joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x40], 5
xor ebx, ebx
lea rcx, [rsp + 0x40]
call fcn.1400010c0
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001011
mov qword [rsp + 0x48], 4
mov qword [rsp + 0x50], 0xf
nop dword [rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x47
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x47
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_mouse_event]
lea rcx, [rsp + 0x48]
call fcn.1400010c0
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_mouse_event]
lea rcx, [rsp + 0x50]
call fcn.1400010c0
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140001040
jmp 0x140001011

Function at 0x140001b3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b86
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b88
xor al, al
add rsp, 0x28
ret
Function at 0x140001730
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp], 0
mov rax, qword [rsp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x140001784
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp], rax
mov rax, qword [rsp]
cmp dword [rax], 0x4550
jne 0x140001784
mov rax, qword [rsp]
jmp 0x140001786
xor eax, eax
add rsp, 0x18
ret
Function at 0x4082f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x0091b0a8], 0
je 0x4083a8
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.00413600
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x008b30e8]
call fcn.00413600
mov rcx, rsi
mov rdx, qword [0x008b30e8]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.00413600
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x4083bb
xor ecx, ecx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x409680
Capabilities:
Get common file path
Set current directory

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x450
mov rbp, rsp
mov byte [rbp + 0x27], cl
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], 0
nop
xor esi, esi
movzx rax, byte [rbp + 0x27]
test al, al
je 0x409713
movzx rax, byte [rbp + 0x27]
movzx ax, al
add ax, 0x40
mov word [rbp + 0x448], ax
mov word [rbp + 0x44a], 0x3a
mov word [rbp + 0x44c], 0
mov ecx, 0x104
lea rdx, [rbp + 0x38]
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
cmp esi, 0x104
jbe 0x409707
lea rcx, [rbp + 0x30]
mov edx, esi
sub edx, 1
call fcn.00414780
mov rcx, qword [rbp + 0x30]
call fcn.00414500
mov ecx, esi
mov rdx, rax
call sub.kernel32.dll_GetCurrentDirectoryW
lea rcx, [rbp + 0x448]
call sub.kernel32.dll_SetCurrentDirectoryW
mov ecx, 0x104
lea rdx, [rbp + 0x240]
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
cmp ebx, 0x104
ja 0x409746
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x240]
mov r8d, 0x104
call fcn.004145f0
jmp 0x40976a
mov rcx, qword [rbp + 0x28]
mov edx, ebx
sub edx, 1
call fcn.00414780
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.00414500
mov ecx, ebx
mov rdx, rax
call sub.kernel32.dll_GetCurrentDirectoryW
movzx rax, byte [rbp + 0x27]
test al, al
je 0x409797
cmp esi, 0x104
jbe 0x40978e
mov rcx, qword [rbp + 0x30]
call fcn.00414500
mov rcx, rax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x409797
lea rcx, [rbp + 0x38]
call sub.kernel32.dll_SetCurrentDirectoryW
nop
lea rcx, [rbp + 0x30]
call fcn.00412d10
lea rsp, [rbp + 0x450]
pop rbx
pop rsi
pop rbp
ret

Function at 0x409e20
Capabilities:
Accept command line arguments

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x38], 0
nop
xor eax, eax
mov dword [rbp + 0x2c], eax
call sub.kernel32.dll_GetCommandLineW
mov rcx, rax
lea rdx, [rbp + 0x38]
call fcn.00409d30
mov rcx, rax
lea rdx, [rbp + 0x38]
call fcn.00409d30
cmp qword [rbp + 0x38], 0
je 0x409e65
mov ecx, dword [rbp + 0x2c]
add ecx, 1
mov dword [rbp + 0x2c], ecx
jmp 0x409e47
nop
nop
lea rcx, [rbp + 0x38]
call fcn.00412d10
mov eax, dword [rbp + 0x2c]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x40cf70
Capabilities:
Get file size

