joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400052c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xc8], 0
mov rdi, rdx
mov rbx, rcx
jg 0x1400052f3
mov r8d, 0x6c4
lea rdx, str.D:Sourcesimgui_512c54bbc062c41c74f8a8bd8ff1fd6bebd1e6d0imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm2, dword [rbx + 0xe8]
lea r8, [0x140060380]
movss xmm0, dword [rdi]
movsxd rcx, dword [rbx + 0xc8]
subss xmm0, xmm2
mov rax, qword [rbx + 0xd0]
movss xmm3, dword [rbx + 0xec]
movss xmm1, dword [rdi + 4]
subss xmm1, xmm3
mov edx, dword [rax + rcx*4 - 4]
not edx
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x20]
movss xmm0, dword [rdi + 8]
movzx ecx, dl
subss xmm0, xmm2
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor edx, dword [r8 + rcx*4]
subss xmm1, xmm3
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x23]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x24]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x25]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x26]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x27]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x28]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x29]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x2a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x2b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x2c]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x2d]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x2e]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x2f]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1400c9a50]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1c9c], edx
jne 0x140005490
mov dword [rax + 0x1ca0], edx
cmp dword [rax + 0x1cd8], edx
jne 0x14000549f
mov byte [rax + 0x1cdc], 1
mov rbx, qword [rsp + 0x40]
mov eax, edx
add rsp, 0x30
pop rdi
ret
Function at 0x140011970
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rdx, qword [0x1400c9a50]
movsxd rsi, ecx
mov rbx, qword [rdx + 0x1c50]
add rbx, 0xc8
cmp dword [rbx], 0
jg 0x1400119c1
mov r8d, 0x6c4
lea rdx, str.D:Sourcesimgui_512c54bbc062c41c74f8a8bd8ff1fd6bebd1e6d0imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rdx, qword [0x1400c9a50]
movsxd rcx, dword [rbx]
lea r8, [0x140060380]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rcx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
not edi
cmp dword [rdx + 0x1c84], edi
jne 0x140011a39
mov r8, rsi
mov edx, 4
mov ecx, edi
call fcn.14001aa20
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x140011a6d
inc r8d
test ecx, ecx
je 0x140011a56
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140011a5b
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.14001bd90
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140013070
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1400c9a50]
mov edi, ecx
cmp byte [rbx + 0x1fe5], 0
jne 0x1400130c2
cmp byte [rbx + 0x1fe6], 0
jne 0x1400130c2
movsx r9d, word [rbx + 0x30c6]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400027f0
test dil, 1
je 0x1400131e8
jmp 0x14001314b
movss xmm1, dword [rbx + 0x1628]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14006ce04]
xor eax, eax
mulss xmm1, dword [0x14006cde8]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d60], rax
mov dword [rbx + 0x1d4c], 1
movss dword [rbx + 0x1d58], xmm0
movss dword [rbx + 0x1d5c], xmm1
movss xmm0, dword [rbx + 0x1690]
mulss xmm0, dword [0x14006ccd4]
or dword [rbx + 0x1d48], 0x41
movss dword [rbx + 0x1da8], xmm0
movsx r9d, word [rbx + 0x30c6]
call fcn.1400027f0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400131a0
lea r11, [0x140060380]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140013183
cmp byte [r8], r9b
jne 0x140013183
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140013170
not ecx
call fcn.14000b6c0
test rax, rax
je 0x1400131e8
cmp byte [rax + 0x8e], 0
je 0x1400131e8
mov byte [rax + 0x96], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x30c6]
mov edx, 0x10
movsx r9d, word [rbx + 0x30c6]
call fcn.1400027f0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000de80
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400194f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3168], 0
lea rbx, [rcx + 0x3170]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140019597
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001954a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001bb60
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400032d0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3168]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3178]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400c9a48]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001959f
mov rcx, rbx
call fcn.1400032d0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14004e020
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14004e058
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140049870
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14004e196
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14004e110
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14004e185
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14004e14d
mov r10, qword [rdx]
cmp r10, rax
je 0x14004e147
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14004e185
cmp r9, rdx
je 0x14004e161
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14004e1ab
cmp r9, rdx
jne 0x14004e152
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14004e0c0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14004e185
Function at 0x14005ab3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005ab86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005ab86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005ab86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005ab86
cmp dword [rcx + 0x84], 0xe
jbe 0x14005ab86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005ab88
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4d88f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d92f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4d938a
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4d936e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9362
cmp qword [rbp - 0x10], 0
je 0x2fc4d9362
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d9328
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d938b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9490
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d94b8
mov eax, 0
jmp 0x2fc4d9506
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d94e1
mov eax, 0
jmp 0x2fc4d9506
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d9501
mov eax, 0
jmp 0x2fc4d9506
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d950c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d958a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9581
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9581
mov rax, qword [rbp - 8]
jmp 0x2fc4d959f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9554
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x4045a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x00438098], 0
je 0x404658
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.0040ba50
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x004320b0]
call fcn.0040ba50
mov rcx, rsi
mov rdx, qword [0x004320b0]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.0040ba50
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x40466b
xor ecx, ecx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x409210
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov ebx, edx
mov rax, qword [rbp + 0x28]
mov r13d, dword [rax + 0x18]
mov rcx, qword [rbp + 0x28]
call fcn.00409860
mov esi, eax
test sil, sil
jne 0x4093c4
test ebx, ebx
je 0x4093c4
xor edi, edi
test r13d, r13d
jle 0x4092f1
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov dword [rbp + 0x3c], 0
test r13d, r13d
jle 0x4092d5
cmp ebx, 0xffffffff
je 0x409283
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x409283
xor esi, esi
jmp 0x4093c4
mov rax, qword [rbp + 0x28]
cmp dword [rax], 1
jg 0x4092d5
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0
jne 0x4092c3
xor eax, eax
mov ecx, 1
mov rdx, qword [rbp + 0x28]
lock cmpxchg dword [rdx], ecx
test eax, eax
jne 0x4092c3
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov sil, 1
jmp 0x4093c4
lea rcx, [rbp + 0x3c]
call fcn.00408d90
sub r13d, 1
test r13d, r13d
jg 0x40926a
nop
cmp ebx, 0xffffffff
je 0x4092f1
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x4092ef
xor esi, esi
jmp 0x4093c4
sub ebx, eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x40922d
mov edx, ecx
add edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x4092f1
nop
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov rcx, qword [rbp + 0x28]
call fcn.00409470
xor ecx, ecx
mov rdx, rax
mov r8d, ebx
mov rax, qword [0x00438990]
call qword [rax + 0x20]
test eax, eax
sete sil
cmp ebx, 0xffffffff
je 0x409354
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jae 0x409352
sub ebx, eax
jmp 0x409354
xor ebx, ebx
test sil, sil
je 0x409385
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov eax, ecx
test eax, 1
jne 0x409382
mov edx, ecx
sub edx, 2
or edx, 1
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x409359
mov dil, 1
nop
jmp 0x4093a2
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov edx, ecx
sub edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x409385
mov dil, 1
test dil, dil
je 0x409314
nop
test sil, sil
je 0x4093c4
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov eax, esi
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x40af80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x00438098], 0
je 0x40b01a
cmp word [0x004383a8], 0xd7b2
jne 0x40afb3
cmp dword [0x004383b0], 0
jbe 0x40afb3
lea rcx, [0x004383a0]
call qword [0x004383c8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x00433d98]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x0040b050]
call fcn.0040bca0
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x40b03b
cmp byte [0x00432042], 0
jne 0x40b03b
xor ecx, ecx
lea rdx, [0x00433d98]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x40f0f0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x0043cef0]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x0043cf18], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x0043cee8], al
cmp byte [0x0043cee8], 0
je 0x40f18e
lea rcx, [0x0040f194]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040f1ae]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0043ced0], rax
lea rcx, [0x0040f194]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040f1cc]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0043ced8], rax
lea rcx, [0x0040f194]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040f1ea]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0043cee0], rax
add rsp, 0x28
ret
Function at 0x40f430
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x1d8
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov word [rbp + 0x56], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x48]
call fcn.0040b390
movzx rax, word [rbp + 0x56]
cmp word [0x00434520], ax
ja 0x40f506
movzx rax, word [rbp + 0x56]
cmp ax, word [0x00434920]
mov word [rbp + 0x56], ax
ja 0x40f506
mov eax, 0x40
xor ecx, ecx
cmp eax, ecx
jb 0x40f505
mov edx, eax
add edx, ecx
shr edx, 1
mov r8d, edx
lea r9, [0x00434520]
mov r10, r8
add r10, r10
movzx r11, word [rbp + 0x56]
cmp word [r9 + r10*8], r11w
jbe 0x40f4c4
mov eax, edx
sub eax, 1
jmp 0x40f501
lea rcx, [0x00434520]
mov r9, r8
add r9, r9
movzx r10, word [rbp + 0x56]
cmp word [rcx + r9*8], r10w
jae 0x40f4e4
mov ecx, edx
add ecx, 1
jmp 0x40f501
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea rax, [0x00434528]
add r8, r8
mov r8, qword [rax + r8*8]
call fcn.0040f2e0
jmp 0x40f505
cmp eax, ecx
jae 0x40f49a
nop
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0
jne 0x40f5db
movzx rcx, word [rbp + 0x56]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40f5db
movzx rbx, word [rbp + 0x56]
movzx ebx, bx
mov ecx, ebx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
mov ecx, ebx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040bfa0
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.0040bfa0
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040bfa0
mov rcx, qword [rbp + 0x48]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x0040f628]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x0040f638]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.0040c340
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.0040b470
mov rax, qword [rbp + 0x48]
lea rsp, [rbp + 0x1d8]
pop rbx
pop rbp
ret
Function at 0x40f830
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x0043cef0]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x0043cf18], ax
jne 0x40f89a
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0043cf1a]
mov r8d, 0x55
call fcn.0040bfa0
lea rcx, [0x0043cef0]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40f9a3
lea rcx, [0x0043cef0]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.0040b390
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40f95e
cmp byte [0x0043cee8], 0
je 0x40f8f2
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.0040f6d0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.0040b850
jmp 0x40f95e
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.0040f430
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040b850
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x40f95e
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x40f93d
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0040f9e8]
call fcn.0040c150
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.0040f430
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.0040c150
lea rcx, [0x0043cef0]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x0043cf18], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.0040bf00
lea rcx, [0x0043cf1a]
mov edx, 0xaa
mov r8, rax
call fcn.0040f220
lea rcx, [0x0043cef0]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.0040b470
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x410350
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.0040b560
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040bfa0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.0040c210
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
call fcn.004101a0
test al, al
jne 0x41041a
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040bfa0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.0040c210
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
call fcn.004101a0
test al, al
jne 0x41041a
mov rcx, qword [rbp + 0x28]
call fcn.0040b390
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040b470
lea rcx, [rbp + 0x70]
call fcn.0040b390
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret