joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x419d20
push 0x67
push esi
call edi
push 0x64
push 0x419c58
push 0x6d
push esi
call edi
mov eax, esi
call fcn.004011a0
push 0
push esi
push 0
push 0
push 0
push closesocket
push 0
push closesocket
push 0xcf0000
push 0x419d20
push 0x419c58
push 0
mov dword [0x419de8], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401092
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00405794
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
push 0x419070
call fcn.00402b10
add esp, 4
call fcn.00402080
test eax, eax
je 0x4010cb
call fcn.00403620
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004012f0
test eax, eax
je 0x40107a
call fcn.004014b0
mov eax, dword [0x41a688]
test eax, eax
jbe 0x401106
cmp word [0x41a68c], 0
jbe 0x401106
push 0x41907c
push eax
call fcn.00404280
mov ax, word [0x41a68c]
add esp, 8
mov word [0x41908c], ax
xor eax, eax
jmp 0x401110
movzx ecx, word [eax + 0x415c38]
mov word [eax + 0x41abc0], cx
add eax, 2
test cx, cx
jne 0x401110
call fcn.00404330
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x12]
push edx
mov word [esp + 0x14], cx
call fcn.004092b0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41abc0
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.004057a3
add esp, 0xc
push 0x1f4
call esi
push 1
push 0
push 0x415c50
lea edx, [esp + 0x14]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4012f0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x1e0
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x1d8], eax
push ebx
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x1a2]
push ecx
mov word [esp + 0x1a4], ax
call fcn.004092b0
lea edx, [esp + 0x1a4]
add esp, 0xc
push edx
call fcn.00403ad0
add esp, 4
xor eax, eax
jmp 0x401340
movzx ecx, word [esp + eax + 0x198]
mov word [eax + 0x419df0], cx
add eax, 2
test cx, cx
jne 0x401340
push 0x419df0
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x40138c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1d8]
xor ecx, esp
call fcn.00405794
add esp, 0x1e0
ret
push 0x419df0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x401374
lea eax, [esp + 8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, 0x41a7c0
call fcn.00401d40
test eax, eax
jne 0x401460
jmp 0x4013d0
movzx ecx, word [eax + 0x415c54]
mov word [eax + 0x41a968], cx
add eax, 2
test cx, cx
jne 0x4013d0
push 0x415c60
push 0x40
push 0x41a7c4
call fcn.00405820
add esp, 0xc
push 0x415c80
push 0x10
push 0x41a846
call fcn.00405820
add esp, 0xc
push 0x415c8c
push 0x40
push 0x41a866
call fcn.00405820
mov ecx, 0x51
mov edx, 0x2b8e
add esp, 0xc
mov word [0x41a844], cx
mov word [0x41a8e6], dx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x415cac]
mov word [eax + 0x41a948], cx
add eax, 2
test cx, cx
jne 0x401440
mov dword [0x41a988], 5
call fcn.00403be0
push 0x415c8c
call fcn.00403d00
add esp, 4
mov dword [0x41a688], eax
call fcn.00401960
push 0
push 0
push 0
push 0x401770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x1dc]
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00405794
add esp, 0x1e0
ret
Function at 0x401ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x414
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21e]
push ecx
xor ebx, ebx
mov word [esp + 0x220], ax
call fcn.004092b0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.004092b0
add esp, 0x18
push 0x104
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x415d78
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
xor edx, edx
push 0x415dbc
push ecx
mov word [esp + 0x228], dx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x401b86
mov ebx, 1
push 0x415dc8
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x415dbc
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x401bb1
or ebx, 2
push 0x415e10
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x415dbc
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x401bdc
or ebx, 4
push 0x415e60
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x415dbc
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x401c0a
or ebx, 0x100
push 0x415eb8
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x415dbc
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x401c38
or ebx, 0x200
push 0x415f10
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push 0x415dbc
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
cmp eax, 0xffffffff
je 0x401c66
or ebx, 0x400
mov ecx, dword [esp + 0x41c]
pop edi
mov eax, ebx
pop esi
pop ebx
xor ecx, esp
or eax, 0x2000000
call fcn.00405794
add esp, 0x414
ret
Function at 0x401de0
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
xor ebx, ebx
cmp edi, ebx
je 0x401ef3
cmp esi, ebx
je 0x401ef3
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401e10
sub eax, edx
sar eax, 1
je 0x401ef3
push 0x206
lea ecx, [esp + 0xe]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x14], ax
call fcn.004092b0
add esp, 0xc
cmp dword [esp + 0x218], ebx
jne 0x401e7a
cmp dword [0x419070], 3
jne 0x401e7a
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x415fd0
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.004057a3
add esp, 0xc
jmp 0x401e8a
lea edx, [esp + 8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004057a3
push 0x415fd4
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
call fcn.00405af5
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, ebx
je 0x401ef3
push eax
push 1
push 0x200
push edi
call fcn.00405de8
mov eax, dword [esp + 0x14]
push eax
call fcn.00405e7c
add esp, 0x14
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00405794
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00405794
add esp, 0x210
ret

Function at 0x401fb0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0xe]
xor eax, eax
push edi
push ecx
mov word [esp + 0x14], ax
call fcn.004092b0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x402062
lea edx, [esp + 8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x415fb4
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004057a3
push 0x415ff4
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00405af5
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x402047
push eax
push 1
push 0x200
push esi
call fcn.0040605a
mov eax, dword [esp + 0x14]
push eax
call fcn.00405e7c
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00405794
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00405794
add esp, 0x210
ret
Function at 0x402950
Capabilities:
Delete file

Disassembly:
sub esp, 0x414
mov eax, dword [0x41804c]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x212]
push ecx
mov word [esp + 0x214], ax
call fcn.004092b0
add esp, 0xc
push 0x200
xor esi, esi
lea edx, [esp + 0xc]
push esi
push edx
call fcn.004092b0
add esp, 0xc
lea ebx, [esp + 8]
call fcn.00401f10
test eax, eax
je 0x402a96
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x415c8c]
mov word [eax + 0x41a4b8], cx
add eax, 2
test cx, cx
jne 0x4029b0
xor eax, eax
jmp 0x4029d0
movzx ecx, word [esp + eax + 0x8e]
mov word [eax + 0x41a3b0], cx
add eax, 2
test cx, cx
jne 0x4029d0
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0xc]
mov word [eax + 0x41a430], cx
add eax, 2
test cx, cx
jne 0x4029f0
cmp dword [0x419070], 3
mov ax, word [esp + 0x8c]
mov cx, word [esp + 0x12e]
mov word [0x41a4b0], ax
mov word [0x41a538], cx
mov dword [0x41a53c], 5
je 0x402a40
lea edx, [esp + 0x208]
push edx
push 1
jmp 0x402a4a
lea eax, [esp + 0x208]
push eax
push 0
call fcn.00403430
add esp, 8
push 0x415fdc
lea ecx, [esp + 0x20c]
push 0x104
push ecx
call fcn.004057a3
add esp, 0xc
lea edx, [esp + 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.00405794
add esp, 0x414
ret
mov ecx, dword [esp + 0x414]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00405794
add esp, 0x414
ret

Function at 0x402b10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x41804c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
xor ecx, ecx
mov word [ebp - 0x134], cx
push 0x11c
push 0
lea edx, [ebp - 0x130]
push edx
call fcn.004092b0
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402bd2
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 4], edx
mov ax, word [ebp - 0x1c]
mov word [ebp - 0x134], ax
cmp dword [ebp - 8], 5
jne 0x402bac
cmp dword [ebp - 4], 2
jae 0x402ba3
cmp dword [ebp - 4], 1
jne 0x402bac
mov ecx, dword [ebp + 8]
mov dword [ecx], 3
cmp dword [ebp - 8], 6
jne 0x402bd2
cmp dword [ebp - 4], 0
jne 0x402bc3
mov edx, dword [ebp + 8]
mov dword [edx], 4
jmp 0x402bd2
cmp dword [ebp - 4], 1
jne 0x402bd2
mov eax, dword [ebp + 8]
mov dword [eax], 5
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00405794
mov esp, ebp
pop ebp
ret
Function at 0x404c50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x404c84
jmp 0x404d40
mov dword [ebp - 0x18], 0
jmp 0x404c96
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0x10]
jge 0x404cb3
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x18]
movzx ecx, byte [eax]
not ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x18]
mov byte [edx], cl
jmp 0x404c8d
mov eax, dword [ebp + 0x10]
add eax, 7
push eax
call fcn.00406aaf
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
movzx edx, word [ebp + 0x10]
add edx, 5
mov eax, dword [ebp - 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov edx, dword [0x419074]
mov dword [ecx], edx
mov al, byte [0x419078]
mov byte [ecx + 4], al
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
add eax, 7
push eax
call fcn.00409e70
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 7
mov dword [ebp + 0x10], ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x404d35
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
je 0x404d39
jmp 0x404d40
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 0
je 0x404d58
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00406e7a
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4101cf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040af34
and dword [ebp - 4], 0
cmp dword [0x419b2c], 0
mov ebx, eax
jne 0x410280
push 0x414b90
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410331
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x414b84
push edi
call esi
test eax, eax
je 0x410331
push eax
call fcn.0040aec2
mov dword [esp], 0x414b74
push edi
mov dword [0x419b2c], eax
call esi
push eax
call fcn.0040aec2
mov dword [esp], 0x414b60
push edi
mov dword [0x419b30], eax
call esi
push eax
call fcn.0040aec2
mov dword [esp], 0x414b44
push edi
mov dword [0x419b34], eax
call esi
push eax
call fcn.0040aec2
pop ecx
mov dword [0x419b3c], eax
test eax, eax
je 0x410280
push 0x414b2c
push edi
call esi
push eax
call fcn.0040aec2
pop ecx
mov dword [0x419b38], eax
mov eax, dword [0x419b38]
cmp eax, ebx
je 0x4102d8
cmp dword [0x419b3c], ebx
je 0x4102d8
push eax
call fcn.0040af3d
push dword [0x419b3c]
mov esi, eax
call fcn.0040af3d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4102d8
test edi, edi
je 0x4102d8
call esi
test eax, eax
je 0x4102cf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4102cf
test byte [ebp - 0xc], 1
jne 0x4102d8
or dword [ebp + 0x10], 0x200000
jmp 0x410311
mov eax, dword [0x419b30]
cmp eax, ebx
je 0x410311
push eax
call fcn.0040af3d
pop ecx
test eax, eax
je 0x410311
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410311
mov eax, dword [0x419b34]
cmp eax, ebx
je 0x410311
push eax
call fcn.0040af3d
pop ecx
test eax, eax
je 0x410311
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419b2c]
call fcn.0040af3d
pop ecx
test eax, eax
je 0x410331
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410333
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4046d8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406894
test esi, esi
jne 0x40470e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004069fc
jmp 0x40472c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040461c
mov edi, eax
test esi, esi
je 0x40472c
cmp dword [ebx], 0
je 0x40472c
dec esi
jmp 0x404715
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405640
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405a2c
mov byte [esp], al
cmp byte [esp], 0
jne 0x4057c9
test edi, edi
je 0x4057c9
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405700
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x4056db
cmp edi, 0xffffffff
je 0x40569f
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40569f
mov byte [esp], 0
jmp 0x4057c9
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4056db
test ebx, ebx
jne 0x4056d4
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402568
test eax, eax
jne 0x4056d4
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4057c9
pause
dec ebp
test ebp, ebp
jg 0x405684
cmp edi, 0xffffffff
je 0x405700
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4056fe
mov byte [esp], 0
jmp 0x4057c9
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40564e
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402568
cmp ebx, eax
jne 0x405700
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040583c
mov edx, eax
mov ebx, dword [0x4c58c8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x405767
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405765
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x405767
xor edi, edi
cmp byte [esp], 0
je 0x405790
mov ebx, dword [esi]
test bl, 1
jne 0x4057a9
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402568
cmp ebx, eax
jne 0x40576d
mov byte [esp + 1], 1
jmp 0x4057a9
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402568
cmp ebx, eax
jne 0x405790
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x40571a
cmp byte [esp], 0
je 0x4057c9
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406544
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c5050], 0
je 0x4065a5
cmp word [0x4c532c], 0xd7b2
jne 0x40656d
cmp dword [0x4c5334], 0
jbe 0x40656d
mov eax, 0x4c5328
call dword [0x4c5344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4065d0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4c2028], 0
jne 0x4065c1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406750
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4c202c], 0
je 0x40677b
mov edx, edi
mov eax, esi
call dword [0x4c202c]
mov ebx, eax
jmp 0x40678c
mov eax, 8
call fcn.00404350
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x4c5051], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406718
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x4067c1
mov edx, 8
mov eax, ebx
call fcn.0040436c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x4089f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408b59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406894
cmp si, word [0x4c27dc]
jb 0x408a8c
cmp si, word [0x4c29dc]
ja 0x408a8c
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x408a8c
mov ebx, dword [ebp - 8]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4c27dc]
jae 0x408a66
mov edi, ebx
dec edi
jmp 0x408a87
cmp si, word [ebx*8 + 0x4c27dc]
jbe 0x408a76
inc ebx
mov dword [ebp - 8], ebx
jmp 0x408a87
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4c27e0]
call fcn.00408904
jmp 0x408a8c
cmp edi, dword [ebp - 8]
jae 0x408a50
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x408b3b
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408b3b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004073a4
push dword [ebp - 0x160]
push 0x408b74
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004073a4
push dword [ebp - 0x164]
push 0x408b84
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004073a4
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004075dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408b60
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004068f4
ret
Function at 0x408d0c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408e0f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4c7b51
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4c7b6a]
jne 0x408d58
mov eax, esi
mov edx, 0x4c7b6c
mov ecx, 0x55
call fcn.004073a4
push 0x4c7b51
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408df9
push 0x4c7b51
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406894
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408dc7
cmp byte [0x4c7b50], 0
je 0x408d8c
mov edx, esi
mov eax, ebx
call fcn.00408bf0
jmp 0x408dc7
mov edx, esi
mov eax, ebx
call fcn.004089f4
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408dc7
cmp dword [esi], 0
je 0x408db0
mov eax, esi
mov edx, 0x408e28
call fcn.004074fc
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004089f4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004074fc
push 0x4c7b51
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4c7b6a], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407300
push eax
push 0x4c7b6c
call sub.kernel32.dll_lstrcpynW
push 0x4c7b51
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408e16
lea eax, [ebp - 4]
call fcn.00406894
ret