joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180044fe0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180078040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov qword [rcx], rsi
mov rbx, rcx
mov qword [rcx + 8], rsi
xor edx, edx
mov ecx, 4
mov ebp, r8d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18004510b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180045102
nop dword [rax + rax]
cmp dword [rsp + 0x20], 0x10
jb 0x1800450e4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x1800450e4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x1800450e4
mov rdx, qword [rbx]
test rdx, rdx
jne 0x1800450a2
mov rcx, qword [0x180078e58]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180045102
jmp 0x1800450d7
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x1800450d7
mov rcx, qword [0x180078e58]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180045102
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180045050
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x180045165
cmp dword [rbx + 0xc], esi
jbe 0x180045165
nop word [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
mov ecx, 0x5a
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18004515e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.180044e30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x180045120
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180047b60
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180045190
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180078040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x180079960]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180045203
mov eax, 0xa
jmp 0x180045296
test esi, esi
je 0x180045225
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180045248
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180045248
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180045241
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180045248
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180047b60
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800452c0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x18007996c]
mov ebx, edi
test ecx, ecx
je 0x1800453fd
mov rax, qword [0x180079960]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180045318
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800452f0
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x1800453fd
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180044fe0
mov r8d, dword [0x18007996c]
cmp ebx, r8d
jae 0x180045388
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x180079960]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x180045381
mov edx, esi
mov ecx, ebx
call fcn.180045190
mov edi, eax
test eax, eax
jne 0x180045388
mov r8d, dword [0x18007996c]
inc ebx
cmp ebx, r8d
jb 0x180045350
cmp qword [rsp + 0x20], 0
je 0x1800453fd
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800453e9
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800453da
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800453b0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180078e58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180045770
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180078e50], ebp
je 0x1800457c7
cmp rbx, 0x20
jae 0x1800457b0
xor ecx, ecx
jmp 0x1800457b2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180078e50], ebp
jne 0x1800457a6
cmp qword [0x180078e58], r15
je 0x1800458c3
test rdi, rdi
jne 0x1800457e7
mov ecx, esi
call fcn.1800452c0
mov ebp, eax
jmp 0x1800458c8
mov ecx, dword [0x18007996c]
mov ebx, r15d
test ecx, ecx
je 0x18004580f
mov r8, qword [0x180079960]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180045819
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180045800
mov ebp, 4
jmp 0x1800458c8
cmp ebx, 0xffffffff
je 0x18004580f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x1800458ba
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180044fe0
mov edx, esi
mov ecx, ebx
call fcn.180045190
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x1800458c8
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800458a4
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18004589a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180045870
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180078e58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800458c8
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x1800458c8
mov ebp, 2
xchg dword [0x180078e50], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x1800478e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x180047922
cmp edx, 1
jne 0x18004794c
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180047880]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp dword [0x180078f68], 0
je 0x18004794c
call fcn.1800458f0
mov rcx, qword [0x180078f60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x180078f60], rax
mov dword [0x180078f68], eax
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140001ff0
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
mov qword [rsp + 0x48], rcx
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
mov r8d, 3
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
xorps xmm0, xmm0
cmp rax, 0xffffffffffffffff
jne 0x140002072
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r15b
jmp 0x1400021b3
movups xmmword [rsp + 0x60], xmm0
lea rax, [0x1400021e0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x54], r15
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x44], r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400020f3
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], al
jmp 0x1400021a4
mov edi, dword [rsp + 0x4c]
mov ecx, edi
call fcn.140004254
mov r14, rax
mov r8d, edi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov r9d, 0xc
lea r8, [rsp + 0x50]
mov edx, 0x2d1400
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140002167
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], al
mov rcx, r14
call fcn.140004210
nop
jmp 0x1400021a4
mov eax, dword [r14 + 0x18]
test eax, eax
jne 0x14000218e
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], al
mov rcx, r14
call fcn.140004210
nop
jmp 0x1400021a4
lea rdx, [r14 + rax]
mov rcx, rsi
call fcn.140002280
nop
mov rcx, r14
call fcn.140004210
nop
test rbp, rbp
je 0x1400021b3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rsi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400041f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140004d3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004d86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004d86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004d86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004d86
cmp dword [rcx + 0x84], 0xe
jbe 0x140004d86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004d88
xor al, al
add rsp, 0x28
ret
Function at 0x4079a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x0057e0a0], 0
je 0x407a5b
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.0040eb20
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x0055b0c0]
call fcn.0040eb20
mov rcx, rsi
mov rdx, qword [0x0055b0c0]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.0040eb20
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x407a70
xor rcx, rcx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x40bd60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov ebx, edx
mov rax, qword [rbp + 0x28]
mov r13d, dword [rax + 0x18]
mov rcx, qword [rbp + 0x28]
call fcn.0040c3c0
mov esi, eax
test sil, sil
jne 0x40bf22
test ebx, ebx
je 0x40bf22
xor rdi, rdi
test r13d, r13d
jle 0x40be47
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov dword [rbp + 0x3c], 0
test r13d, r13d
jle 0x40be26
cmp ebx, 0xffffffff
je 0x40bdd3
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x40bdd3
xor rsi, rsi
jmp 0x40bf22
mov rax, qword [rbp + 0x28]
cmp dword [rax], 1
jg 0x40be26
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0
jne 0x40be14
xor eax, eax
mov ecx, 1
mov rdx, qword [rbp + 0x28]
lock cmpxchg dword [rdx], ecx
test eax, eax
jne 0x40be14
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov sil, 1
jmp 0x40bf22
lea rcx, [rbp + 0x3c]
call fcn.0040b910
sub r13d, 1
test r13d, r13d
jg 0x40bdba
nop
cmp ebx, 0xffffffff
je 0x40be47
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jb 0x40be42
xor rsi, rsi
jmp 0x40bf22
sub eax, r14d
sub ebx, eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x40bd7d
mov edx, ecx
add edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40be47
nop
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov rcx, qword [rbp + 0x28]
call fcn.0040bfd0
xor rcx, rcx
mov rdx, rax
mov r8d, ebx
mov rax, qword [0x0057e998]
call qword [rax + 0x20]
test eax, eax
sete sil
cmp ebx, 0xffffffff
je 0x40beb1
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jae 0x40beae
sub eax, r14d
sub ebx, eax
jmp 0x40beb1
xor rbx, rbx
test sil, sil
je 0x40bee3
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov eax, ecx
test eax, 1
jne 0x40bee0
mov edx, ecx
sub edx, 2
or edx, 1
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40beb6
mov dil, 1
nop
jmp 0x40bf00
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov edx, ecx
sub edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40bee3
mov dil, 1
test dil, dil
je 0x40be6a
nop
test sil, sil
je 0x40bf22
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov eax, esi
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x40dda0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x0057e0a0], 0
je 0x40de3e
cmp word [0x0057e3b0], 0xd7b2
jne 0x40ddd3
cmp dword [0x0057e3b8], 0
jbe 0x40ddd3
lea rcx, [0x0057e3a8]
call qword [0x0057e3d0]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x0055c920]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x0040de74]
call fcn.0040f110
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x40de60
cmp byte [0x0055b052], 0
jne 0x40de60
xor rcx, rcx
lea rdx, [0x0055c920]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x40e140
Capabilities:
Create thread

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov ebx, edx
mov rsi, r8
mov rdi, r9
cmp qword [0x0055b058], 0
je 0x40e171
mov rcx, rsi
mov rdx, rdi
call qword [0x0055b058]
mov r13, rax
jmp 0x40e187
mov ecx, 0x10
call fcn.00408c30
mov r13, rax
mov qword [r13], rsi
mov qword [r13 + 8], rdi
mov byte [0x0057e0a1], 1
mov rcx, qword [rsp + 0x38]
mov edx, ebx
lea r8, [0x0040e0d0]
mov r9, r13
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov rbx, rax
test rbx, rbx
jne 0x40e1cc
mov rcx, r13
call fcn.00408c60
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x411bd0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x00582e68]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x00582e90], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x00582e60], al
cmp byte [0x00582e60], 0
je 0x411c6f
lea rcx, [0x00411c74]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x00411c8e]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00582e48], rax
lea rcx, [0x00411c74]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x00411cac]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00582e50], rax
lea rcx, [0x00411c74]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x00411cca]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00582e58], rax
add rsp, 0x28
ret
Function at 0x411f50
Capabilities:
Get geographical location

Disassembly:
push rbp
sub rsp, 0x1d0
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], rdx
mov word [rbp + 0x4e], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
call fcn.0040e350
movzx rax, word [rbp + 0x4e]
cmp word [0x0055cfe0], ax
ja 0x412038
movzx rax, word [rbp + 0x4e]
cmp ax, word [0x0055d3e0]
mov word [rbp + 0x4e], ax
ja 0x412038
mov ecx, 0x40
xor r8, r8
cmp ecx, r8d
jb 0x412037
mov eax, ecx
add eax, r8d
mov r9d, 2
xor edx, edx
div r9d
lea rdx, [0x0055cfe0]
mov r9d, eax
add r9, r9
movzx r10, word [rbp + 0x4e]
cmp word [rdx + r9*8], r10w
jbe 0x411ff1
mov ecx, eax
sub ecx, 1
jmp 0x412032
lea rdx, [0x0055cfe0]
mov r8d, eax
add r8, r8
movzx r9, word [rbp + 0x4e]
cmp word [rdx + r8*8], r9w
jae 0x412013
mov r8d, eax
add r8d, 1
jmp 0x412032
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
lea r8, [0x0055cfe8]
mov eax, eax
add rax, rax
mov r8, qword [r8 + rax*8]
call fcn.00411de0
jmp 0x412037
cmp ecx, r8d
jae 0x411fc0
nop
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0
jne 0x41211a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x41211a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040f7a0
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.0040f7a0
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040f7a0
mov rcx, qword [rbp + 0x40]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x00412174]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x00412184]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.0040fc20
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.0040e430
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x1d0]
pop rbp
ret
Function at 0x412390
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x00582e68]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x00582e90], ax
jne 0x4123fb
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00582e92]
mov r8d, 0x55
call fcn.0040f7a0
lea rcx, [0x00582e68]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x412506
lea rcx, [0x00582e68]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.0040e350
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4124c0
cmp byte [0x00582e60], 0
je 0x412454
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.00412220
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.0040e980
jmp 0x4124c0
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.00411f50
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040e980
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x4124c0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x41249f
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00412554]
call fcn.0040fa10
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.00411f50
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.0040fa10
lea rcx, [0x00582e68]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x00582e90], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.0040f6d0
lea rcx, [0x00582e92]
mov edx, 0xaa
mov r8, rax
call fcn.00411d00
lea rcx, [0x00582e68]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.0040e430
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x412f30
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.0040e4e0
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040f7a0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.0040fb00
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.00412d50
test al, al
jne 0x412ffe
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040f7a0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.0040fb00
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.00412d50
test al, al
jne 0x412ffe
mov rcx, qword [rbp + 0x20]
call fcn.0040e350
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040e430
lea rcx, [rbp + 0x70]
call fcn.0040e350
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret