.0040f19c
jmp 0x40f373
mov edx, esi
mov eax, ebx
call fcn.0040ef9c
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40f373
cmp dword [esi], 0
je 0x40f35c
mov eax, esi
mov edx, 0x40f3d8
call fcn.0040c334
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040ef9c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040c334
push 0x686c14
call sub.kernel32.dll_EnterCriticalSection
mov word [0x686c2c], bx
mov eax, dword [esi]
call fcn.0040c128
mov ecx, eax
mov eax, 0x686c2e
mov edx, 0xaa
call fcn.0040ee18
push 0x686c14
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f3c5
lea eax, [ebp - 4]
call fcn.0040b590
pop eax
jmp eax