joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801092a0
Capabilities:
Reference wmi statements

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov r15, qword [rdx + 0x10]
test r15, r15
je 0x180109377
lea rcx, [0x1801e6e8a]
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov rcx, r14
call sub.oleaut32.dll_SysFreeString
test ebp, ebp
js 0x180109377
mov rbx, qword [rsp + 0x30]
cmp qword [rsi + 0x20], 0
je 0x180109343
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x180109343
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x1801093e0
mov qword [rdi], 2
mov rcx, qword [rsi + 0x28]
cmp qword [rsi + 0x20], 0
mov qword [rsi + 0x20], 0
je 0x18010939c
test rcx, rcx
je 0x18010939c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 0x10], 0
test r15, r15
je 0x1801093b8
test rcx, rcx
je 0x1801093b8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
je 0x1801093d4
test rcx, rcx
je 0x1801093d4
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rsi + 0x30], 0
je 0x1801093e0
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1801095d0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x180109605
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x18010960a
call fcn.180108800
mov ecx, dword [0x180221a34]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0xa8], 1
mov qword [rcx + 0xb0], rax
mov qword [rcx + 0xb8], rdx
add rsp, 0x38
ret
Function at 0x1801149e0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x180114b32
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd rbp, dword [rsp + 0x24]
mov qword [rsp + 0x28], 8
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
test rbp, rbp
je 0x180114b11
shl rbp, 3
mov esi, 8
xor r15d, r15d
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x78]
xor r12d, r12d
jmp 0x180114a8c
lea rax, [r12 + r12*2]
mov rcx, qword [rsp + 0x70]
mov qword [rsi + rax*8 + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + rax*8], xmm0
inc r12
mov qword [rsp + 0x38], r12
add r15, 8
cmp rbp, r15
je 0x180114b11
mov r13, qword [rdi + r15]
mov rcx, r13
call fcn.180178c14
lea rax, [rax*2]
add rax, r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], rax
mov word [rsp + 0x88], 0
mov qword [rsp + 0x48], 1
lea rax, [rsp + 0x50]
movups xmmword [rax], xmm6
mov rcx, rbx
mov rdx, r14
call fcn.1801103d0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
cmp r12, qword [rsp + 0x30]
jne 0x180114a60
lea rcx, [rsp + 0x28]
mov rdx, r12
call fcn.180114c90
mov rsi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
jmp 0x180114a60
mov rcx, rdi
call qword [sym.imp.kernel32.dll_LocalFree]
movups xmm0, xmmword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x10], rax
jmp 0x180114b40
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180120450
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18012065d
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x1802219d0]
test rcx, rcx
jne 0x1801204c0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18012065d
mov rcx, qword [rsp + 0x20]
mov qword [0x1802219d0], rcx
test rcx, rcx
je 0x180120662
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x1801204d6
mov rax, r14
xor edx, edx
div rcx
jmp 0x1801204dd
mov eax, r14d
xor edx, edx
div ecx
imul r9, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x180120501
xor edx, edx
div rcx
mov r8, rax
jmp 0x180120508
xor edx, edx
div ecx
mov r8d, eax
add r8, r9
mov rcx, r8
shr rcx, 9
movabs r14, 0x44b82fa09b5a53
mov rax, rcx
mul r14
mov r9, rdx
shr r9, 0xb
add r9, rbx
jb 0x18012055a
mov rax, rcx
mul r14
shr rdx, 0xb
imul eax, edx, 0x3b9aca00
sub r8d, eax
add r8d, edi
cmp r8d, 0x3b9aca00
jb 0x180120624
inc r9
jne 0x180120654
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18012065d
mov rdi, qword [rsp + 0x20]
mov rcx, qword [0x1802219d0]
test rcx, rcx
jne 0x1801205b8
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18012065d
mov rcx, qword [rsp + 0x20]
mov qword [0x1802219d0], rcx
test rcx, rcx
je 0x180120662
mov rax, rdi
or rax, rcx
shr rax, 0x20
je 0x1801205ce
mov rax, rdi
xor edx, edx
div rcx
jmp 0x1801205d4
mov eax, edi
xor edx, edx
div ecx
imul r9, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x1801205f8
xor edx, edx
div rcx
mov r8, rax
jmp 0x1801205ff
xor edx, edx
div ecx
mov r8d, eax
add r8, r9
mov rax, r8
shr rax, 9
mul r14
mov r9, rdx
shr r9, 0xb
imul eax, r9d, 0x3b9aca00
sub r8d, eax
add r9, 0x38640900
mov eax, r8d
shr eax, 9
imul rax, rax, 0x44b83
shr rax, 0x27
imul eax, eax, 0x3b9aca00
sub r8d, eax
mov rcx, rsi
mov rdx, r9
call fcn.18011fc60
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
add r8d, 0xc4653600
jmp 0x180120624
call sub.kernel32.dll_GetLastError
ud2
Function at 0x18012c890
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x18012c8d8
lea rcx, [rsp + 0x30]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x18012c96a
movdqa xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x26]
movzx ecx, byte [rsp + 0x28]
and cl, 0x3f
or cl, 0x80
movzx edx, byte [rsp + 0x2a]
shl edx, 8
movzx r8d, byte [rsp + 0x29]
or r8d, edx
movzx ecx, cl
shl ecx, 8
movzx edx, byte [rsp + 0x27]
or edx, ecx
movd xmm1, edx
pinsrw xmm1, r8d, 1
mov ecx, dword [rsp + 0x2c]
shl ecx, 8
movzx edx, byte [rsp + 0x2b]
or edx, ecx
pinsrw xmm1, edx, 2
movzx ecx, byte [rsp + 0x2e]
shl ecx, 8
movzx edx, byte [rsp + 0x2d]
or edx, ecx
pinsrw xmm1, edx, 3
movzx ecx, byte [rsp + 0x2f]
and al, 0xf
or al, 0x40
movd dword [rsi], xmm0
pextrw edx, xmm0, 2
mov word [rsi + 4], dx
mov byte [rsi + 6], al
mov byte [rsi + 0xf], cl
movq qword [rsi + 7], xmm1
add rsp, 0x40
pop rsi
ret
ud2
Function at 0x18012d450
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov qword [rsp + 0x48], 0
lea r14, [rsp + 0x48]
mov qword [rsp + 0x20], r14
lea rcx, [0x18020a5c8]
lea r9, [0x18020a5ac]
xor ebx, ebx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18012d555
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x18012d56c
lea rcx, [0x18020a5bc]
mov edx, 0xa
call fcn.18012ce70
mov rbx, rax
mov qword [rsp + 0x48], 0
mov rax, qword [rdi]
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
xor r15d, r15d
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
test eax, eax
js 0x18012d574
mov r14, qword [rsp + 0x48]
test r14, r14
je 0x18012d58c
test rbx, rbx
je 0x18012d514
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x18012d5b6
mov qword [rsi + 8], r14
mov byte [rsi], 0x11
jmp 0x18012d5a0
mov ecx, eax
call fcn.18012cba0
mov ebx, edx
test rax, rax
je 0x18012d56c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov byte [rsi], 0
mov dword [rsi + 4], ebx
jmp 0x18012d5a9
mov ecx, eax
call fcn.18012cba0
mov r15d, edx
test rax, rax
je 0x18012d58c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
test rbx, rbx
je 0x18012d599
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov byte [rsi], 0
mov dword [rsi + 4], r15d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, eax
call fcn.18012cba0
mov ebx, edx
test rax, rax
je 0x18012d5cd
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov byte [rsi], 0
mov dword [rsi + 4], ebx
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
jmp 0x18012d5a0
Function at 0x180149f80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
cmp rbx, 0x20
jb 0x18014a05d
mov rdx, qword [rcx + 8]
mov r9, qword [rcx + 0x18]
mov rax, rdx
mov r8, qword [rcx + 0x10]
mov r11, r9
mov r10, qword [rcx + 0x20]
rol r11, 0xc
rol rax, 1
add r11, rax
mov qword [rsp + 0x30], rsi
movabs rsi, 0x9e3779b185ebca87
mov qword [rsp + 0x38], rdi
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, r8
rol rax, 7
add r11, rax
mov rax, r10
imul rdx, rdi
imul r8, rdi
imul r10, rdi
imul r9, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
imul rdx, rsi
movabs rax, 0x7a1435883d4d519d
rol r8, 0x1f
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r8, rsi
imul r10, rsi
sub r11, rax
rol r9, 0x1f
xor r11, r8
imul r11, rsi
imul r9, rsi
sub r11, rax
xor r11, r9
imul r11, rsi
sub r11, rax
xor r11, r10
movabs r10, 0x85ebca77c2b2ae63
imul r11, rsi
mov rsi, qword [rsp + 0x30]
add r10, r11
jmp 0x18014a06e
mov r10, qword [rcx + 0x18]
movabs rdx, 0x27d4eb2f165667c5
add r10, rdx
add r10, rbx
lea rdx, [rcx + 0x28]
mov rcx, r10
xor r9d, r9d
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.180149e80
Function at 0x18017c6cc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18017c6fc
xor eax, eax
jmp 0x18017c7bf
mov rbp, rbx
cmp word [rax], si
je 0x18017c721
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18017c708
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18017c704
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18017c61c
movsxd r14, eax
test eax, eax
jne 0x18017c75f
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x18017c6f5
mov rcx, r14
call fcn.180179f6c
mov rdi, rax
test rax, rax
jne 0x18017c778
xor ecx, ecx
call fcn.180179eb8
jmp 0x18017c754
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18017c61c
test eax, eax
jne 0x18017c7a9
mov rcx, rdi
call fcn.180179eb8
jmp 0x18017c7b3
xor ecx, ecx
call fcn.180179eb8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180181e40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180181e68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180181e68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x40c270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov ebx, edx
mov rax, qword [rbp + 0x28]
mov r13d, dword [rax + 0x18]
mov rcx, qword [rbp + 0x28]
call fcn.0040c8d0
mov esi, eax
test sil, sil
jne 0x40c432
test ebx, ebx
je 0x40c432
xor rdi, rdi
test r13d, r13d
jle 0x40c357
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov dword [rbp + 0x3c], 0
test r13d, r13d
jle 0x40c336
cmp ebx, 0xffffffff
je 0x40c2e3
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x40c2e3
xor rsi, rsi
jmp 0x40c432
mov rax, qword [rbp + 0x28]
cmp dword [rax], 1
jg 0x40c336
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0
jne 0x40c324
xor eax, eax
mov ecx, 1
mov rdx, qword [rbp + 0x28]
lock cmpxchg dword [rdx], ecx
test eax, eax
jne 0x40c324
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov sil, 1
jmp 0x40c432
lea rcx, [rbp + 0x3c]
call fcn.0040be20
sub r13d, 1
test r13d, r13d
jg 0x40c2ca
nop
cmp ebx, 0xffffffff
je 0x40c357
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jb 0x40c352
xor rsi, rsi
jmp 0x40c432
sub eax, r14d
sub ebx, eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x40c28d
mov edx, ecx
add edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40c357
nop
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov rcx, qword [rbp + 0x28]
call fcn.0040c4e0
xor rcx, rcx
mov rdx, rax
mov r8d, ebx
mov rax, qword [0x008a59a0]
call qword [rax + 0x20]
test eax, eax
sete sil
cmp ebx, 0xffffffff
je 0x40c3c1
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jae 0x40c3be
sub eax, r14d
sub ebx, eax
jmp 0x40c3c1
xor rbx, rbx
test sil, sil
je 0x40c3f3
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov eax, ecx
test eax, 1
jne 0x40c3f0
mov edx, ecx
sub edx, 2
or edx, 1
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40c3c6
mov dil, 1
nop
jmp 0x40c410
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov edx, ecx
sub edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x40c3f3
mov dil, 1
test dil, dil
je 0x40c37a
nop
test sil, sil
je 0x40c432
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov eax, esi
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x40e130
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x008a50a8], 0
je 0x40e1ce
cmp word [0x008a53b8], 0xd7b2
jne 0x40e163
cmp dword [0x008a53c0], 0
jbe 0x40e163
lea rcx, [0x008a53b0]
call qword [0x008a53d8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x00846a18]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x0040e204]
call fcn.0040f4b0
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x40e1f0
cmp byte [0x00845052], 0
jne 0x40e1f0
xor rcx, rcx
lea rdx, [0x00846a18]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x40e4d0
Capabilities:
Create thread

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov ebx, edx
mov rsi, r8
mov rdi, r9
cmp qword [0x00845058], 0
je 0x40e501
mov rcx, rsi
mov rdx, rdi
call qword [0x00845058]
mov r13, rax
jmp 0x40e517
mov ecx, 0x10
call fcn.00408d40
mov r13, rax
mov qword [r13], rsi
mov qword [r13 + 8], rdi
mov byte [0x008a50a9], 1
mov rcx, qword [rsp + 0x38]
mov edx, ebx
lea r8, [0x0040e460]
mov r9, r13
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov rbx, rax
test rbx, rbx
jne 0x40e55c
mov rcx, r13
call fcn.00408d70
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x4128d0
Capabilities:
Get geographical location

Disassembly:
push rbp
sub rsp, 0x1d0
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], rdx
mov word [rbp + 0x4e], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
call fcn.0040e6e0
movzx rax, word [rbp + 0x4e]
cmp word [0x00847138], ax
ja 0x4129b8
movzx rax, word [rbp + 0x4e]
cmp ax, word [0x00847538]
mov word [rbp + 0x4e], ax
ja 0x4129b8
mov ecx, 0x40
xor r8, r8
cmp ecx, r8d
jb 0x4129b7
mov eax, ecx
add eax, r8d
mov r9d, 2
xor edx, edx
div r9d
lea rdx, [0x00847138]
mov r9d, eax
add r9, r9
movzx r10, word [rbp + 0x4e]
cmp word [rdx + r9*8], r10w
jbe 0x412971
mov ecx, eax
sub ecx, 1
jmp 0x4129b2
lea rdx, [0x00847138]
mov r8d, eax
add r8, r8
movzx r9, word [rbp + 0x4e]
cmp word [rdx + r8*8], r9w
jae 0x412993
mov r8d, eax
add r8d, 1
jmp 0x4129b2
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
lea r8, [0x00847140]
mov eax, eax
add rax, rax
mov r8, qword [r8 + rax*8]
call fcn.00412760
jmp 0x4129b7
cmp ecx, r8d
jae 0x412940
nop
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0
jne 0x412a9a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x412a9a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040fb40
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.0040fb40
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040fb40
mov rcx, qword [rbp + 0x40]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x00412af4]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x00412b04]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.0040ffc0
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.0040e7c0
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x1d0]
pop rbp
ret
Function at 0x412d10
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x008a9e70]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x008a9e98], ax
jne 0x412d7b
mov rcx, qword [rbp + 0x28]
lea rdx, [0x008a9e9a]
mov r8d, 0x55
call fcn.0040fb40
lea rcx, [0x008a9e70]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x412e86
lea rcx, [0x008a9e70]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.0040e6e0
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x412e40
cmp byte [0x008a9e68], 0
je 0x412dd4
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.00412ba0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.0040ed30
jmp 0x412e40
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.004128d0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040ed30
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x412e40
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x412e1f
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00412ed4]
call fcn.0040fdb0
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.004128d0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.0040fdb0
lea rcx, [0x008a9e70]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x008a9e98], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.0040fa70
lea rcx, [0x008a9e9a]
mov edx, 0xaa
mov r8, rax
call fcn.00412680
lea rcx, [0x008a9e70]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.0040e7c0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x4138b0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.0040e870
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040fb40
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.0040fea0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.004136d0
test al, al
jne 0x41397e
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040fb40
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.0040fea0
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.004136d0
test al, al
jne 0x41397e
mov rcx, qword [rbp + 0x20]
call fcn.0040e6e0
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040e7c0
lea rcx, [rbp + 0x70]
call fcn.0040e6e0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret