joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430e7c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00431b34
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00430fdc
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x430fc6
test ebx, ebx
jl 0x430f6a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce72e0
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x430f8b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x430f7d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0043294c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0043294c
add esp, 8
mov ebx, 0x80070057
jmp 0x430f6a

Function at 0x438fd0
Capabilities:
Encode data using xor

Disassembly:
or edi, dword es:[ebp - 0x48a79587]
mov ch, 0x53
xor dword [ecx - 0x76], esi
jbe 0x439054
insb byte es:[edi], dx
std
mov edi, 0x8e90cb0d
ja 0x439051
jno 0x438fe9
mov ecx, 0x841178ae
xor al, 0xcf
push esp
cmp ah, ch
mov ebx, ebp
adc byte [eax - 0x1068f4dd], bh
cmp byte [ebx - 0x624b0d31], 0x22
sti
pushal
dec edx
out 0xaa, eax
sub al, 0x18
pop ss
ja 0x438fee
aas
xchg edi, eax
aam 0xb1
out dx, eax
mov edi, 0x37bf174
cmc
clc
dec edi
ror dword [edi + 0x4b], 0xf4
and dword [esp + 8], 0x4a
pop eax
ljmp 0x592b
mov edi, 0xba80bdd3
invalid
lodsb al, byte [esi]
mov ch, 0x59
dec ecx
cmp ecx, esp
mov al, byte [0x8fe9e117]
shr dword [edi + 0x5e], 1
add dword [ebx], ebx
scasd eax, dword es:[edi]
xchg ecx, eax
pop ds
mov cl, 0xc5
loope 0x43903d
invalid
Function at 0x4478bc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00448574
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00447a1c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x447a06
test ebx, ebx
jl 0x4479aa
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfdd20
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4479cb
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4479bd
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0044938c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0044938c
add esp, 8
mov ebx, 0x80070057
jmp 0x4479aa
Function at 0x45e31c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045efd4
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045e47c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45e466
test ebx, ebx
jl 0x45e40a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd14780
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45e42b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45e41d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0045fdec
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0045fdec
add esp, 8
mov ebx, 0x80070057
jmp 0x45e40a
Function at 0x47511c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00475dd4
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0047527c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x475266
test ebx, ebx
jl 0x47520a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2b580
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47522b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x47521d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00476bec
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00476bec
add esp, 8
mov ebx, 0x80070057
jmp 0x47520a
Function at 0x48c8cc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048d584
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048ca2c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48ca16
test ebx, ebx
jl 0x48c9ba
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd42d30
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48c9db
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48c9cd
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048e39c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048e39c
add esp, 8
mov ebx, 0x80070057
jmp 0x48c9ba
Function at 0x4a378c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a4444
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a38ec
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a38d6
test ebx, ebx
jl 0x4a387a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd59bf0
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a389b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a388d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a525c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a525c
add esp, 8
mov ebx, 0x80070057
jmp 0x4a387a
Function at 0x4b9601
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c13c0
cmp edx, dword [eax]
je 0x4b9623
add eax, 8
inc ecx
cmp eax, 0x4c1450
jl 0x4b9614
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c13c0]
jne 0x4b9751
mov eax, dword [0x4c5d64]
cmp eax, 1
je 0x4b972b
test eax, eax
jne 0x4b9654
cmp dword [0x4c12e8], 1
je 0x4b972b
cmp edx, 0xfc
je 0x4b9751
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b968b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9fe0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba470
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b96ce
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba470
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be9c4
push edi
call fcn.004bc340
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9fe0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9ff0
lea eax, [ebp - 0xa0]
push 0x4be9a4
push eax
call fcn.004b9ff0
push dword [esi + 0x4c13c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9ff0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc2b4
add esp, 0x2c
pop edi
jmp 0x4b9751
lea eax, [ebp + 8]
lea esi, [esi + 0x4c13c4]
push 0
push eax
push dword [esi]
call fcn.004ba470
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4047f8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406fc4
test esi, esi
jne 0x404830
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00407100
jmp 0x40484e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040473c
mov edi, eax
test esi, esi
je 0x40484e
cmp dword [ebx], 0
je 0x40484e
dec esi
jmp 0x404837
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x406170
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x542054], 0
je 0x4061d1
cmp word [0x542330], 0xd7b2
jne 0x406199
cmp dword [0x542338], 0
jbe 0x406199
mov eax, 0x54232c
call dword [0x542348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4061fc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x53e030], 0
jne 0x4061ed
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40637c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x53e034], 0
je 0x4063a2
mov edx, esi
mov eax, ebx
call dword [0x53e034]
jmp 0x4063b1
mov eax, 8
call fcn.00404484
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x542055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x406344
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4090b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x409217
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406fc4
cmp si, word [0x53e7dc]
jb 0x40914a
cmp si, word [0x53e9dc]
ja 0x40914a
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x40914a
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x53e7dc]
jae 0x409124
mov edi, ebx
dec edi
jmp 0x409145
cmp si, word [ebx*8 + 0x53e7dc]
jbe 0x409134
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x409145
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x53e7e0]
call fcn.00408fc0
jmp 0x40914a
cmp edi, dword [ebp - 0xc]
jae 0x40910e
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4091f9
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4091f9
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.004071ac
push dword [ebp - 0x164]
push 0x409234
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.004071ac
push dword [ebp - 0x168]
push 0x409244
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.004071ac
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00407564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40921e
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406fbc
ret
Function at 0x4093d0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4094d5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x544b5c
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x544b74]
jne 0x40941c
mov eax, esi
mov edx, 0x544b78
mov ecx, 0x55
call fcn.004071ac
push 0x544b5c
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4094bf
push 0x544b5c
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406fc4
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40948d
cmp byte [0x544b58], 0
je 0x409452
mov edx, esi
mov eax, ebx
call fcn.004092b0
jmp 0x40948d
mov edx, esi
mov eax, ebx
call fcn.004090b0
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40948d
cmp dword [esi], 0
je 0x409476
mov eax, esi
mov edx, 0x4094f0
call fcn.004073c0
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004090b0
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004073c0
push 0x544b5c
call sub.kernel32.dll_EnterCriticalSection
mov word [0x544b74], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407050
push eax
push 0x544b78
call sub.kernel32.dll_lstrcpynW
push 0x544b5c
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094dc
lea eax, [ebp - 4]
call fcn.00406fb4
ret
Function at 0x409714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406fac
xor eax, eax
push ebp
push 0x4098f9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x409754
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40976e
push 0x105
mov eax, dword [ebp - 4]
call fcn.00407050
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x4098e3
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409908
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4097fd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409908
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4097fd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40993c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4097fd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409970
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4098e3
xor eax, eax
push ebp
push 0x4098dc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00409518
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40986c
mov eax, dword [ebp - 0x10]
call fcn.00404484
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407170
jmp 0x4098b7
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x4099b0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4098b7
mov eax, dword [ebp - 0x10]
call fcn.00404484
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x4099b0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4098e3
cmp dword [ebp - 8], 0
je 0x4098d2
mov eax, dword [ebp - 8]
call fcn.004044a0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409900
lea eax, [ebp - 4]
call fcn.00406fb4
ret