joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100178a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f55d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10056050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
mov dword [ebp - 0x28], 0
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.100146c0
mov dword [ebp - 4], 0
lea eax, [esi + 1]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, dword [ebp - 0x28]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [0x1005b8e0]
lea ecx, [ebp - 0x28]
call fcn.100100e0
test al, al
jne 0x1001797c
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1001795f
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10017955
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017981
push edx
push ecx
call fcn.1001bb9d
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b845
mov esp, ebp
pop ebp
ret
call fcn.10017670
call fcn.10020268
int3

Function at 0x10017c70
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x1005ba88
call fcn.1001d6d0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x10017c9b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10017ca6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10017cb1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10017cbc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10017cc7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10017cd2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10017cdd
bts eax, 1
test cl, 2
je 0x10017ce6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x10017d7f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10017d70
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x1005ba88], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10017c90
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017db0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10056050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x1005104c
push eax
or ebx, 0xffffffff
call fcn.10023c4b
add esp, 8
mov dword [ebp - 0x408], eax
test eax, eax
jne 0x10017df6
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001b845
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop dword [eax + eax]
push eax
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.1002164c
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x10017e4d
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1005ba88]
sub edx, 1
jne 0x10017e25
mov eax, dword [ebp - 0x408]
cmp edi, 0x400
je 0x10017e00
push dword [ebp - 0x408]
call fcn.100207ab
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.1001b845
mov esp, ebp
pop ebp
ret 4
Function at 0x10018880
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x10056050]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10018936
lea eax, [esp + 4]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10018936
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10018936
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10018936
push 0
push 0
push 0
push 0x10018830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1001b845
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
xor ecx, esp
call fcn.1001b845
mov esp, ebp
pop ebp
ret

Function at 0x100189b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
mov esi, ecx
push esi
push 0
call edi
test eax, eax
je 0x10018a7d
push ebx
push esi
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [ebp - 4]
push ecx
push eax
call ebx
push dword [ebp - 4]
push 1
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x1005b980]
cmp eax, 1
jne 0x10018a29
push 0
push 0
push 0
push 0x10018980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10018a3b
push 0
push 0
push 0
push 0x10018950
jmp 0x10018a0c
cmp eax, 3
jne 0x10018a4d
push 0
push 0
push 0
push 0x10001f10
jmp 0x10018a0c
push esi
push 0
call edi
lea ecx, [ebp - 4]
push ecx
push eax
call ebx
push dword [ebp - 4]
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
push 1
push 0x100001
call eax
push 0
push eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10019a60
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f2fb
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10056050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005b97c], 1
jne 0x10019b1c
sub esp, 0xc
lea ecx, [ebp - 0x174]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nHT_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.10005930
mov edx, str.Hide_windows_detected_
lea ecx, [ebp - 0x174]
call fcn.10005930
lea ecx, [ebp - 0x170]
call fcn.10004900
test eax, eax
jne 0x10019b0a
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005b98c], 1
jne 0x10019bfd
lea eax, [ebp - 0x14]
push eax
call fcn.10020f8f
lea eax, [ebp - 0x14]
push eax
call fcn.1002127c
push ecx
push 0x1004c450
lea ecx, [ebp - 0xc4]
mov esi, eax
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc4]
call fcn.10005930
push esi
call fcn.10021ca8
add esp, 4
lea ecx, [ebp - 0xc4]
mov edx, eax
call fcn.10005930
mov edx, str.HT_Scan:
lea ecx, [ebp - 0xc4]
call fcn.10005930
mov edx, str.Hide_windows_detected_
lea ecx, [ebp - 0xc4]
call fcn.10005930
mov edx, str._n__________________
lea ecx, [ebp - 0xc4]
call fcn.10005930
lea ecx, [ebp - 0xc0]
call fcn.10004900
test eax, eax
jne 0x10019be5
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004c450
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.100030f0
mov eax, dword [0x1005b980]
push 0
cmp eax, 1
jne 0x10019c2f
push 0
push 0
push 0x10019a30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10019c3f
push 0
push 0
push 0x10019a00
jmp 0x10019c12
cmp eax, 3
jne 0x10019c4f
push 0
push 0
push 0x10001f10
jmp 0x10019c12
cmp eax, 4
jne 0x10019c29
push 0
push 0
push 0x1001a230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.H_Scan
push str.Generic_Hide_Window
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10019c27
Function at 0x10019c80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20a00
call fcn.1001c810
mov eax, dword [0x10056050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
xor eax, eax
push esi
push esi
mov dword [ebp - 0x20a00], eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x10019d7b
push ebx
lea ebx, [ebp - 0x209f4]
nop dword [eax]
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x10019d5a
lea eax, [ebp - 0x209fc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x209fc]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x10019d5a
mov eax, dword [ebp - 0x209fc]
mov dword [ebx], eax
lea eax, [ebx + 4]
push 0xff
push eax
push edi
mov dword [ebx - 4], edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xff
lea eax, [ebx + 0x103]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
inc dword [ebp - 0x20a00]
add ebx, 0x208
mov ecx, dword [ebp - 0x209fc]
xor eax, eax
test esi, esi
jle 0x10019d4e
nop word [eax + eax]
cmp ecx, dword [ebp + eax*4 - 0x400]
je 0x10019d4e
inc eax
cmp eax, esi
jl 0x10019d40
cmp eax, esi
jne 0x10019d5a
mov dword [ebp + esi*4 - 0x400], ecx
inc esi
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x10019cc0
pop ebx
cmp dword [ebp - 0x20a00], eax
je 0x10019d7b
cmp esi, 1
jg 0x10019d93
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001b845
mov esp, ebp
pop ebp
ret
call fcn.10019a60
int3

Function at 0x10019e40
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x1005b980]
cmp eax, 1
je 0x10019e8c
cmp eax, 4
je 0x10019e8c
push 0
cmp eax, 2
jne 0x10019e7c
push 0
push 0
push 0x10019de0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x10019e76
push 0
push 0
push 0x10001f10
jmp 0x10019e5f
push 0
push 0
push 0
push 0x10019e10
jmp 0x10019e5f
Function at 0x1001a2f0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f6d0
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x10056050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005b97c], 1
jne 0x1001a3a0
sub esp, 0xc
lea ecx, [ebp - 0xbc]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nAKS_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.10005930
mov edx, str.Thread_attack_
lea ecx, [ebp - 0xbc]
call fcn.10005930
lea ecx, [ebp - 0xb8]
call fcn.10004900
test eax, eax
jne 0x1001a395
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xbc]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0xbc]
call fcn.100030f0
mov eax, dword [0x1005b980]
cmp eax, 1
je 0x1001a3ec
cmp eax, 4
je 0x1001a3ec
push 0
cmp eax, 2
jne 0x1001a3dc
push 0
push 0
push 0x1001a250
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x1001a3d6
push 0
push 0
push 0x10001f10
jmp 0x1001a3bf
push 0
push 0
push 0
push 0x1001a2a0
jmp 0x1001a3bf

Function at 0x1001a6d0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10007130
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov eax, dword [0x1005ba24]
cdq
sub eax, edx
mov dword [0x1005c6ac], 1
sar eax, 1
push eax
mov dword [0x1005c68c], 1
call ebx
mov eax, 0x10624dd3
inc esi
imul dword [0x1005ba10]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jne 0x1001a6f2
push 0
push 0
push 0
push 0x10007130
push 0
push 0
call edi
jmp 0x1001a6f0
Function at 0x1001a820
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f6d0
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x10056050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005b97c], 1
jne 0x1001a8d0
sub esp, 0xc
lea ecx, [ebp - 0xbc]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nVM_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.10005930
mov edx, str.Virtual_memory_Value_changed_
lea ecx, [ebp - 0xbc]
call fcn.10005930
lea ecx, [ebp - 0xb8]
call fcn.10004900
test eax, eax
jne 0x1001a8c5
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xbc]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0xbc]
call fcn.100030f0
mov eax, dword [0x1005b980]
push 0
cmp eax, 1
jne 0x1001a902
push 0
push 0
push 0x1001a7f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1001a912
push 0
push 0
push 0x1001a7c0
jmp 0x1001a8e5
cmp eax, 3
jne 0x1001a922
push 0
push 0
push 0x10001f10
jmp 0x1001a8e5
cmp eax, 4
jne 0x1001a8fc
push 0
push 0
push 0x1001a230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.VM_Scan
push str.Virtual_memory_Value_changed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1001a8fa

Function at 0x1002e27c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002e0f2

Function at 0x100365db
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10036258
Function at 0x404548
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406888
test esi, esi
jne 0x404580
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004069c4
jmp 0x40459e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040448c
mov edi, eax
test esi, esi
je 0x40459e
cmp dword [ebx], 0
je 0x40459e
dec esi
jmp 0x404587
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4045d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4c2008], 0x8088405
inc edx
mov dword [ebx + 0x4c2008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x405e24
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c5050], 0
je 0x405e85
cmp word [0x4c532c], 0xd7b2
jne 0x405e4d
cmp dword [0x4c5334], 0
jbe 0x405e4d
mov eax, 0x4c5328
call dword [0x4c5344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405eb0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4c2030], 0
jne 0x405ea1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406010
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4c2034], 0
je 0x406036
mov edx, esi
mov eax, ebx
call dword [0x4c2034]
jmp 0x406045
mov eax, 8
call fcn.004041d4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4c5051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405fd8
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x40862c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408793
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406888
cmp si, word [0x4c27d0]
jb 0x4086c6
cmp si, word [0x4c29d0]
ja 0x4086c6
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x4086c6
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4c27d0]
jae 0x4086a0
mov edi, ebx
dec edi
jmp 0x4086c1
cmp si, word [ebx*8 + 0x4c27d0]
jbe 0x4086b0
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x4086c1
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4c27d4]
call fcn.0040853c
jmp 0x4086c6
cmp edi, dword [ebp - 0xc]
jae 0x40868a
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408775
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408775
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a70
push dword [ebp - 0x164]
push 0x4087b0
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406a70
push dword [ebp - 0x168]
push 0x4087c0
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a70
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406e28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40879a
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406880
ret
Function at 0x4087c4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 6], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x4089aa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4c7b58
call sub.kernel32.dll_EnterCriticalSection
movzx eax, word [0x4c7b70]
cmp ax, word [ebp - 2]
jne 0x40881c
mov eax, dword [ebp - 6]
mov edx, 0x4c7b74
mov ecx, 0x55
call fcn.00406a70
push 0x4c7b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408994
push 0x4c7b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [ebp - 6]
xor edx, edx
call fcn.00406888
push 2
movzx eax, word [ebp - 2]
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40895c
cmp byte [0x4c7b54], 0
je 0x408912
call dword [0x4c7b4c]
mov word [ebp - 0x16], ax
movzx eax, word [ebp - 2]
push eax
call dword [0x4c7b50]
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x40890b
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x4c7b48]
test al, al
je 0x4088e4
mov eax, dword [ebp - 0xc]
add eax, eax
call fcn.004041d4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x4c7b48]
mov edx, dword [ebp - 0xc]
sub edx, 2
test edx, edx
jb 0x4088d9
inc edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
jne 0x4088d5
mov ecx, dword [ebp - 0x10]
mov word [ecx + eax*2], 0x2c
inc eax
dec edx
jne 0x4088c2
mov eax, dword [ebp - 6]
mov edx, dword [ebp - 0x10]
call fcn.00406a34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40895c
movzx eax, word [ebp - 0x16]
push eax
call dword [0x4c7b50]
cmp dword [ebp - 0x10], 0
je 0x40890a
mov eax, dword [ebp - 0x10]
call fcn.004041f0
ret
mov edx, dword [ebp - 6]
movzx eax, word [ebp - 2]
call fcn.0040862c
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp ax, word [ebp - 2]
je 0x40895c
mov eax, dword [ebp - 6]
cmp dword [eax], 0
je 0x408941
mov eax, dword [ebp - 6]
mov edx, 0x4089c4
call fcn.00406c84
mov eax, dword [ebp - 6]
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x1c]
call fcn.0040862c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 6]
call fcn.00406c84
mov eax, dword [ebp - 6]
push 0x4c7b58
call sub.kernel32.dll_EnterCriticalSection
movzx eax, word [ebp - 2]
mov word [0x4c7b70], ax
push 0xaa
mov eax, dword [ebp - 6]
mov eax, dword [eax]
call fcn.00406914
push eax
push 0x4c7b74
call sub.kernel32.dll_lstrcpynW
push 0x4c7b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4089b1
lea eax, [ebp - 0x1c]
call fcn.00406878
ret
Function at 0x409098
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.00406870
mov eax, dword [ebp - 0x21c]
call fcn.00406870
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x409237
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406888
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.00406914
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x409138
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x40914a
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x409135
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x409203
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x409173
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00408be8
cmp dword [ebp - 0x220], 0
je 0x4091ab
push ebp
mov eax, dword [ebp - 0x220]
call fcn.00408f8c
pop ecx
mov ebx, eax
jmp 0x409203
push ebp
call sub.kernel32.dll_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.004087c4
mov eax, dword [ebp - 0x224]
call fcn.00408f8c
pop ecx
mov ebx, eax
test bl, bl
jne 0x4091f6
cmp byte [0x4c7b54], 0
jne 0x4091f6
push ebp
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.004087c4
mov eax, dword [ebp - 0x228]
call fcn.00408f8c
pop ecx
mov ebx, eax
test bl, bl
jne 0x409203
push ebp
call fcn.0040903c
pop ecx
mov ebx, eax
test bl, bl
je 0x409219
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406a70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40923e
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.00406880
ret

Function at 0x4099b0
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret