joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008095a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100d729c
call fcn.100cece0
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10080ade
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10080ade
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
call fcn.10088249
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.10088249
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov byte [esi + 2], al
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.10088249
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10088249
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.10088249
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.10088249
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.10088249
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.10088249
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.100034b3
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10080f88
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d731b
call fcn.100cece0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100851fe
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100d78af
call fcn.100cece0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001da4
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10085281
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100c1f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x100c1fcb
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x100c200c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x100c1ff1
mov ecx, ebx
call fcn.100c1c50
add ebx, 0x28
dec ebp
jne 0x100c1fe5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x100c2007
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.100c1b20
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.100c20b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x20]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x1c]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
push ebp
call fcn.10088249
mov ebx, eax
cmp ebx, edi
je 0x100c2084
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.100c20e0
cmp ebx, edi
jle 0x100c207f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x100c2084
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x100c2096
cmp dword [esi + 0x40], edi
jne 0x100c2096
cmp dword [esi + 0x3c], edi
jne 0x100c2096
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x4013f8
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40140a
mov eax, dword [0x48309f]
shl eax, 2
mov dword [0x4830a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov edx, eax
call fcn.004729e4
pop edx
call fcn.00471024
call fcn.004729e8
push 0
call fcn.00474690
pop ecx
push 0x483048
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x4830a7], eax
push 0
jmp fcn.0047eac8
Function at 0x402afc
Capabilities:
Stop service

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerW
mov ebx, eax
test ebx, ebx
je 0x402b51
push 0xf01ff
mov eax, dword [str.HwRwDrv]
push eax
push ebx
call sub.ADVAPI32.DLL_OpenServiceW
mov esi, eax
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
test esi, esi
je 0x402b4b
push esp
push 1
push esi
call sub.ADVAPI32.DLL_ControlService
test eax, eax
push esi
setne bl
and ebx, 1
call sub.ADVAPI32.DLL_CloseServiceHandle
jmp 0x402b55
xor eax, eax
jmp 0x402b57
xor eax, eax
jmp 0x402b57
mov eax, ebx
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x404f24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c0
mov eax, 0x485de4
push ebx
push esi
push edi
call fcn.00473cf0
lea edi, [ebp - 0x440]
mov esi, 0x4831d8
mov ecx, 0x100
lea eax, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x840]
mov ecx, 0x100
mov esi, 0x4835d8
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
push 0
mov edx, dword [0x483168]
push str.HARDWARERESOURCEMAPSystem_ResourcesLoader_Reserved
push edx
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x404f94
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x405145
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x38], 0x400
lea ecx, [ebp - 0x38]
push ecx
lea eax, [ebp - 0x440]
push eax
lea edx, [ebp - 0x34]
push edx
push 0
push 0x48556a
mov ecx, dword [ebp - 0x30]
push ecx
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
je 0x404fe4
mov eax, dword [ebp - 0x30]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x405145
mov ecx, dword [ebp - 0x30]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
call fcn.00401548
test eax, eax
je 0x405006
mov dword [ebp - 0x40], 0x14
mov dword [ebp - 0x3c], 0
jmp 0x405014
mov dword [ebp - 0x40], 0x10
mov dword [ebp - 0x3c], 0
mov ecx, 0x14
lea edx, [ebp - 0x840]
lea eax, [ebp - 0x42c]
jmp 0x40502e
mov bl, byte [eax]
mov byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, dword [ebp - 0x38]
jb 0x405027
sub dword [ebp - 0x38], 0x14
mov word [ebp - 0x1c], 0x30
xor eax, eax
xor ecx, ecx
mov dword [0x490a28], eax
lea eax, [ebp - 4]
mov edx, 0x485574
call fcn.004810c0
inc dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 0x24
mov word [ebp - 0x1c], 0x24
xor ebx, ebx
jmp 0x405112
lea eax, [ebx + 4]
push eax
lea edx, [ebp - 0x840]
push edx
call fcn.00402720
add esp, 8
mov edx, dword [0x490a28]
mov dword [edx*8 + 0x490228], eax
lea ecx, [ebx + 0xc]
push ecx
lea ecx, [ebp - 0x840]
push ecx
call fcn.004028dc
mov edx, dword [0x490a28]
add esp, 8
mov dword [edx*8 + 0x49022c], eax
mov eax, dword [0x490a28]
mov ecx, dword [eax*8 + 0x49022c]
mov eax, dword [0x490a28]
push ecx
mov ecx, dword [0x490a28]
mov edx, dword [eax*8 + 0x490228]
lea eax, [ebp - 8]
push edx
push ecx
push str.__i_Start0x_08lX_Size0x_08lX_n
mov word [ebp - 0x1c], 0x3c
call fcn.00402848
add dword [ebp - 0x10], 2
push eax
call fcn.00402828
add esp, 0x14
lea edx, [ebp - 4]
xchg edx, eax
call fcn.004811f4
sub dword [ebp - 0x10], 2
lea eax, [ebp - 8]
mov edx, 2
call fcn.004027d4
inc dword [0x490a28]
mov eax, dword [ebp - 0x40]
add ebx, eax
cmp ebx, dword [ebp - 0x38]
jb 0x40506c
mov eax, 1
mov edx, 2
push eax
lea eax, [ebp - 4]
sub dword [ebp - 0x10], 2
call fcn.004027d4
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x405145
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4053c4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x40545a
lea edx, [ebp - 0x10]
push edx
push str.SeShutdownPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueW
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
cmp ebx, 1
jne 0x405429
push 0x40000
push 5
call sub.USER32.DLL_ExitWindowsEx
jmp 0x40545a
cmp ebx, 2
jne 0x40543c
push 0x40000
push 6
call sub.USER32.DLL_ExitWindowsEx
jmp 0x40545a
cmp ebx, 3
jne 0x40544c
push 1
push 1
call sub.KERNEL32.DLL_SetSystemPowerState
jmp 0x40545a
cmp ebx, 4
jne 0x40545a
push 1
push 0
call sub.KERNEL32.DLL_SetSystemPowerState
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43efb4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x43f00d
test eax, edx
je 0x43f010
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x43efcb
movzx eax, word [eax]
sub eax, ecx
jmp 0x43eff2
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x43eff3
add ecx, 4
js 0x43efe3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x43eff0
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x43eff2
xor eax, eax
ret
test eax, eax
je 0x43f01c
test edx, edx
jne 0x43efbc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x440164
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0045927c
mov edi, eax
push edi
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4401ce
test ah, 4
je 0x4401c7
test bl, bl
jne 0x44018c
mov al, 1
jmp 0x4401f5
test al, 0x10
je 0x440194
xor eax, eax
jmp 0x4401f5
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push edi
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x4401b8
push eax
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x4401f5
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x4401f5
test al, 0x10
sete al
jmp 0x4401f5
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x4401ef
cmp ebx, 3
je 0x4401ef
cmp ebx, 0x7b
je 0x4401ef
mov eax, esi
call fcn.00440124
test al, al
jne 0x4401f3
xor eax, eax
jmp 0x4401f5
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x443e70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x443ea9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004586b8
jmp 0x443eb2
mov eax, ebx
mov edx, esi
call fcn.00458910
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x443ebc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x443ede
movzx eax, word [esp]
jmp 0x443ee0
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x444bb4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x444cd9
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004449bc
mov esi, eax
mov eax, dword [0x48fbf0]
cmp byte [eax], 0
je 0x444c81
mov eax, dword [0x48fbf4]
call fcn.00456a84
call fcn.0045682c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x444b84]
call fcn.0045a380
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x444cf4
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x444cbd
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x48fa68]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x493100]
call fcn.0045a444
push eax
call sub.USER32.DLL_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.USER32.DLL_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444ce0
lea eax, [ebp - 4]
mov edx, dword [0x444b84]
call fcn.0045a38c
ret

Function at 0x44656c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00458a2c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0045beb0
mov edi, eax
cmp edi, 0x104
jbe 0x446513
mov eax, edi
add eax, eax
call fcn.004566d8
mov esi, eax
jmp 0x446515
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0045beb0
mov eax, esi
push eax
call sub.USER32.DLL_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x446550
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x44653a
mov eax, esp
cmp esi, eax
je 0x44655d
mov eax, esi
call fcn.004566f4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x446598
cmp bl, 0
je 0x446594
cmp bl, 0x41
jl 0x44658f
cmp bl, 0x5a
jg 0x44658f
or bl, 0x20
xor al, bl
inc esi
jmp 0x446573
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4464d4

Function at 0x446d78
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00459310
add esp, 0x800
pop ebx
ret
Function at 0x457808
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00457ab8
mov byte [esp], al
cmp byte [esp], 0
jne 0x457994
test edi, edi
je 0x457994
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4578cb
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x4578a6
cmp edi, 0xffffffff
je 0x457867
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x457867
mov byte [esp], 0
jmp 0x457994
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4578a6
test ebx, ebx
jne 0x45789c
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00454b2c
test eax, eax
jne 0x45789c
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x457994
call 0x457afc
dec ebp
test ebp, ebp
jg 0x45784c
cmp edi, 0xffffffff
je 0x4578cb
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4578c9
mov byte [esp], 0
jmp 0x457994
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x457816
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00454b2c
cmp ebx, eax
jne 0x4578cb
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00457a04
mov edx, eax
mov ebx, dword [0x493a1c]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x457932
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x457930
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x457932
xor edi, edi
cmp byte [esp], 0
je 0x45795b
mov ebx, dword [esi]
test bl, 1
jne 0x457974
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00454b2c
cmp ebx, eax
jne 0x457938
mov byte [esp + 1], 1
jmp 0x457974
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00454b2c
cmp ebx, eax
jne 0x45795b
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4578e5
cmp byte [esp], 0
je 0x457994
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4582c8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49317c], 0
je 0x45832f
cmp word [0x493468], 0xd7b2
jne 0x4582f1
cmp dword [0x493470], 0
jbe 0x4582f1
mov eax, 0x493464
call dword [0x493480]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x45835c
call fcn.00458ee0
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x488a38], 0
jne 0x45834b
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x45a900
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45aa65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00458560
cmp si, word [0x489404]
jb 0x45a998
cmp si, word [0x489604]
ja 0x45a998
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x45a998
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x489404]
jae 0x45a972
mov edi, ebx
dec edi
jmp 0x45a993
cmp si, word [ebx*8 + 0x489404]
jbe 0x45a982
inc ebx
mov dword [ebp - 8], ebx
jmp 0x45a993
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x489408]
call fcn.0045a810
jmp 0x45a998
cmp edi, dword [ebp - 8]
jae 0x45a95c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x45aa47
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x45aa47
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00459310
push dword [ebp - 0x160]
push 0x45aa80
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00459310
push dword [ebp - 0x164]
push 0x45aa90
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00459310
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00459548
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45aa6c
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004585c0
ret
Function at 0x45ac18
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45ad1b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x495cb4
call sub.KERNEL32.DLL_EnterCriticalSection
cmp bx, word [0x495ccc]
jne 0x45ac64
mov eax, esi
mov edx, 0x495cce
mov ecx, 0x55
call fcn.00459310
push 0x495cb4
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x45ad05
push 0x495cb4
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
call fcn.00458560
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x45acd3
cmp byte [0x495cb0], 0
je 0x45ac98
mov edx, esi
mov eax, ebx
call fcn.0045aafc
jmp 0x45acd3
mov edx, esi
mov eax, ebx
call fcn.0045a900
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0x45acd3
cmp dword [esi], 0
je 0x45acbc
mov eax, esi
mov edx, 0x45ad34
call fcn.00459468
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0045a900
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00459468
push 0x495cb4
call sub.KERNEL32.DLL_EnterCriticalSection
mov word [0x495ccc], bx
push 0xaa
mov eax, dword [esi]
call fcn.0045927c
push eax
push 0x495cce
call sub.KERNEL32.DLL_lstrcpynW
push 0x495cb4
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad22
lea eax, [ebp - 4]
call fcn.00458560
ret