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
or esi, 0xffffffff
movzx rax, word [rbx + 8]
cmp ax, 0xd7b0
jbe 0x40cfb1
cmp ax, 0xd7b3
ja 0x40cfb1
mov rcx, qword [rbx]
xor edx, edx
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x40cfa5
call fcn.00409660
jmp 0x40cfbb
mov eax, esi
xor edx, edx
div dword [rbx + 0xc]
mov rsi, rax
jmp 0x40cfbb
mov ecx, 0x67
call fcn.00409640
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x4109e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov ebx, edx
mov rax, qword [rbp + 0x28]
mov r13d, dword [rax + 0x18]
mov rcx, qword [rbp + 0x28]
call fcn.00411030
mov esi, eax
test sil, sil
jne 0x410b94
test ebx, ebx
je 0x410b94
xor edi, edi
test r13d, r13d
jle 0x410ac1
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov dword [rbp + 0x3c], 0
test r13d, r13d
jle 0x410aa5
cmp ebx, 0xffffffff
je 0x410a53
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x410a53
xor esi, esi
jmp 0x410b94
mov rax, qword [rbp + 0x28]
cmp dword [rax], 1
jg 0x410aa5
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0
jne 0x410a93
xor eax, eax
mov ecx, 1
mov rdx, qword [rbp + 0x28]
lock cmpxchg dword [rdx], ecx
test eax, eax
jne 0x410a93
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov sil, 1
jmp 0x410b94
lea rcx, [rbp + 0x3c]
call fcn.00410560
sub r13d, 1
test r13d, r13d
jg 0x410a3a
nop
cmp ebx, 0xffffffff
je 0x410ac1
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x410abf
xor esi, esi
jmp 0x410b94
sub ebx, eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x4109fd
mov edx, ecx
add edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x410ac1
nop
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov rcx, qword [rbp + 0x28]
call fcn.00410c40
xor ecx, ecx
mov rdx, rax
mov r8d, ebx
mov rax, qword [0x0091b9a0]
call qword [rax + 0x20]
test eax, eax
sete sil
cmp ebx, 0xffffffff
je 0x410b24
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jae 0x410b22
sub ebx, eax
jmp 0x410b24
xor ebx, ebx
test sil, sil
je 0x410b55
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov eax, ecx
test eax, 1
jne 0x410b52
mov edx, ecx
sub edx, 2
or edx, 1
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x410b29
mov dil, 1
nop
jmp 0x410b72
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov edx, ecx
sub edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x410b55
mov dil, 1
test dil, dil
je 0x410ae4
nop
test sil, sil
je 0x410b94
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov eax, esi
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x412760
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x0091b0a8], 0
je 0x4127fa
cmp word [0x0091b3b8], 0xd7b2
jne 0x412793
cmp dword [0x0091b3c0], 0
jbe 0x412793
lea rcx, [0x0091b3b0]
call qword [0x0091b3d8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x008b5db0]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x00412830]
call fcn.00413fa0
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x41281b
cmp byte [0x008b305a], 0
jne 0x41281b
xor ecx, ecx
lea rdx, [0x008b5db0]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x412b10
Capabilities:
Create thread

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov ebx, edx
mov rsi, r8
mov rdi, r9
cmp qword [0x008b3060], 0
je 0x412b41
mov rcx, rsi
mov rdx, rdi
call qword [0x008b3060]
mov r13, rax
jmp 0x412b56
mov ecx, 0x10
call fcn.004092d0
mov r13, rax
mov qword [r13], rsi
mov qword [r13 + 8], rdi
mov byte [0x0091b0a9], 1
mov rcx, qword [rsp + 0x38]
mov edx, ebx
lea r8, [0x00412aa0]
mov r9, r13
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov rbx, rax
test rbx, rbx
jne 0x412b9b
mov rcx, r13
call fcn.00409300
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x418a80
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x0091ff00]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x0091ff28], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x0091fef8], al
cmp byte [0x0091fef8], 0
je 0x418b1e
lea rcx, [0x00418b24]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x00418b3e]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0091fee0], rax
lea rcx, [0x00418b24]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x00418b5c]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0091fee8], rax
lea rcx, [0x00418b24]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x00418b7a]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0091fef0], rax
add rsp, 0x28
ret
Function at 0x418dc0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x1d8
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov word [rbp + 0x56], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x48]
call fcn.00412d10
movzx rax, word [rbp + 0x56]
cmp word [0x008b6890], ax
ja 0x418e96
movzx rax, word [rbp + 0x56]
cmp ax, word [0x008b6c90]
mov word [rbp + 0x56], ax
ja 0x418e96
mov eax, 0x40
xor ecx, ecx
cmp eax, ecx
jb 0x418e95
mov edx, eax
add edx, ecx
shr edx, 1
mov r8d, edx
lea r9, [0x008b6890]
mov r10, r8
add r10, r10
movzx r11, word [rbp + 0x56]
cmp word [r9 + r10*8], r11w
jbe 0x418e54
mov eax, edx
sub eax, 1
jmp 0x418e91
lea rcx, [0x008b6890]
mov r9, r8
add r9, r9
movzx r10, word [rbp + 0x56]
cmp word [rcx + r9*8], r10w
jae 0x418e74
mov ecx, edx
add ecx, 1
jmp 0x418e91
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea rax, [0x008b6898]
add r8, r8
mov r8, qword [rax + r8*8]
call fcn.00418c70
jmp 0x418e95
cmp eax, ecx
jae 0x418e2a
nop
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0
jne 0x418f6b
movzx rcx, word [rbp + 0x56]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x418f6b
movzx rbx, word [rbp + 0x56]
movzx ebx, bx
mov ecx, ebx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
mov ecx, ebx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.004145f0
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.004145f0
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.004145f0
mov rcx, qword [rbp + 0x48]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x00418fb8]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x00418fc8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.00414a50
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.00412df0
mov rax, qword [rbp + 0x48]
lea rsp, [rbp + 0x1d8]
pop rbx
pop rbp
ret
Function at 0x4191c0
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x0091ff00]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x0091ff28], ax
jne 0x41922a
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0091ff2a]
mov r8d, 0x55
call fcn.004145f0
lea rcx, [0x0091ff00]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x419333
lea rcx, [0x0091ff00]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.00412d10
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4192ee
cmp byte [0x0091fef8], 0
je 0x419282
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.00419060
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.004133a0
jmp 0x4192ee
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.00418dc0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.004133a0
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x4192ee
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x4192cd
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00419378]
call fcn.00414860
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.00418dc0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.00414860
lea rcx, [0x0091ff00]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x0091ff28], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.00414500
lea rcx, [0x0091ff2a]
mov edx, 0xaa
mov r8, rax
call fcn.00418bb0
lea rcx, [0x0091ff00]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.00412df0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x419ce0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.00412ee0
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.004145f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.00414920
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
call fcn.00419b30
test al, al
jne 0x419daa
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.004145f0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.00414920
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
call fcn.00419b30
test al, al
jne 0x419daa
mov rcx, qword [rbp + 0x28]
call fcn.00412d10
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00412df0
lea rcx, [rbp + 0x70]
call fcn.00412d10
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x419e00
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.00412ee0
mov rcx, qword [rbp + 0x90]
call fcn.00412ee0
nop
mov rcx, qword [rbp + 0x28]
call fcn.00412d10
cmp qword [rbp + 0x90], 0
je 0x419fbf
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.00413430
xor eax, eax
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x419eab
mov eax, dword [rcx - 4]
cmp eax, 1
jl 0x419ee4
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x419edd
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.00414b70
jmp 0x419ee4
sub eax, 1
test eax, eax
jne 0x419eb0
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.00419a30
cmp qword [rbp + 0x68], 0
je 0x419f22
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.00419bc0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.004133a0
jmp 0x419fbe
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.004191c0
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.00419bc0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.004133a0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x419f97
cmp byte [0x0091fef8], 0
jne 0x419f97
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.004191c0
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.00419bc0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.004133a0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x419fbe
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.00419ce0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.004133a0
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.00412df0
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.00412df0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x41c950
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x41c970
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x41c993
cmp eax, 1
jae 0x41c998
cmp ecx, 5
jbe 0x41c9a4
mov dword [0x0091ba30], 0x7f
jmp 0x41c9ae
mov dword [0x0091ba30], 0x409
add rsp, 0x28
ret
Function at 0x41dbf0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.0041dbe0
mov ebx, eax
test ebx, ebx
je 0x41dc39
cmp dword [0x008b776c], 0xffffffff
jne 0x41dc13
mov ecx, 0xe2
call fcn.004129f0
mov ecx, ebx
call fcn.0041dbc0
test rax, rax
jne 0x41dc2b
mov ecx, 0xe2
call fcn.004129f0
jmp 0x41dc39
mov ecx, dword [0x008b776c]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x41dca0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x009212d0], 0
je 0x41dcdb
mov ecx, dword [0x008b776c]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41dcee
call fcn.0041dbf0
mov ecx, dword [0x008b776c]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x41dcee
mov rax, qword [0x009212c8]
jmp 0x41dcee
mov rax, qword gs:[0x58]
mov ecx, dword [0x008b776c]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x43a450
Capabilities:
Get disk information

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x460
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
nop
mov ecx, 0x104
lea rdx, [rbp + 0x254]
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x43a562
lea rbx, [rbp + 0x254]
mov word [rbx + 4], 0
mov rcx, rbx
lea rdx, [rbp + 0x48]
mov r8d, 0x104
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x43a548
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0x48]
mov r8d, 0x106
call fcn.004145f0
mov r13, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x40]
mov rdx, r13
mov r8d, 1
call fcn.00414d80
test eax, eax
jle 0x43a548
xor esi, esi
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x43a500
mov esi, dword [rax - 4]
xor edi, edi
test r13, r13
je 0x43a50b
mov edi, dword [r13 - 4]
lea rcx, [rbp + 0x38]
mov rdx, rbx
call fcn.00414590
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
mov r8d, esi
add r8d, 1
mov r9d, edi
sub r9d, esi
call fcn.00414b70
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
call fcn.00414920
jmp 0x43a561
add rbx, 2
cmp word [rbx], 0
jne 0x43a544
add rbx, 4
test rbx, rbx
je 0x43a561
cmp word [rbx], 0
jne 0x43a4a3
nop
nop
lea rcx, [rbp + 0x30]
mov edx, 3
call fcn.00412df0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x460]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x43aa70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov byte [rbp + 0x67], 0
mov ecx, 6
xor edx, edx
call fcn.0044a660
test al, al
je 0x43ab7f
mov rcx, qword [rbp + 0x80]
xor edx, edx
call fcn.0043cfb0
test al, al
je 0x43ab7f
mov rcx, qword [rbp + 0x80]
call fcn.0043c9e0
test al, 0x20
je 0x43ab7f
mov rcx, qword [rbp + 0x80]
call fcn.00414500
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], 0xffffffff
je 0x43ab7f
mov eax, dword [rbp + 0x5c]
test eax, 0x400
je 0x43ab7f
mov eax, dword [rbp + 0x5c]
test eax, 0x10
je 0x43ab0e
mov dword [rbp + 0x60], 0x2000000
jmp 0x43ab15
mov dword [rbp + 0x60], 0
mov rcx, qword [rbp + 0x80]
call fcn.00414500
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov eax, dword [rbp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0xffffffffffffffff
je 0x43ab7f
nop
mov rcx, rbp
mov rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x88]
mov r9d, dword [rbp + 0x60]
call fcn.0043a6f0
mov byte [rbp + 0x67], al
nop
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_CloseHandle
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret