joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c817
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x435e10]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c857
cmp byte [ebx], 0xa
jne 0x41c857
or byte [edi + eax + 0x28], 4
jmp 0x41c85c
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41c95b
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41c93e
inc eax
cmp dl, 0xd
je 0x41c888
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41c8ae
cmp eax, ecx
jae 0x41c8bc
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41c870
jmp 0x41c95b
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c939
cmp dword [ebp - 0x10], 0
je 0x41c939
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x435e10]
test byte [eax + edi + 0x28], 0x48
je 0x41c913
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41c8fe
mov byte [esi], dl
jmp 0x41c90f
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x435e10]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41c95b
cmp byte [ebp - 1], 0xa
jne 0x41c922
cmp esi, ebx
jne 0x41c922
mov byte [esi], 0xa
jmp 0x41c95a
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041d39d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41c95b
mov byte [esi], 0xd
jmp 0x41c95a
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x435e10]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41c958
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41c95b
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41c964
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x435e10]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c9aa
cmp word [ebx], dx
jne 0x41c9aa
or byte [eax + edi + 0x28], 4
jmp 0x41c9af
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41cb12
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41caf2
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41c9f0
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41ca26
cmp eax, edx
jae 0x41ca34
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41c9cb
jmp 0x41cb12
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41caed
cmp dword [ebp - 0x18], 0
je 0x41caed
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x435e10]
test byte [eax + edi + 0x28], 0x48
je 0x41cac3
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41ca87
mov word [esi], cx
jmp 0x41cabe
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x435e10]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x435e10]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x435e10]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41cb12
pop eax
cmp word [ebp - 4], ax
jne 0x41cad3
cmp esi, ebx
jne 0x41cad3
mov word [esi], ax
jmp 0x41cb0f
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041d39d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41cb12
push 0xd
pop eax
jmp 0x41cace
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x435e10]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41cb0c
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41cb12
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41fb5b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41fbf8
push ebx
push esi
call fcn.0041fb24
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041e920
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41fba5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41fbf7
push edi
push eax
call fcn.00419e73
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41fbc5
call fcn.00419e39
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41fbf6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041e920
add esp, 0x20
test eax, eax
jne 0x41fbe4
push edi
call fcn.00419e39
jmp 0x41fbec
push ebx
call fcn.00419e39
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4220b8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00419a92
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x422127
cmp esi, dword [ebp - 4]
je 0x422122
cmp dword [ebp + 0xc], 0
je 0x422122
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4220ff
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00421c0a
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x422129
xor eax, eax
inc eax
jmp 0x422129
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x42218e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x433180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00419a92
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00419a92
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x422205
cmp word [ecx], dx
je 0x422205
mov eax, dword [0x42ab4c]
push edi
dec eax
push eax
push 0x42aa38
call fcn.0042212d
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x422278
cmp word [eax], dx
je 0x422278
mov eax, dword [edi]
test eax, eax
je 0x422229
cmp word [eax], dx
je 0x422229
lea eax, [ebp - 0x10]
push eax
call fcn.00421b10
jmp 0x422232
lea eax, [ebp - 0x10]
push eax
call fcn.00421bab
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4222a2
mov eax, dword [0x42aa34]
push dword [ebp - 0x14]
dec eax
push eax
push 0x42a728
call fcn.0042212d
add esp, 0xc
test al, al
je 0x4222a2
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x42226d
cmp word [eax], di
je 0x42226d
lea eax, [ebp - 0x10]
push eax
call fcn.00421b10
pop ecx
jmp 0x4222a4
lea eax, [ebp - 0x10]
push eax
call fcn.00421bab
jmp 0x42226a
mov eax, dword [edi]
test eax, eax
je 0x42228f
cmp word [eax], dx
je 0x42228f
lea eax, [ebp - 0x10]
push eax
call fcn.00421ac5
pop ecx
jmp 0x4222a2
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x42236d
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00421fb2
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42236d
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x42236d
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x42236d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4222fa
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0041a4f9
test ebx, ebx
je 0x422368
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0041a4f9
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42236d
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42236d
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00423794
add esp, 0x10
xor eax, eax
inc eax
jmp 0x42236f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040edbe
leave
ret
Function at 0x424f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x424fad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x424fad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002930
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012405
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1001e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x1001f208
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.10005d90
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x1001f1f0
push eax
call fcn.10005d90
mov esi, dword [0x1001f218]
xor ebx, ebx
mov edi, dword [0x1001f21c]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x1001fed8], bl
mov eax, ebx
mov ecx, 0x1001f208
cmovae ecx, dword [0x1001f208]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x1001fdd8], al
inc ebx
cmp ebx, 0x100
jl 0x100029b0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x1001fed8]
movzx eax, byte [esi + 0x1001fdd8]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x10002a04
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x1001fed8]
mov byte [esi + 0x1001fed8], al
inc esi
mov byte [edi + 0x1001fed8], dl
cmp esi, 0x100
jl 0x100029e0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.10002720
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10002a59
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10002a4f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002aaf
push edx
push ecx
call fcn.1000679f
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x10002a9b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10002a91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002aaf
push edx
push ecx
call fcn.1000679f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100099dc
int3
Function at 0x10003760
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001262d
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1001e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, 0x1001af41
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10006060
test al, al
jne 0x1000381d
mov eax, dword [ebp + 0x18]
inc eax
push eax
call fcn.10006d17
add esp, 4
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov ebx, eax
mov edx, ebx
cmovae ecx, dword [ebp + 8]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100037c0
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100037d2
sub esi, ecx
inc esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.10009260
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x1000384d
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003843
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000385f
push edx
push ecx
call fcn.1000679f
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100099dc
int3
Function at 0x409544
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00409a04
mov byte [esp], al
cmp byte [esp], 0
jne 0x4096cd
test edi, edi
je 0x4096cd
mov byte [esp + 1], 0
test ebp, ebp
jle 0x40960d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4095e8
cmp edi, 0xffffffff
je 0x4095a9
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4095a9
mov byte [esp], 0
jmp 0x4096cd
cmp dword [esi], 1
jg 0x4095e8
cmp dword [esi], 0
jne 0x4095da
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4095da
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4096cd
lea eax, [esp + 0xc]
call fcn.004091dc
dec ebp
test ebp, ebp
jg 0x40958e
cmp edi, 0xffffffff
je 0x40960d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40960b
mov byte [esp], 0
jmp 0x4096cd
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409552
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40960d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409748
mov edx, eax
mov ebx, dword [0x5808fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409671
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40966f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409671
xor edi, edi
cmp byte [esp], 0
je 0x409697
mov ebx, dword [esi]
test bl, 1
jne 0x4096ad
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409677
mov byte [esp + 1], 1
jmp 0x4096ad
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409697
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409624
cmp byte [esp], 0
je 0x4096cd
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40a5a4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x580058], 0
je 0x40a60b
cmp word [0x580348], 0xd7b2
jne 0x40a5cd
cmp dword [0x580350], 0
jbe 0x40a5cd
mov eax, 0x580344
call dword [0x580360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a638
call fcn.0040b174
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x578032], 0
jne 0x40a627
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40a7cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x578034], 0
je 0x40a7f7
mov edx, edi
mov eax, esi
call dword [0x578034]
mov ebx, eax
jmp 0x40a808
mov eax, 8
call fcn.00406e34
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x580059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a794
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40a838
mov eax, ebx
call fcn.00406e50
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40e490
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40e5f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a90c
cmp si, word [0x578a10]
jb 0x40e528
cmp si, word [0x578c10]
ja 0x40e528
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40e528
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x578a10]
jae 0x40e502
mov edi, ebx
dec edi
jmp 0x40e523
cmp si, word [ebx*8 + 0x578a10]
jbe 0x40e512
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40e523
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x578a14]
call fcn.0040e3b0
jmp 0x40e528
cmp edi, dword [ebp - 8]
jae 0x40e4ec
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40e5d7
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40e5d7
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b478
push dword [ebp - 0x160]
push 0x40e614
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040b478
push dword [ebp - 0x164]
push 0x40e624
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b478
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040b6b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e5fe
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040a96c
pop eax
jmp eax
Function at 0x40e7ac
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e8b2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x582c14
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x582c2c]
jne 0x40e7f8
mov eax, esi
mov edx, 0x582c2e
mov ecx, 0x55
call fcn.0040b478
push 0x582c14
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40e89a
push 0x582c14
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.0040a90c
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40e867
cmp byte [0x582c10], 0
je 0x40e82c
mov edx, esi
mov eax, ebx
call fcn.0040e690
jmp 0x40e867
mov edx, esi
mov eax, ebx
call fcn.0040e490
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40e867
cmp dword [esi], 0
je 0x40e850
mov eax, esi
mov edx, 0x40e8cc
call fcn.0040b5d4
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040e490
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040b5d4
push 0x582c14
call sub.kernel32.dll_EnterCriticalSection
mov word [0x582c2c], bx
mov eax, dword [esi]
call fcn.0040b3c4
mov ecx, eax
mov eax, 0x582c2e
mov edx, 0xaa
call fcn.0040e310
push 0x582c14
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e8b9
lea eax, [ebp - 4]
call fcn.0040a90c
pop eax
jmp eax
Function at 0x40eaf4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040aa00
xor eax, eax
push ebp
push 0x40ed1c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40eb3a
push 0x105
lea eax, [ebp - 0x21e]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40eb54
mov eax, dword [ebp - 4]
call fcn.0040b3c4
mov ecx, eax
lea eax, [ebp - 0x21e]
mov edx, 0x105
call fcn.0040e310
cmp word [ebp - 0x21e], 0
je 0x40ecff
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ed2c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40ec23
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ed2c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40ec23
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ed68
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40ec23
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ed68
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40ec23
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ed9c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40ec23
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40edd0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40ecff
xor eax, eax
push ebp
push 0x40ecf8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
lea eax, [ebp - 0x21e]
call fcn.0040e8f4
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40ec86
mov eax, dword [ebp - 0x14]
call fcn.00406e34
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040b424
jmp 0x40ecd1
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0x40ee10
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40ecd1
mov eax, dword [ebp - 0x14]
call fcn.00406e34
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x40ee10
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040b424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ecff
cmp dword [ebp - 0xc], 0
je 0x40ecec
mov eax, dword [ebp - 0xc]
call fcn.00406e50
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ed23
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a96c
pop eax
jmp eax