joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fad0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x424448], 0
je 0x41faeb
mov eax, 1
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x108]
push str.National_Instruments_LabWindows_CVI_Startup_SDK_stubs__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x41fb24
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x424448], 0
jne 0x41fb5a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x424448], eax
test eax, eax
jne 0x41fb5a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x424448], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x424448], eax
pop esi
setne al
mov esp, ebp
pop ebp
ret
Function at 0x480bbb
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x467b25fa
cmp ebp, dword [ecx + 0x312c13f1]
xor dword [eax], esi
mov ebp, 0x789db37f
std
xlatb
fsub dword [ebx + ecx*8 - 0x2e]
int1
les esp, [ecx - 0x7a417de0]
push ebp
pushal
and byte [edx + 0x605585be], al
jecxz 0x480be1
mov al, 0x58
push ecx
cmp ebx, esi
neg byte [edi + 0x56]
push edx
adc byte [edx - 0x40], dh
and ebp, edx
cmpsd dword [esi], dword es:[edi]
mov byte [esi - 0x1a], al
pop es
cld
invalid
ja 0x480b8b
jl 0x480bd9
jl 0x480b83
arpl si, bp
mov dword [edi - 0x72], ebx
push ebp
movsd dword es:[edi], dword [esi]
out 0x57, eax
wait
mov al, 0x3a
push 0xf
outsd dx, dword [esi]
bound esi, qword [ebx - 0x28e66cda]
pop edi
mov dword [0x67967819], eax
sub eax, 0x99c50e3d
js 0x480b71
sub eax, 0x99c50e3d
rcr dl, 0x90
xor al, 0x9e
rol dword [ebp - 0x1e4f2874], cl
salc
mov ch, 0x35
cmpsd dword [esi], dword es:[edi]
or al, byte [ebx]
push ds
adc edx, dword [ecx + esi*4 + 0x782e6cfb]
aaa
sub byte [ebp - 0x174a13bf], cl
mov byte [0xce95d967], bl
mov cl, 0xaf
cmp al, byte [esi - 0x16]
sar dword [edi], 1
invalid

Function at 0x49ccc5
Capabilities:
Encode data using xor

Disassembly:
sub ebx, edx
cmp ch, dh
dec esp
inc ecx
adc eax, 0xbd2d5cfc
popal
pop esi
xor eax, 0x5331dde5
sub dword [edx], edi
fmul dword [eax + ecx*8 - 0x27]
scasd eax, dword es:[edi]
pop es
cld
inc edi
jecxz 0x49ccd0
adc dl, byte [ecx]
xor al, 0x8e
cld
stc
xlatb
add bh, ah
xor al, 0x78
invalid

Function at 0x4b336b
Capabilities:
Encode data using xor

Disassembly:
pop ecx
scasd eax, dword es:[edi]
and eax, 0x9c156ccc
pop edi
fcom qword [esi]
mov dword [0xdcec45e2], eax
cmp eax, 0xaf2fad42
sbb eax, 0x2c9d8ecc
or dh, 0xbe
sbb eax, 0x54cdd0e4
in eax, 0x64
mov ah, 0xbb
mov dword [eax + 0x45], edx
pushfd
adc byte [edx + ecx*2], cl
insd dword es:[edi], dx
in al, dx
frstor dword [ebx - 0x1db3f779]
pop ebp
stosb byte es:[edi], al
lea eax, [ebx + 0x53]
pop eax
xlatb
fsubr dword [edx + 3]
cmp eax, 0xc5fcc4ec
cdq
aaa
xor eax, 0x461c9c7e
pushfd
sbb al, 0x46
mov byte [edi - 0x3392394a], ah
push ecx
push ebx
xor dword [edx], 0x73
mov dl, 0x32
mov eax, dword [0xcdbcd3df]
std
in al, 0x9e
or cl, byte [0x33b44d64]
cmp eax, 0x4e1890c0
push cs
xor ebp, dword [ebx - 0x7abf2fb0]
fldlg2
pop ebp
sbb al, 0x25
clc
popal
sub eax, 0x511937c4
loop 0x4b33b3
cdq
lahf
cmp al, 0xe6
add esp, ebp
sub edx, dword [eax + 0x64]
les edi, [esp + edi*4 + 0x79]
xor esi, edx
or al, 0xed
das
mov al, byte [0x800d7dbc]
movsd dword es:[edi], dword [esi]
lea esi, [eax]
sahf
pop ebp
invalid
Function at 0x4c9efb
Capabilities:
Encode data using xor

Disassembly:
imul edi, ebx, 0x8ef4763d
ror byte [esi - 0x74], cl
mov ecx, 0xb9090c24
inc esi
pop ss
pop edi
mov dword [ebp + ecx - 0x13], esi
xchg esp, eax
push eax
cmp eax, 0x32e9fd14
inc esi
jl 0x4c9ee5
push 0x64cc268c
shr dword gs:[ecx + esi*2], 1
daa
pop esp
and al, 0xba
inc esp
xchg ebx, eax
or al, 0x4a
sbb eax, 0x9bd07ca8
salc
adc ebx, dword ds:[eax]
sub eax, 0x1eacfcbc
jb 0x4c9f6f
pop ebp
cmp ebx, dword [ebx + edx + 0x2b553265]
jae 0x4c9ea6
cmp eax, 0xb5e9fe90
mov word [ecx + 0x2ec2f684], ds
cli
movsb byte es:[edi], byte [esi]
std
mov ebp, 0x414de2e3
sub dword [edx], ecx
cmp al, 0x29
adc dl, byte [esp + esi + 0x79a9d30d]
mov word [eax], ds
inc ebx
dec dword [ecx]
invalid
jne 0x4c9faf
sbb ch, 0xfd
std
mov ds, word ss:[edx - 0x23]
cmp al, 0x9a
aam 0x6e
fucom st(4)
xor byte [ebp - 0x334337fd], bl
jl 0x4c9f5c
sbb eax, 0x6128447a
or al, 0xbc
push 0xee787ef4
jp 0x4c9fb6
sub byte [ecx + 0xc], ah
mov esp, 0x787ef468
out dx, al
fmul qword [ebp + ebx + 0xe]
jp 0x4c9f70
jle 0x4c9fd1
loop 0x4c9f58
mov edi, 0xbbe642ba
scasb al, byte es:[edi]
lcall 0x2a2d, 0x2c8e84a6
and al, 0xf0
cmp dh, ch
push es
into
sahf
push cs
adc ch, ch
retf
pop esi
invalid
cld
and dword [0xf009be7d], ebp
invalid

Function at 0x54b47b
Capabilities:
Encode data using xor

Disassembly:
dec esi
sahf
sbb eax, 0x60f1c5ee
sub ch, byte [esi - 0x558b63fd]
mov ebx, 0xd01e9bcf
sti
invalid

Function at 0x5731cb
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a66bb
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5732ee
push ecx
lea ecx, [esi + 0x18]
call 0x5929eb
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573305
push ecx
lea ecx, [esi + 0x24]
call fcn.005928fb
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x57603b
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
push edi
mov edi, ecx
shr edx, 0x10
mov ecx, eax
and ecx, 0xf0
pushfd
insb byte es:[edi], dx
jae 0x5760a0
ljmp 0xf0e1:0x81c88b10
lcall 0xec41, 0xaecc8d5c
pop eax
cli
or al, 0xec
outsb dx, byte [esi]
pop ds
scasd eax, dword es:[edi]
jge 0x576072
cmp al, 0xcc
sbb esp, 0x4c
lodsb al, byte [esi]
dec esp
xlatb
and al, 0x7e
jl 0x5760fc
fidivr word [ebp - 0x2a]
or byte [ebx + ebp*2 + 0x2ddd442e], bh
test eax, 0xdc0e0c23
push ebp
xchg esp, eax
in al, dx
push es
div byte [eax - 0x70]
sal byte [edx], 0x8c
inc esi
lodsb al, byte [esi]
insb byte es:[edi], dx
and eax, 0x669d1cc5
add al, 0xe4
popfd
add al, 0xe4
mov esp, 0xa9bcafe0
and byte [eax + 0x2e], ch
pop esp
push es
out 0x5d, al
cmp al, 0x48
lahf
lodsd eax, dword [esi]
push 0x7095323b
mov cl, 0xc9
leave
jle 0x576124
sub byte [ecx + 0x387b091c], dh
mov esi, 0xff5416ac
je 0x576102
lodsb al, byte [esi]
push ss
push esp
push dword [eax + edi + 0x6d]
insd dword es:[edi], dx
jge 0x5760ba
test al, 0x28
xor eax, 0xdb62f1c8
ja 0x576056
invalid
lodsb al, byte [esi]
pop esp
rcr byte [eax + ecx*8 - 0x3606628f], cl
popfd
stc
leave
pop eax
fdivr dword [ebp + 0x55]
idiv dword [eax - 0x54edd1d8]
sahf
jecxz 0x5760c4
rcr dword [edi], cl
sbb bh, cl
cmp byte [ecx], cl
push cs
or al, byte [edx - 0x46]
mov cl, bh
mov ebx, 0x1f4e9d88
aaa
lodsd eax, dword [esi]
pop ebp
mov byte [esi + ecx*8], ah
sub ebp, ebx
sub eax, 0x1d2db1b9
or byte [ecx], ah
sbb eax, 0x67d8190a
int3

Function at 0x5dc36b
Capabilities:
Encode data using xor

Disassembly:
cwde
clc
dec esp
cli
pinsrw mm6, word [edx + 0x59ef3e15], 0xe5
xchg ebx, eax
lahf
sub byte [edx], ah
stosb byte es:[edi], al
and esi, edx
rol byte [ebp + edi*8 - 0x1396c0a5], 0x23
xor eax, 0x23a17c58
adc esp, dword [0x736dc710]
fld qword [edx + 0x195d84e5]
cmpsd dword [esi], dword es:[edi]
jge 0x5dc378
ljmp 0x176f:0xedb6ef93
Function at 0x5f007b
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xd322e151
mov al, byte [0x52af6c4c]
push edx
scasd eax, dword es:[edi]
push edx
mov cl, 0x34
xor byte [esi - 0x43], 0x62
push cs
or byte [edx - 0x6e], cl
jae 0x5f007a
push edx
sti
loopne 0x5f00d2
or ch, byte [eax + 0x15]
sbb al, cl
cmp byte [edx + 0xa3d1104], ch
xor ch, byte [edx - 0x5ab345aa]
jge fcn.005f007b
in eax, dx
fnstcw word [edi + 0x23604745]
sub byte [eax], 0
in al, dx
sub ch, al
sahf
cld
push 0x1416ea8b
mov al, 0xe0
adc al, 0xc
lea eax, fs:[ebp + 0x22b0512f]
ror dword [ebp + 0x47], cl
dec ecx
jp 0x5f0072
mov dl, 0x6d
jno 0x5f010c
sub al, byte [ecx]
fadd dword [edx]
div byte [ecx + ecx*4 - 0x4f85ea78]
mov al, byte [0x166621ea]
stosb byte es:[edi], al
retf 0xa355
mov al, 0xa0
ljmp 0x55ca
sub ebx, dword [ebx - 0x3c0ac431]
ljmp 0x8b8b
fsubr dword [eax + edx*2 - 0x75]
mov esi, dword [edi - 0x65]
xchg ecx, eax
fld qword [edx]
imul dword [edx + eax - 0x3b]
and dword [ebx], ebp
jo 0x5f0149
nop
push eax
xchg esp, eax
xor dword [edx], eax
stosd dword es:[edi], eax
xchg ecx, eax
jnp 0x5f016b
les edi, [ecx]
mov ch, 0x13
dec esp
mov ebx, dword [esi + 0x32]
ficom dword [eax - 0x2e]
add ax, 0xee9
adc edi, dword [eax + 0x72]
sub dword [eax - 0x2b], esp
jge 0x5f00ec
dec ebx
stosb byte es:[edi], al
dec ecx
inc edx
mov byte [0xaa64f7ca], al
cmp al, 0x7a
inc esi
or al, cl
ret 0x81ca
jp 0x5f00e4
dec ebp
push ss
dec edi
fstp dword [eax - 0x44]
outsd dx, dword [esi]
mov bl, 0x8b
sbb ah, cl
lds edx, [edx]
adc dword [ebx + 8], edi
loope 0x5f0110
adc dl, byte [ecx]
jnp 0x5f0157
push edx
int 0x2a
test dword [ebx - 0x7c991e65], 0xa68583f
aaa
jno 0x5f0159
cmp dword [edi], 0x58
pop eax
push 0xfa71370a
sar byte [edx + 0x7ba2690b], 0x6d
push ss
xor bh, dl
jge 0x5f013d
in al, dx
and dword [edi + 0x3551c1ee], ebp
ret 0xeffa

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4068db
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068ff
xor eax, eax
test eax, eax
je 0x406912
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406912
xor ecx, ecx
jmp 0x406915
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a6f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a49
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a44
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406aa0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406a82
pop edi
not eax
pop esi
ret 0xc

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x408937
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ebx
call fcn.00408959
add edx, edx
xor dword [ecx], ebx
inc ecx
and eax, eax
cmp ecx, esi
jne fcn.00408937
add edx, 1
ret
Function at 0x4048c8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406bc4
test esi, esi
jne 0x4048fe
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406d4c
jmp 0x40491c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040480c
mov edi, eax
test esi, esi
je 0x40491c
cmp dword [ebx], 0
je 0x40491c
dec esi
jmp 0x404905
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405940
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405d38
mov byte [esp], al
cmp byte [esp], 0
jne 0x405acc
test edi, edi
je 0x405acc
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405a03
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x4059de
cmp edi, 0xffffffff
je 0x40599f
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40599f
mov byte [esp], 0
jmp 0x405acc
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4059de
test ebx, ebx
jne 0x4059d4
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.004027cc
test eax, eax
jne 0x4059d4
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405acc
call 0x405e5c
dec ebp
test ebp, ebp
jg 0x405984
cmp edi, 0xffffffff
je 0x405a03
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405a01
mov byte [esp], 0
jmp 0x405acc
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40594e
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.004027cc
cmp ebx, eax
jne 0x405a03
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405b3c
mov edx, eax
mov ebx, dword [0x5308f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x405a6a
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405a68
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x405a6a
xor edi, edi
cmp byte [esp], 0
je 0x405a93
mov ebx, dword [esi]
test bl, 1
jne 0x405aac
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.004027cc
cmp ebx, eax
jne 0x405a70
mov byte [esp + 1], 1
jmp 0x405aac
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.004027cc
cmp ebx, eax
jne 0x405a93
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x405a1d
cmp byte [esp], 0
je 0x405acc
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40685c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x530058], 0
je 0x4068c3
cmp word [0x530344], 0xd7b2
jne 0x406885
cmp dword [0x53034c], 0
jbe 0x406885
mov eax, 0x530340
call dword [0x53035c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4068f0
call fcn.0040742c
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x52b032], 0
jne 0x4068df
push 0
push 0x52b9c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x52b034], 0
je 0x406aab
mov edx, edi
mov eax, esi
call dword [0x52b034]
mov ebx, eax
jmp 0x406abc
mov eax, 8
call fcn.00404548
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x530059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406a48
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x406af1
mov edx, 8
mov eax, ebx
call fcn.00404564
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x409038
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40919d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406bc4
cmp si, word [0x52ba00]
jb 0x4090d0
cmp si, word [0x52bc00]
ja 0x4090d0
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x4090d0
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x52ba00]
jae 0x4090aa
mov edi, ebx
dec edi
jmp 0x4090cb
cmp si, word [ebx*8 + 0x52ba00]
jbe 0x4090ba
inc ebx
mov dword [ebp - 8], ebx
jmp 0x4090cb
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x52ba04]
call fcn.00408f48
jmp 0x4090d0
cmp edi, dword [ebp - 8]
jae 0x409094
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40917f
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40917f
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004077a0
push dword [ebp - 0x160]
push 0x4091b8
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004077a0
push dword [ebp - 0x164]
push 0x4091c8
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004077a0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004079d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4091a4
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406c24
ret
Function at 0x409350
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409453
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x532b88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x532ba0]
jne 0x40939c
mov eax, esi
mov edx, 0x532ba2
mov ecx, 0x55
call fcn.004077a0
push 0x532b88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40943d
push 0x532b88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406bc4
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40940b
cmp byte [0x532b84], 0
je 0x4093d0
mov edx, esi
mov eax, ebx
call fcn.00409234
jmp 0x40940b
mov edx, esi
mov eax, ebx
call fcn.00409038
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40940b
cmp dword [esi], 0
je 0x4093f4
mov eax, esi
mov edx, 0x40946c
call fcn.004078f8
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00409038
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004078f8
push 0x532b88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x532ba0], bx
push 0xaa
mov eax, dword [esi]
call fcn.0040770c
push eax
push 0x532ba2
call sub.kernel32.dll_lstrcpynW
push 0x532b88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40945a
lea eax, [ebp - 4]
call fcn.00406bc4
ret