joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056da
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421d58
push esi
call sub.KERNEL32.dll_lstrcpyA
push esi
call fcn.0040568d
mov edi, eax
test edi, edi
jne 0x4056fb
xor eax, eax
jmp 0x40574d
push edi
call fcn.00405d30
test byte [0x424350], 0x80
je 0x405714
mov al, byte [edi]
test al, al
je 0x4056f7
cmp al, 0x5c
je 0x4056f7
sub edi, esi
jmp 0x40572c
call fcn.00405dc9
test eax, eax
je 0x405726
test byte [eax], 0x10
je 0x4056f7
push esi
call fcn.00405641
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405718
call fcn.004055fa
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4057be
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4057ed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405831
test edi, edi
jne 0x4057f8
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40582b
Function at 0x405835
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405e07
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405861
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4059a5
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422ae0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422ae0
je 0x4058a5
push 1
push 0
push esi
call fcn.004057be
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4059ab
cmp eax, edi
jg 0x4059ab
mov esi, 0x422558
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4059ab
cmp eax, edi
jg 0x4059ab
push esi
push ebp
push str._s_s_r_n
push 0x422158
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call sub.KERNEL32.dll_lstrcatA
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4059a5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x40598d
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x405981
push str._Rename__r_n
push edi
call fcn.00405752
test eax, eax
jne 0x4059b2
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpyA
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x422158
push eax
call fcn.0040579e
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x4243d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40931c
push eax
call fcn.00405752
test eax, eax
je 0x405968
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x4059db
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x4059ce
sub eax, edi
jmp 0x40596a
Function at 0x4059df
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405a43
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405a32
cmp dword [ebp + 0x14], 1
je 0x405a34
cmp dword [ebp + 0x14], 2
je 0x405a34
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x405e64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422ee4], 0
push esi
jne 0x405e9b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405e75
mov dword [ecx*4 + 0x422ee0], eax
inc ecx
cmp ecx, 0x100
jl 0x405e70
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405ecc
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ee0]
xor eax, esi
inc ecx
dec edx
jne 0x405eae
pop edi
not eax
pop esi
ret 0xc
Function at 0x100124c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x1001f04a
call fcn.1001124e
mov eax, dword [0x1001d808]
mov dword [ebp - 8], eax
jmp 0x100124fa
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10012513
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x10012511
mov eax, dword [ebp - 8]
jmp 0x10012596
jmp 0x100124f2
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.10011262
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10012593
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
cmp eax, 0xfe0
jbe 0x10012556
mov eax, dword [ebp - 8]
mov ecx, dword [0x1001d808]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov dword [0x1001d808], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10011262
mov esp, ebp
pop ebp
ret
Function at 0x10014090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea edi, [ebp - 0x10c]
mov ecx, 0x43
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1001d270]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x1001f068
call fcn.1001124e
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1001d7f0]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10014100
mov eax, dword [ebp - 0x30]
sub eax, 5
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
add eax, 2
mov dword [ebp - 0x24], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10011262
test eax, eax
jne 0x1001412b
mov eax, 0xa
jmp 0x1001422d
cmp dword [ebp + 0xc], 0
je 0x10014178
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x30]
add eax, 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x3c]
mov dword [eax + 1], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10014176
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x48]
mov byte [eax + 1], 0xf9
jmp 0x100141b4
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1001419f
push 7
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.100112b7
add esp, 0xc
jmp 0x100141b4
push 5
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.100112b7
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10011262
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.10011262
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.10011262
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1001425c]
call fcn.10011285
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011217
add esp, 0x10c
cmp ebp, esp
call fcn.10011262
mov esp, ebp
pop ebp
ret
Function at 0x100143b0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
lea edi, [ebp - 0x100]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1001d270]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x1001f068
call fcn.1001124e
push 0
push 4
call fcn.10011299
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1001453e
mov dword [ebp - 0x30], 0x1c
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1001123a
test eax, eax
je 0x1001452b
cmp dword [ebp - 0x30], 0x10
jb 0x1001450f
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.10011262
cmp dword [ebp - 0x24], eax
jne 0x1001450f
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.10011262
cmp dword [ebp - 0x28], eax
je 0x1001450f
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10014496
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
mov esi, esp
push ecx
push 0
mov edx, dword [0x1001d3b0]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.10011262
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10014494
jmp 0x1001452b
jmp 0x100144ef
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x100144ef
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x1001d3b0]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.10011262
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x100144d9
jmp 0x1001452b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [ebp - 0x28]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 8], ecx
mov dword [ebp - 0x30], 0x1c
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10011370
test eax, eax
jne 0x10014414
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10011262
push edx
mov ecx, ebp
push eax
lea edx, [0x10014570]
call fcn.10011285
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011217
add esp, 0x100
cmp ebp, esp
call fcn.10011262
mov esp, ebp
pop ebp
ret
Function at 0x10014830
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x1001f068
call fcn.1001124e
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100143b0
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1001490e
mov dword [ebp - 8], 0
jmp 0x1001489f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x1001490e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10011262
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1001490c
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.10011262
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.10015620
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10011262
jmp 0x10014896
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10011262
mov esp, ebp
pop ebp
ret

Function at 0x100159d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x1001f068
call fcn.1001124e
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10015a8f
mov dword [ebp - 8], 0
jmp 0x10015a16
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10015a71
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10011262
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10015a6f
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.10011262
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10011262
jmp 0x10015a0d
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x1001d3b0]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.10011262
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10011262
mov esp, ebp
pop ebp
ret
Function at 0x100161c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x1001f077
call fcn.1001124e
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x1001622b
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x1001622b
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x1001622b
xor eax, eax
jmp 0x1001626c
mov dword [ebp - 8], 1
jmp 0x1001623d
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x10016267
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x10016265
xor eax, eax
jmp 0x1001626c
jmp 0x10016234
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10011262
mov esp, ebp
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x406688
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00406b30
mov byte [esp], al
cmp byte [esp], 0
jne 0x406811
test edi, edi
je 0x406811
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406751
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x40672c
cmp edi, 0xffffffff
je 0x4066ed
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4066ed
mov byte [esp], 0
jmp 0x406811
cmp dword [esi], 1
jg 0x40672c
cmp dword [esi], 0
jne 0x40671e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40671e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x406811
lea eax, [esp + 0xc]
call fcn.00406368
dec ebp
test ebp, ebp
jg 0x4066d2
cmp edi, 0xffffffff
je 0x406751
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40674f
mov byte [esp], 0
jmp 0x406811
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x406696
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406751
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040688c
mov edx, eax
mov ebx, dword [0x4bb8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4067b5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4067b3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4067b5
xor edi, edi
cmp byte [esp], 0
je 0x4067db
mov ebx, dword [esi]
test bl, 1
jne 0x4067f1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4067bb
mov byte [esp + 1], 1
jmp 0x4067f1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4067db
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x406768
cmp byte [esp], 0
je 0x406811
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4076b8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4bb058], 0
je 0x40771f
cmp word [0x4bb344], 0xd7b2
jne 0x4076e1
cmp dword [0x4bb34c], 0
jbe 0x4076e1
mov eax, 0x4bb340
call dword [0x4bb35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40774c
call fcn.00408240
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b7032], 0
jne 0x40773b
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4078e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4b7034], 0
je 0x40790b
mov edx, edi
mov eax, esi
call dword [0x4b7034]
mov ebx, eax
jmp 0x40791c
mov eax, 8
call fcn.004053f0
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x4bb059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x4078a8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40794c
mov eax, ebx
call fcn.0040540c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40a4cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00407a20
cmp si, word [0x4b7a08]
jb 0x40a564
cmp si, word [0x4b7c08]
ja 0x40a564
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40a564
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4b7a08]
jae 0x40a53e
mov edi, ebx
dec edi
jmp 0x40a55f
cmp si, word [ebx*8 + 0x4b7a08]
jbe 0x40a54e
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40a55f
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4b7a0c]
call fcn.0040a3ec
jmp 0x40a564
cmp edi, dword [ebp - 8]
jae 0x40a528
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40a613
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40a613
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040858c
push dword [ebp - 0x160]
push 0x40a64c
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040858c
push dword [ebp - 0x164]
push 0x40a65c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040858c
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004087c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a638
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00407a80
ret