joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40368d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40369c
pop dword [ebp - 0x2c]
mov eax, 0x2dc31a5b
add eax, 0xd27d1c41
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6a60e36a
add dword [ebp - 0x3c], 0xe3f161e1
mov dword [ebp - 0x38], 0x6951833a
add dword [ebp - 0x38], 0xc8e1c90b
mov dword [ebp - 0x34], 0xe5332a2e
sub dword [ebp - 0x34], 0x98e6e600
mov dword [ebp - 0x30], 0x261b1e34
add dword [ebp - 0x30], 0xd9e4e1cc
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x5a864e50
add dword [ebp - 0x3c], 0x19ec1b06
mov dword [ebp - 0x38], 0xb96a6c80
add dword [ebp - 0x38], 0x8801f4f5
mov dword [ebp - 0x34], 0x7fc698b8
add dword [ebp - 0x34], 0xe3a8d3b4
mov dword [ebp - 0x30], 0xa1aaf370
sub dword [ebp - 0x30], 0xa1aaf370
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x385a5
push 0
call eax
mov ecx, 0x4a90
mov edi, eax
mov ebx, 0x392c5073
sub ebx, 0x38eb8873
add ebx, dword [ebp - 0x2c]
mov esi, 0xecbbeba1
add esi, 0x8353665e
xor dword [ebp - 0x10], edx
mov edx, dword [ebx]
add dword [ebp - 0xc], esi
sub edx, esi
mov dword [edi], edx
sub dword [ebp - 8], 0xd7396c20
add edi, 0x3e42ec92
add edi, 0xc1bd1372
add ebx, 0x1928486e
sub ebx, 0x1928486a
loop 0x4037ae
add eax, 0x11d13
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040368d
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.0040368d
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret
Function at 0xf927c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor ecx, ecx
test esi, esi
jle 0xf927eb
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, ecx
mov esi, dword [ebp + 8]
cdq
idiv ebx
mov al, byte [edx + esi]
xor byte [ecx + edi], al
inc ecx
cmp ecx, dword [ebp + 0x14]
jl 0xf927d5
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0xf927f0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push edi
test esi, esi
je 0xf92825
mov eax, dword [edx]
mov ecx, 1
mov dword [ebp - 0x18], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
jmp 0xf9282d
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
cmp ecx, esi
jae 0xf92841
mov eax, dword [edx + ecx*8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx + ecx*8 + 4]
inc ecx
mov dword [ebp - 0x1c], eax
jmp 0xf92849
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
cmp ecx, esi
jae 0xf9285d
mov eax, dword [edx + ecx*8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + ecx*8 + 4]
inc ecx
mov dword [ebp - 0x24], eax
jmp 0xf92865
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
cmp ecx, esi
jae 0xf92878
mov eax, dword [edx + ecx*8]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + ecx*8 + 4]
mov dword [ebp - 0x2c], eax
jmp 0xf92880
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x10], xmm0
cmp esi, 4
jbe 0xf928a9
lea eax, [edx + 0x18]
mov dword [ebp - 0xc], 0
cdq
mov dword [ebp - 0x38], eax
lea eax, [esi - 4]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call fcn.00f928b9

Function at 0xf92930
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
push ebx
push esi
push edi
call fcn.00f92be0
add eax, 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
adc edx, 0
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], edx
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push esi
push edi
push 0x33
call fcn.00f92968

Function at 0xf92be0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xorps xmm0, xmm0
push esi
push edi
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
push 0x33
call 0xf92bfd
add dword [esp], 5
retf

Function at 0xf92d90
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
push ebx
lea eax, [ebp - 0xb4]
cdq
push esi
push edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
push esi
push edi
push 0x33
call 0xf92db2
add dword [esp], 5
retf
Function at 0xf93990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
push esi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov esi, dword [eax + 0x10]
test esi, esi
je 0xf939c7
push 0xf984fc
push esi
call fcn.00f93b10
add esp, 8
test eax, eax
je 0xf939c7
mov ecx, dword [ebp + 8]
cmp ecx, esi
je 0xf939c7
push ecx
push 0xffffffffffffffff
call eax
pop esi
pop ebp
ret

Function at 0xf939d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0xc], 0
mov dword [ebp - 8], 0
jne 0xf939f0
mov eax, dword [0x106a2c0]
test eax, eax
je 0xf939fa
mov esp, ebp
pop ebp
ret
mov dword [0x106a2c0], 0
mov eax, dword fs:[0x30]
push esi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov esi, dword [eax + 0x10]
test esi, esi
jne 0xf93a17
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0xf984d0
push esi
call fcn.00f93b10
push 0xf984e0
push esi
mov dword [ebp - 4], eax
call fcn.00f93b10
push 0xf984f4
push esi
mov ebx, eax
call fcn.00f93b10
add esp, 0x18
mov edi, eax
cmp dword [ebp - 4], 0
je 0xf93ae5
test ebx, ebx
je 0xf93ae5
mov ecx, dword [ebp + 8]
push ecx
mov dword [ebp - 0xc], ecx
call fcn.00f92620
movzx eax, ax
add esp, 4
add eax, eax
mov dword [ebp - 0x28], 0x18
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push 0xc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], 0
push eax
mov dword [ebp - 0x1c], 0x40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call dword [ebp - 4]
test eax, eax
jns 0xf93ac0
call fcn.00f93920
pop edi
pop ebx
mov dword [0x106a2c0], esi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 2
push 0
push 1
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x106a2c0
push 0xffffffffffffffff
push dword [ebp + 0xc]
call ebx
push dword [ebp + 0xc]
test eax, eax
jns 0xf93aee
call edi
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x106a2c0], 0
je 0xf93ae3
call edi
mov eax, dword [0x106a2c0]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xf93b10
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0xf93b23
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0xf93b1c
push ebx
mov ebx, dword [esi + 0x3c]
cmp dword [ebx + esi], 0x4550
jne 0xf93b83
mov ebx, dword [ebx + esi + 0x78]
mov ecx, dword [ebp + 0xc]
add ebx, esi
mov eax, dword [ebx + 0x24]
mov edx, dword [ebx + 0x20]
add eax, esi
mov dword [ebp - 4], eax
add edx, esi
xor eax, eax
mov dword [ebp + 8], edx
test ecx, 0xffff0000
jne 0xf93b8b
mov edx, dword [ebx + 0x10]
movzx ecx, cx
cmp ecx, edx
jb 0xf93b83
mov eax, dword [ebx + 0x14]
add eax, edx
cmp ecx, eax
jae 0xf93b83
mov eax, dword [ebx + 0x1c]
sub ecx, edx
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
xor edi, edi
cmp dword [ebx + 0x18], eax
jbe 0xf93bcd
mov eax, dword [edx + edi*4]
add eax, esi
push eax
push ecx
call fcn.00f923a0
add esp, 8
test eax, eax
je 0xf93bbb
mov ecx, dword [ebp + 0xc]
inc edi
mov edx, dword [ebp + 8]
cmp edi, dword [ebx + 0x18]
jb 0xf93b93
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
movzx ecx, word [eax + edi*2]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xf95f70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [0xf9803c]
push esi
push 4
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
push 0x3000
push 0x40
push 0
mov dword [eax], 0
call ebx
mov esi, eax
test esi, esi
je 0xf95fc4
push 0
push 0x40
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0xf9808c]
test eax, eax
jne 0xf95fcc
push 0x8000
push 0
push esi
call dword [0xf98040]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0xf95fb6
mov eax, dword [esi + 0x3c]
push edi
mov edi, dword [0xf98040]
push 0x8000
push 0
push esi
mov dword [ebp - 4], eax
call edi
push 4
push 0x3000
push 0x18
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0xf96069
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
push 0
push 0x18
push ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [0xf9808c]
push 0x8000
push 0
push ebx
test eax, eax
je 0xf96067
cmp dword [ebx], 0x4550
jne 0xf96067
movzx esi, word [ebx + 0x14]
call edi
push 4
push 0x3000
lea ebx, [esi + 0x18]
push ebx
push 0
call dword [0xf9803c]
mov esi, eax
test esi, esi
je 0xf96069
push 0
push ebx
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [0xf9808c]
push 0x8000
push 0
push esi
test eax, eax
jne 0xf96072
call edi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi], 0x4550
jne 0xf96067
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi + 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x28]
mov dword [ecx], eax
call edi
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf97a80
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0xc], 0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 4], 0x28
mov dword [ebp - 8], eax
movlpd qword [ebp - 0x24], xmm0
push edi
test esi, esi
je 0xf97ac4
mov edx, dword [ecx]
mov eax, 1
mov edi, dword [ecx + 4]
jmp 0xf97aca
mov edi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edi
movlpd qword [ebp - 0x2c], xmm0
cmp eax, esi
jae 0xf97ae3
mov edx, dword [ecx + eax*8]
mov edi, dword [ecx + eax*8 + 4]
inc eax
jmp 0xf97ae9
mov edi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edi
movlpd qword [ebp - 0x2c], xmm0
cmp eax, esi
jae 0xf97b02
mov edx, dword [ecx + eax*8]
mov edi, dword [ecx + eax*8 + 4]
inc eax
jmp 0xf97b08
mov edi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edi
movlpd qword [ebp - 0x2c], xmm0
cmp eax, esi
jae 0xf97b20
mov edx, dword [ecx + eax*8]
mov eax, dword [ecx + eax*8 + 4]
jmp 0xf97b26
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
cmp esi, 4
jbe 0xf97b61
lea eax, [ecx + 0x18]
mov dword [ebp - 0x18], 0
cdq
mov dword [ebp - 0x14], eax
lea eax, [esi - 4]
mov dword [ebp - 0x1c], eax
lea ecx, [eax*8]
mov eax, 0xfffffff8
mov dword [ebp - 0x10], edx
sub eax, ecx
and eax, 0xf
add eax, 0x28
add eax, ecx
mov dword [ebp - 4], eax
push edi
push esi
mov dword [ebp - 8], esp
and esp, 0xfffffff0
push 0x33
call 0xf97b70
add dword [esp], 5
retf
Function at 0x404880
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406b7c
test esi, esi
jne 0x4048b6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406d04
jmp 0x4048d4
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004047c4
mov edi, eax
test esi, esi
je 0x4048d4
cmp dword [ebx], 0
je 0x4048d4
dec esi
jmp 0x4048bd
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4058f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405cf0
mov byte [esp], al
cmp byte [esp], 0
jne 0x405a84
test edi, edi
je 0x405a84
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4059bb
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x405996
cmp edi, 0xffffffff
je 0x405957
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405957
mov byte [esp], 0
jmp 0x405a84
mov ebx, dword [esi]
cmp ebx, 1
jg 0x405996
test ebx, ebx
jne 0x40598c
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402784
test eax, eax
jne 0x40598c
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405a84
call 0x405e14
dec ebp
test ebp, ebp
jg 0x40593c
cmp edi, 0xffffffff
je 0x4059bb
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4059b9
mov byte [esp], 0
jmp 0x405a84
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x405906
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402784
cmp ebx, eax
jne 0x4059bb
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405af4
mov edx, eax
mov ebx, dword [0x5288f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x405a22
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405a20
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x405a22
xor edi, edi
cmp byte [esp], 0
je 0x405a4b
mov ebx, dword [esi]
test bl, 1
jne 0x405a64
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402784
cmp ebx, eax
jne 0x405a28
mov byte [esp + 1], 1
jmp 0x405a64
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402784
cmp ebx, eax
jne 0x405a4b
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4059d5
cmp byte [esp], 0
je 0x405a84
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406814
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x528058], 0
je 0x40687b
cmp word [0x528344], 0xd7b2
jne 0x40683d
cmp dword [0x52834c], 0
jbe 0x40683d
mov eax, 0x528340
call dword [0x52835c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4068a8
call fcn.0040743c
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x523032], 0
jne 0x406897
push 0
push 0x5239c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406a38
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x523034], 0
je 0x406a63
mov edx, edi
mov eax, esi
call dword [0x523034]
mov ebx, eax
jmp 0x406a74
mov eax, 8
call fcn.00404500
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x528059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406a00
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x406aa9
mov edx, 8
mov eax, ebx
call fcn.0040451c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x4090e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x409249
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406b7c
cmp si, word [0x523a00]
jb 0x40917c
cmp si, word [0x523c00]
ja 0x40917c
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40917c
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x523a00]
jae 0x409156
mov edi, ebx
dec edi
jmp 0x409177
cmp si, word [ebx*8 + 0x523a00]
jbe 0x409166
inc ebx
mov dword [ebp - 8], ebx
jmp 0x409177
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x523a04]
call fcn.00408ff4
jmp 0x40917c
cmp edi, dword [ebp - 8]
jae 0x409140
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40922b
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40922b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040782c
push dword [ebp - 0x160]
push 0x409264
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040782c
push dword [ebp - 0x164]
push 0x409274
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040782c
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00407a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409250
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406bdc
ret
Function at 0x4093fc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4094ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x52ab88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x52aba0]
jne 0x409448
mov eax, esi
mov edx, 0x52aba2
mov ecx, 0x55
call fcn.0040782c
push 0x52ab88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4094e9
push 0x52ab88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406b7c
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4094b7
cmp byte [0x52ab84], 0
je 0x40947c
mov edx, esi
mov eax, ebx
call fcn.004092e0
jmp 0x4094b7
mov edx, esi
mov eax, ebx
call fcn.004090e4
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4094b7
cmp dword [esi], 0
je 0x4094a0
mov eax, esi
mov edx, 0x409518
call fcn.00407984
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004090e4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407984
push 0x52ab88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x52aba0], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407798
push eax
push 0x52aba2
call sub.kernel32.dll_lstrcpynW
push 0x52ab88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409506
lea eax, [ebp - 4]
call fcn.00406b7c
ret
Function at 0x409734
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c60
xor eax, eax
push ebp
push 0x409959
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x409774
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40978e
push 0x105
mov eax, dword [ebp - 4]
call fcn.00407798
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x409943
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409968
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40985d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409968
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40985d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4099a4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40985d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4099a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40985d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4099d8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40985d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409a0c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x409943
xor eax, eax
push ebp
push 0x40993c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00409540
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4098cc
mov eax, dword [ebp - 0x10]
call fcn.00404500
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004077f0
jmp 0x409917
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x409a4c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409917
mov eax, dword [ebp - 0x10]
call fcn.00404500
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x409a4c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004077f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409943
cmp dword [ebp - 8], 0
je 0x409932
mov eax, dword [ebp - 8]
call fcn.0040451c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409960
lea eax, [ebp - 4]
call fcn.00406b7c
ret