joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031373
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100313af
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100313af
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100313af
xor eax, eax
cmp dword [ecx + 0x74], 0xe
jbe 0x100313ae
cmp dword [ecx + 0xe8], eax
setne al
ret
xor eax, eax
ret

Function at 0x10068350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x24
mov eax, 0x100da940
call fcn.10021e72
mov ebx, ecx
mov dword [ebp - 0x30], ebx
mov edx, dword [ebx + 0x30]
lea eax, [edx + 1]
mov dword [ebx + 0x30], eax
test edx, edx
jne 0x1006846c
cmp dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x14]
setne al
mov byte [ebp - 0x29], al
cmp dword [ebx + 0x18], edx
jne 0x1006843c
test al, al
sete al
movzx eax, al
push eax
push dword [ebx + 0x28]
push dword [ebx + 0x24]
call fcn.1006ca32
cmp byte [ebp - 0x29], 0
jne 0x10068448
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov ebx, eax
lea ecx, [ebp - 0x28]
push ebx
call fcn.1006ca32
mov edx, dword [ebp - 0x30]
lea edi, [ebp - 0x1c]
push ebx
mov cx, word [eax + 4]
mov word [edx + 0xc], cx
mov ecx, dword [eax]
mov dword [edx + 8], ecx
mov ecx, dword [edx + 0x14]
imul edx, dword [edx + 0x24], 0x34
mov eax, dword [ecx + 0x10]
movzx ecx, word [edx + eax + 0xc]
mov esi, dword [edx + eax]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov word [ebp - 0x18], cx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
call fcn.1006ca32
mov ebx, dword [ebp - 0x30]
push ebx
mov ecx, dword [ebx + 0x14]
call fcn.1006ca32
mov edi, dword [ebx + 0x14]
lea esi, [edi + 0x20]
push esi
mov dword [ebp - 0x30], esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
mov ecx, ebx
mov eax, dword [ebx]
call dword [eax]
imul ecx, dword [ebx + 0x28], 0x34
imul edx, eax, 0x34
mov eax, dword [edi + 0x10]
push ebx
add ecx, 0xc
mov eax, dword [edx + eax + 0x30]
add ecx, eax
call fcn.1006ca32
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10068448
push ebx
add ecx, 0xc4
call fcn.1006ca32
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x70]
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push ebx
push esi
mov dword [ebx + 0x20], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test eax, eax
jne 0x1006846c
call fcn.1006ca32
call fcn.10021eea
ret
Function at 0x1006ca32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1006ca41
pop dword [ebp - 8]
mov eax, 0x874c2884
sub eax, 0x77455e43
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x5fc40
push 0
mov eax, 0x6d1ac79e
add eax, 0xa2f37a02
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xaf9feac6
sub ecx, 0xaf9f991b
xor ebx, ebx
add ebx, eax
mov esi, 0x100ece00
add esi, dword [ebp - 8]
mov edi, 0x86501406
sub dword [ebp - 4], ecx
mov edx, dword [esi]
xor dword [ebp - 4], 0x4282c2b7
add edx, edi
xor dword [ebp - 4], 0x6777b8d9
mov dword [ebx], edx
add ebx, 0x8ba64beb
sub ebx, 0x8ba64be7
add esi, 0xf9f05ac
sub esi, 0xf9f05a8
loop 0x1006ca96
add eax, 0x1397f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xcbe54d6d
sub ecx, 0xbbe54d6d
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x10070f7c
Capabilities:
Get thread local storage value

Disassembly:
push 4
mov eax, 0x100da5f0
call fcn.100157c2
mov ebx, ecx
mov eax, dword [ebx + 0xc]
push dword [eax + 0x70]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1007103b
push 0
pop edi
and eax, 3
je 0x10070fc4
cmp eax, 1
jne 0x10070fcd
and esi, 0xfffffffe
mov esi, dword [esi + 0x10]
add esi, 8
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10070fc4
mov al, byte [eax + 0x44]
test al, al
jne 0x1007103b
mov ecx, esi
call fcn.10068350
jmp 0x10071002
and esi, 0xfffffffd
lea ecx, [esi + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x10], ecx
call dword [eax + 0x10]
mov esi, dword [esi + 0x20]
mov eax, dword [esi + 0x2c]
add esi, 0x10
test eax, eax
je 0x10070ff3
mov al, byte [eax + 0x44]
test al, al
je 0x10070ff3
mov esi, edi
jmp 0x10070ffa
mov ecx, esi
call fcn.10068350
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x14]
test esi, esi
je 0x1007103b
cmp dword [esi + 0x14], ebx
je 0x10071035
push 0x3c
call fcn.1006ca32
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x10071028
push esi
push ebx
mov ecx, eax
call fcn.1006ca32
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.10068350
jmp 0x10071037
mov edi, esi
mov eax, edi
jmp 0x1007103d
xor eax, eax
call fcn.100157f5
ret
Function at 0x10073f6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x100db7e8
call fcn.100157c2
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor esi, esi
mov dword [edi + 8], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], 0x80000000
mov dword [edi + 0x18], esi
mov dword [edi + 0x38], esi
call sym.MSVCR120.dll_public:_void___thiscall_Concurrency::event::constructor_void_
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
call fcn.1006ca32
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x10073fe8
cmp eax, 2
je 0x10073fe8
xor edx, edx
add eax, 4
inc edx
lock xadd dword [eax], edx
mov ecx, edi
call fcn.10074d68
lea ecx, [edi + 0x3c]
call sym.MSVCR120.dll_public:_void___thiscall_Concurrency::event::set_void_
cmp byte [ebp + 0xc], 0
je 0x10074029
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x10074023
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
je 0x10074031
jmp 0x10074012
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.1001ffa7
mov esi, eax
cmp dword [esi + 0x20], 0
jne 0x10074045
mov ecx, esi
call fcn.10065b8a
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.100157f5
ret 8

Function at 0x10075d62
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100de7b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100e3510]
test dword [ebp + 8], eax
je 0x10075dfc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x808]
call fcn.1006ca32
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [0x100dfd60]
pop ecx
test eax, eax
je 0x10075def
push esi
push edi
lea ecx, [ebp - 0x808]
push ecx
push eax
call sym.MSVCR120.dll_fwprintf
mov edi, dword [0x100e3524]
mov esi, dword [0x100e3520]
pop ecx
pop ecx
push 0
push 0x32
push edi
push esi
call fcn.10032225
add esi, 1
mov dword [0x100e3520], esi
adc edi, 0
or eax, edx
mov dword [0x100e3524], edi
pop edi
pop esi
jne 0x10075dfc
push dword [0x100dfd60]
call sym.MSVCR120.dll_fflush
pop ecx
jmp 0x10075dfc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010cbc
mov esp, ebp
pop ebp
ret
Function at 0x10032b10
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10032ca1
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
or ebp, 0xffffffff
jmp 0x10032b3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10032b41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10032b30
mov eax, 1
add ebx, ebx
jne 0x10032b53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10032b48
jne 0x10032b64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10032b48
xor ecx, ecx
sub eax, 3
jb 0x10032b78
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10032bea
mov ebp, eax
add ebx, ebx
jne 0x10032b83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10032b90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10032bb4
inc ecx
add ebx, ebx
jne 0x10032ba0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10032b95
jne 0x10032bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10032b95
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10032bd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10032bc5
jmp 0x10032b36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10032bd4
add edi, ecx
jmp 0x10032b36
pop esi
mov edi, esi
mov ecx, 0xac6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10032bf2
cmp byte [edi], 0xc
jne 0x10032bf2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x10032bf7
lea edi, [esi + 0x2f000]
mov eax, dword [edi]
or eax, eax
je 0x10032c6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x336c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33718]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10032c24
mov ecx, edi
jns 0x10032c53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3371c]
or eax, eax
je 0x10032c69
mov dword [ebx], eax
add ebx, 4
jmp 0x10032c41
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10032ca0
cmp al, 0xef
ja 0x10032c93
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10032c75
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10032c82
popal
jmp 0x1001765d
Function at 0xc2b3bb
Capabilities:
Encode data using xor

Disassembly:
clc
add eax, 0x39a49e19
bts cx, sp
bts ecx, esp
stosd dword es:[edi], eax
loope 0xc235ab
sbb ecx, edi
stc
clc
rol cl, 7
add ebx, eax
btc cx, ax
mov dword [ebp - 8], 0
pushal
pushfd
not ch
setg cl
mov ecx, dword [edx + 0x18]
pushal
cmp ecx, dword [ebp - 8]
call fcn.00c26ba2
imul edi, ebx, 0xffffff84
jl 0xc2357a
and byte [0xd188fbc4], ah
mov esi, 0x8e96d139
cdq
pop eax
push ebx
fst dword [eax + 0x62]
pop ebx
jle 0xc2358e
popfd
cdq
dec edx
loopne 0xc235d4
invalid
aas
mov dl, 0x70
jae 0xc2358f
cmp dword [esp + edx - 0x38879ae9], 0xffffffc7
pop esp
jecxz 0xc235d0
js 0xc2365b
add eax, 0xb51399c0
sbb eax, 0xec577d37
cmc
or eax, 0x603f192
jg 0xc23632
hlt
sbb bh, byte [esp + ecx*2 + 0x25]
push esi
push 0x47
pop ebp
cli
xchg ebp, eax
adc eax, dword [edx + 0x7b3d3533]
add eax, 0xe44a1425
xchg edi, eax
sbb ah, bh
ret
into
outsb dx, byte [esi]
int 0xdc
inc edi
fist word [0xbcfbe694]
int3
mov ebx, dword [edx + 0x20]
xor cl, 0x1d
pop ecx
jnp 0xc2358d
rcl ch, 1
add ebx, eax
test bl, bl
cmp bl, 0xcb
pushal
sbb cl, bh
mov dword [ebp - 8], 0
rcr cl, cl
mov ecx, dword [edx + 0x18]
add esp, 0x20

Function at 0xcd1860
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jae 0xc3e6b0
rcl ebx, 9
stc
mov ebx, eax
bt esi, ebx
rcr ecx, cl
mov edi, eax
sub cl, 0x88
mov ecx, 0x104
pushfd
cmp eax, 0x26fe63c4
xor al, al
pushfd
repne scasb al, byte es:[edi]
pushal
call int.00cd988d
sbb dword [ecx], edx
and bh, byte [edi]
cli
mov dl, 0xae
stosd dword es:[edi], eax
add al, 0x8f
stc
sbb dword [esi - 0x6852eeb8], esi
sahf
loop 0xc2bfec
iretd
pop ss
in al, dx
nop
movlps xmm7, qword [esi - 0x4e]
pop ds
invalid
mov byte [esp], 0x6a
pushfd
jmp 0xc2bf4f

Function at 0xcd7cec
Capabilities:
Encode data using xor

Disassembly:
bound esp, qword [esi]
push ebx
mov cl, 0x88
pop esp
ret
sub al, 0x30
pushal
test si, si
push edx
call fcn.00cd25fb
sbb esi, dword [edx]
jbe 0xcd7d58
pop edi
in eax, 0xe4
popfd
in eax, 0xe3
and edi, edi
js 0xcd7d19
mov dword [0xa69da18b], eax
adc ebp, dword [eax - 0x709502c4]
xor al, 0xc
dec ebx
fmul st(1)
mov esi, 0xcddea7a1
mov eax, dword [0xf8cddea7]
fmulp st(5)
clc
jnp 0xcd7d0b
xchg ecx, eax
arpl word [ebx - 2], sp
lds ecx, [ebx + 0x58]
and al, 0xe0
xlatb
call [ebp - 0x113d21a2]
insd dword es:[edi], dx
aas
mov es, word [ebp + 0x17154dc5]
sti
adc byte [ebx - 0x5d93a20a], dh
and eax, 0x39010c00
jbe 0xcd7d26
jb 0xcd7cc9
std
loopne 0xcd7db3
fst dword [ecx - 0x14]
std
cmp esi, dword [ebx]
jo 0xcd7d17
jg 0xcd7d99
jl 0xcd7daa
imul ebp, edi, 0xfa31a94a
mov cl, 0xf3
dec edx
test eax, 0xf3b1fa31
xor byte [ebx + ecx*4], dh
jp 0xcd7d67
cmp dword [ecx + 0x5ed15db0], 0x62
rcr dword [esi + 0x62], 1
iretd
push cs
lahf
movsd dword es:[edi], dword [esi]
invalid
cmp al, 0x8e
out 5, eax
cmp al, 0xa9
test ecx, eax
aaa
jne 0xcd7dc0
faddp st(1)
inc edx
ret
sbb ah, ch
mov esp, 0x7eebc1c6
Function at 0xcd800e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edx, edx
pushal
jmp 0xc38ec7
jmp 0xc2446a
pushfd
sub ecx, dword [edx + 0x10]
cmc
jmp 0xc33859
bts cx, ax
add edx, eax
sbb ch, al
bt ebp, ecx
setg cl
cmc
mov ecx, dword [esi + 0x7c]
cmp dl, 0x75
pushal
add ecx, edx
pushal
mov dword [ebp - 0x10], ecx
neg ch
cmc
sbb cl, ah
cmc
mov ecx, dword [ebp + 0xc]
push 0xbfaeccc0
stc
push 0xcedc14a6
cmp ecx, 0xffff
pushfd
pushfd
lea esp, [esp + 0x50]
jbe 0xc28895
shl di, cl
btr cx, 5
mov edi, dword [edx + 0x24]
sbb bh, cl
sbb cx, si
bsr cx, cx
add edi, eax
pushfd
pop ebx
call fcn.00c2b3bb
push ebx
not al
pushfd
lea eax, [0xc38efe]
mov word [esp], cx
mov word [esp], si
call fcn.00cd1a46
bt esp, ebx
clc
cmp ecx, dword [edx + 0x14]
mov word [esp], 0x46f4
pushfd
push dword [esp + 4]
lea esp, [esp + 0xc]
jae 0xc3e6a9
pushal
mov byte [esp + 4], 0x7c
pushfd
push edi
lea esp, [esp + 0x28]
jmp 0xcd5ea4
lea esp, [esp + 0x24]
je 0xc3e6a9
add cx, 0xc25a
cmc
mov cl, al
movzx cx, dl
add edx, eax
shld ecx, edx, cl
shl cl, cl
mov ecx, dword [esi + 0x7c]
pushal
call fcn.008d5988
xchg edx, eax
ljmp 0xfb82
jmp 0xc37336
ror di, cl
bts di, bx
sar di, 1
mov edi, dword [edx + 0x1c]
pushfd
mov byte [esp], dh
add edi, eax
stc
mov byte [esp], 0x8b
mov edi, dword [edi + ecx*4]
mov byte [esp], 0xe5
call fcn.00c3b36d
rcr dl, cl
add esi, eax
add dh, dl
sbb dh, 0x15
mov dh, 0x23
mov edx, dword [esi + 0x78]
stc
push esp
jmp 0xc24d2c
inc al
stc
push ebp
test dl, ah
xadd bp, ax
mov ax, si
bt esi, 8
mov ebp, esp
inc ax
rcr ah, 4
sub esp, 0x18
or al, 0x92
add ah, 0xaa
dec ax
bsf eax, edx
push esi
ror eax, cl
pushal
bswap ax
mov dword [esp + 0x1c], edi
or al, al
add ax, bp
aaa
btc eax, 0x13
mov dword [esp + 0x18], ebx
aam 0xb1
mov dword [esp + 0x14], edx
inc ax
mov eax, dword [ebp + 8]
push edi
pushal
clc
test eax, eax
pushfd
lea esp, [esp + 0x3c]
je 0xc3e6a9
stc
mov esi, dword [eax + 0x3c]
adc dh, 0x31
cmp dh, 0x5f
btc edx, 0x13
ja 0xcd67bd
add esi, eax
not dl
mov edx, dword [esi + 0x78]
pushal
test edx, edx
pushal
lea esp, [esp + 0x40]
je 0xc3e6a9
cmp dl, 0x8e
shrd cx, dx, cl
jmp 0xc29a0b

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x4045cc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407218
test esi, esi
jne 0x404604
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00407354
jmp 0x404622
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404510
mov edi, eax
test esi, esi
je 0x404622
cmp dword [ebx], 0
je 0x404622
dec esi
jmp 0x40460b
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4064e4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x54f050], 0
je 0x406545
cmp word [0x54f32c], 0xd7b2
jne 0x40650d
cmp dword [0x54f334], 0
jbe 0x40650d
mov eax, 0x54f328
call dword [0x54f344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406570
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x54a030], 0
jne 0x406561
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4066f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x54a038], 0
je 0x406716
mov edx, esi
mov eax, ebx
call dword [0x54a038]
jmp 0x406725
mov eax, 8
call fcn.00404220
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x54f051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4066b8
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4090dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x409243
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00407218
cmp si, word [0x54a7e0]
jb 0x409176
cmp si, word [0x54a9e0]
ja 0x409176
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x409176
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x54a7e0]
jae 0x409150
mov edi, ebx
dec edi
jmp 0x409171
cmp si, word [ebx*8 + 0x54a7e0]
jbe 0x409160
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x409171
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x54a7e4]
call fcn.00408fec
jmp 0x409176
cmp edi, dword [ebp - 0xc]
jae 0x40913a
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x409225
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x409225
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00407428
push dword [ebp - 0x164]
push 0x409260
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00407428
push dword [ebp - 0x168]
push 0x409270
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00407428
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.004077e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40924a
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00407210
ret
Function at 0x4093fc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409501
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x551b58
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x551b70]
jne 0x409448
mov eax, esi
mov edx, 0x551b74
mov ecx, 0x55
call fcn.00407428
push 0x551b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4094eb
push 0x551b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00407218
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4094b9
cmp byte [0x551b54], 0
je 0x40947e
mov edx, esi
mov eax, ebx
call fcn.004092dc
jmp 0x4094b9
mov edx, esi
mov eax, ebx
call fcn.004090dc
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4094b9
cmp dword [esi], 0
je 0x4094a2
mov eax, esi
mov edx, 0x40951c
call fcn.0040763c
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004090dc
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040763c
push 0x551b58
call sub.kernel32.dll_EnterCriticalSection
mov word [0x551b70], bx
push 0xaa
mov eax, dword [esi]
call fcn.004072a4
push eax
push 0x551b74
call sub.kernel32.dll_lstrcpynW
push 0x551b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409508
lea eax, [ebp - 4]
call fcn.00407208
ret
Function at 0x409740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407200
xor eax, eax
push ebp
push 0x409925
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x409780
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40979a
push 0x105
mov eax, dword [ebp - 4]
call fcn.004072a4
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40990f
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409934
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409829
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409934
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409829
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409968
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409829
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40999c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40990f
xor eax, eax
push ebp
push 0x409908
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00409544
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409898
mov eax, dword [ebp - 0x10]
call fcn.00404220
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004073d4
jmp 0x4098e3
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x4099dc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4098e3
mov eax, dword [ebp - 0x10]
call fcn.00404220
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x4099dc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004073d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40990f
cmp dword [ebp - 8], 0
je 0x4098fe
mov eax, dword [ebp - 8]
call fcn.0040423c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40992c
lea eax, [ebp - 4]
call fcn.00407208
ret