joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414d4c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
call fcn.00415ecc
test bh, 0xc0
jne 0x414d6f
mov eax, dword [0x4fbf4c]
mov ecx, 0xc000
and ecx, dword [eax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
mov ecx, eax
shr ecx, 8
mov esi, 3
cmp ecx, 6
ja 0x414d93
sar eax, 6
mov esi, dword [eax + 0x4fb9a8]
mov edi, dword [esp + 0x40]
test bh, 1
je 0x414dbc
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
mov al, byte [0x4fb9c8]
and al, byte [esp + 0x48]
mov eax, 0x80
mov ecx, 1
cmovs ecx, eax
jmp 0x414dcf
mov dword [esp], edi
call sub.KERNEL32.DLL_GetFileAttributesA
sub esp, 4
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ebx
and al, 3
je 0x414de8
cmp al, 2
je 0x414def
cmp al, 1
jne 0x414ee7
mov eax, 0x40000000
jmp 0x414df4
mov eax, SysReAllocStringLen
jmp 0x414df4
mov eax, 0xc0000000
mov edx, ebx
and edx, 0x70
add edx, 0xfffffff0
shr edx, 4
cmp edx, 3
mov ebp, 3
cmovb ebp, edx
xor edx, edx
cmp eax, 0x80000000
sete dl
test bl, 4
cmove edx, ebp
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], 0
mov ebp, ebx
shr ebp, 7
not ebp
and ebp, 1
mov dword [esp + 0x28], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 0x18], 0
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
cmp esi, 0xffffffff
je 0x414ec4
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov dword [esp], esi
call fcn.00414ca4
mov ecx, edi
or ecx, 0x2000
test eax, eax
cmove ecx, edi
and ecx, 0xfffff8ff
mov dword [esp], esi
mov dword [esp + 4], ecx
call fcn.0041608c
mov edi, eax
cmp edi, 0xffffffff
jne 0x414ef5
mov dword [esp], 4
call fcn.00416468
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov edi, 0xffffffff
jmp 0x414ef5
call sub.KERNEL32.DLL_GetLastError
movzx eax, ax
test bh, 1
mov ecx, 0x50
mov edx, 2
cmovne edx, ecx
cmp eax, 0x6e
cmovne edx, eax
mov dword [esp], edx
jmp 0x414eee
mov dword [esp], 1
call fcn.00416468
mov edi, eax
call fcn.00415f1c
mov eax, edi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x415470
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x4fbe7c], eax
jbe 0x4154ad
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x504504]
call sub.KERNEL32.DLL_ReadFile
add esp, 0xc
cmp eax, 1
jne 0x4154b4
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
jmp 0x4154ca
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
jne 0x4154c6
add esp, 0xc
ret
sub esp, 0xc
push ecx
call fcn.00416468
add esp, 0x10
add esp, 0xc
ret
Function at 0x4154e8
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
cmp dword [0x4fbe7c], eax
jbe 0x415525
sub esp, 0xc
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax*4 + 0x504504]
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
cmp eax, 1
jne 0x415536
mov eax, dword [esp + 8]
add esp, 0xc
ret
sub esp, 0xc
push 6
call fcn.00416468
add esp, 0x10
add esp, 0xc
ret
call fcn.00416508
add esp, 0xc
ret

Function at 0x41713c
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.DLL_DeleteFileA
sub esp, 4
cmp eax, 1
jne 0x417159
xor eax, eax
add esp, 0xc
ret
add esp, 0xc
jmp fcn.00416508
Function at 0x419c84
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x21c
mov dword [esp + 0x18], edx
mov esi, ecx
mov eax, dword [esi + 4]
lea ebp, [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], eax
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 4], 0x1001
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.004148bc
mov word [esp + eax + 0x1c], 0x5f
mov edi, dword [esi + 4]
mov dword [esp], ebp
call fcn.004148bc
lea ecx, [esp + eax + 0x1c]
mov edx, pe_nt_image_headers32
sub edx, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 4], 0x1002
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0x10
mov dword [esp], ebp
call fcn.004148bc
mov word [esp + eax + 0x1c], 0x2e
mov edi, dword [esi]
mov dword [esp], ebp
call fcn.004148bc
lea eax, [esp + eax + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], 0xa
call fcn.0041d050
mov edi, dword [esi + 0x24]
test edi, edi
je 0x419d78
mov dword [esp], edi
call fcn.004148bc
mov ebx, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004148bc
mov ecx, ebp
mov ebp, eax
mov dword [esp], ecx
call fcn.004148bc
add ebp, ebx
lea eax, [eax + ebp + 3]
lea ebp, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00411c9c
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
jne 0x419dcd
jmp 0x419e15
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004148bc
mov ebx, eax
mov edi, ebp
mov dword [esp], ebp
call fcn.004148bc
mov ebp, eax
lea eax, [ebx + ebp + 3]
mov dword [esp], eax
call fcn.00411c84
mov ebx, eax
mov dword [esi + 0x24], ebx
test ebx, ebx
je 0x419e15
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004148bc
lea eax, [ebp + eax + 3]
mov dword [esp + 8], eax
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.00414757
mov ebp, edi
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00414770
mov edi, dword [esi + 0x24]
mov dword [esp], edi
call fcn.004148bc
mov word [edi + eax], 0x3d
mov eax, dword [esi + 0x24]
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.00414770
mov esi, dword [esi + 0x24]
mov dword [esp], esi
call fcn.004148bc
mov word [esi + eax], 0xa
mov eax, 1
jmp 0x419e17
xor eax, eax
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41b870
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
push 0
push dword [edi + 4]
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00411c84
add esp, 0x10
mov dword [edi + 4], eax
push esi
push eax
push 0xe
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi]
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00411c84
add esp, 0x10
mov dword [edi], eax
test edi, edi
je 0x41b8e3
push esi
push eax
push 0xf
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
jmp 0x41b8f2
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
xor ecx, ecx
and ecx, ebx
mov dword [esp + 8], ecx
push 0
push dword [edi + 8]
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00411c84
add esp, 0x10
mov dword [edi + 8], eax
push esi
push eax
push 0x10
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
push 0
push dword [edi + 0xc]
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00411c84
add esp, 0x10
mov dword [edi + 0xc], eax
push esi
push eax
push 0x50
push ebp
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ecx, ecx
test eax, eax
setne cl
and ecx, ebx
mov ebx, ebp
mov ebp, ecx
push 0
push dword [edi + 0x10]
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
inc esi
sub esp, 0xc
push esi
call fcn.00411c84
add esp, 0x10
mov dword [edi + 0x10], eax
push esi
push eax
push 0x51
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
xor ebx, ebx
test eax, eax
setne bl
and ebx, ebp
and ebx, dword [esp + 8]
sub esp, 0xc
push 4
call fcn.00411c84
add esp, 0x10
mov esi, eax
test esi, esi
je 0x41b9dc
push 4
push esi
push 0x11
push dword [esp + 0x2c]
call sub.KERNEL32.DLL_GetLocaleInfoA
sub esp, 0xc
test eax, eax
je 0x41b9eb
push esi
call fcn.0041ca04
add esp, 0x10
mov word [edi + 0x14], ax
sub esp, 0xc
push esi
call fcn.00411c94
add esp, 0x10
mov eax, 1
jmp 0x41b9f6
sub esp, 0xc
push 0xe
call sub.KERNEL32.DLL_SetLastError
add esp, 0xc
jmp 0x41b9f4
push esi
call fcn.00411c94
add esp, 0x10
xor eax, eax
and ebx, eax
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41f4ac
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push dword [esp + 0x4c]
call sub.KERNEL32.DLL_CreateFileA
add esp, 4
mov edi, eax
test edi, edi
je 0x41f572
sub esp, 0xc
lea eax, [esp + 0x14]
push eax
call sub.KERNEL32.DLL_GetLocalTime
add esp, 0xc
movzx eax, word [esp + 0xa]
mov dword [esp + 0x18], eax
movzx ecx, word [esp + 0xe]
movzx edx, word [esp + 8]
movzx ebp, word [esp + 0x10]
movzx eax, word [esp + 0x12]
movzx esi, word [esp + 0x14]
movzx ebx, word [esp + 0x16]
sub esp, 0xc
push ebx
push esi
push eax
push ebp
push edx
push ecx
push dword [esp + 0x3c]
push str._02d__02d__04d__02d:_02d:_02d._03d
push 0x50480c
call sub.USER32.DLL_wsprintfA
add esp, 0x24
push 0x50480c
call fcn.004148bc
add esp, 4
push 0
lea ebx, [esp + 0x18]
push ebx
push eax
push 0x50480c
push edi
call sub.KERNEL32.DLL_WriteFile
mov esi, dword [esp + 0x40]
push esi
call fcn.004148bc
add esp, 4
push 0
push ebx
push eax
push esi
push edi
call sub.KERNEL32.DLL_WriteFile
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0xc
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41f5a4
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x90
mov edi, dword [esp + 0xa0]
mov eax, dword [0x50482c]
test eax, eax
mov ecx, dword [0x504828]
jne 0x41f669
test ecx, ecx
jne 0x41f669
cmp dword [0x4fd2dc], 0
je 0x41f69f
sub esp, 4
lea esi, [esp + 0x14]
push 0x80
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 4
push 0x5c
push esi
call fcn.0041ee68
add esp, 0x10
test eax, eax
jne 0x41f614
sub esp, 8
push 0x3a
push esi
call fcn.0041ee68
add esp, 0x10
test eax, eax
je 0x41f617
inc eax
mov esi, eax
mov dword [esp + 0xc], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x41f65a
call sub.KERNEL32.DLL_GetCurrentThreadId
sub esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0x41f734
push eax
call sub.USER32.DLL_EnumThreadWindows
add esp, 4
cmp dword [esp + 0xc], 0
mov eax, 0x11010
mov ecx, 0x12010
cmove ecx, eax
push ecx
push esi
push edi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x41f6ec
cmp ecx, 0xffffffff
je 0x41f6ec
test ecx, ecx
je 0x41f680
sub esp, 0xc
push edi
call ecx
add esp, 0x10
mov eax, dword [0x50482c]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x41f6ec
cmp byte [eax], 0
je 0x41f6ec
sub esp, 8
push edi
push eax
call fcn.0041f4ac
add esp, 0xa0
jmp 0x41f6f2
sub esp, 0xc
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
add esp, 0xc
mov esi, eax
sub esp, 0xc
lea ebx, [esp + 0x1c]
push 0
push ebx
push 2
push 0x4fd134
push esi
call sub.KERNEL32.DLL_WriteFile
push edi
call fcn.004148bc
add esp, 4
push 0
push ebx
push eax
push edi
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
push ebx
push 2
push 0x4fd134
push esi
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
add esp, 0x90
pop esi
pop edi
pop ebx
ret
Function at 0x420574
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x50c850]
test eax, eax
je 0x4205a9
mov ecx, dword [eax]
test ecx, ecx
je 0x42060c
add eax, 4
xor edi, edi
nop
cmp byte [ecx], 1
sbb edi, 0
inc edi
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x420594
jmp 0x420638
mov esi, dword [0x50c888]
test esi, esi
jne 0x4205d6
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov esi, eax
mov dword [0x50c888], esi
test esi, esi
jne 0x4205d6
mov dword [esp], str.GetEnvironmentStrings_failed
call fcn.0041f714
mov esi, dword [0x50c888]
mov dword [esp], esi
call fcn.004148bc
test eax, eax
je 0x420610
xor ebx, ebx
xor edi, edi
mov ebp, esi
nop word cs:[eax + eax]
lea ebx, [eax + ebx + 1]
inc edi
lea ebp, [ebp + eax + 1]
mov dword [esp], ebp
call fcn.004148bc
test eax, eax
jne 0x4205f4
inc ebx
jmp 0x420617
xor edi, edi
jmp 0x420638
mov ebx, 1
xor edi, edi
mov dword [esp], ebx
call fcn.00411c84
mov dword [0x50c84c], eax
test eax, eax
je 0x420691
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0041458c
lea eax, [edi + 4]
mov dword [0x50c854], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.00411c68
mov esi, eax
test esi, esi
je 0x420691
mov edi, dword [0x50c850]
test edi, edi
je 0x420695
mov edx, dword [edi]
test edx, edx
je 0x4206ce
lea eax, [edi + 4]
xor ecx, ecx
nop word [eax + eax]
cmp byte [edx], 0
je 0x420684
mov edx, dword [eax - 4]
mov dword [esi + ecx*4], edx
jmp 0x420685
dec ecx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x420674
jmp 0x4206ca
xor eax, eax
jmp 0x4206e1
mov ebx, dword [0x50c84c]
mov dword [esp], ebx
call fcn.004148bc
test eax, eax
je 0x4206d6
mov ebp, esi
nop word cs:[eax + eax]
mov dword [ebp], ebx
lea ebx, [ebx + eax + 1]
mov dword [esp], ebx
call fcn.004148bc
add ebp, 4
test eax, eax
jne 0x4206b4
test edi, edi
je 0x4206d6
mov dword [esp], edi
call fcn.00411c94
mov dword [0x50c850], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x420d94
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 8], esi
cmp ebx, 1
jne 0x420df5
mov eax, dword [0x50c8cc]
lea ecx, [eax + 1]
mov dword [0x50c8cc], ecx
test eax, eax
jne 0x420df5
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x50c888], eax
sub esp, 0xc
push dword [esi + 0x44]
call fcn.00415834
add esp, 8
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00420b6c
add esp, 0x10
push ebp
push ebx
push edi
push dword [esi + 0x18]
call fcn.004216d8
mov esi, eax
test ebx, ebx
jne 0x420e48
dec dword [0x50c8cc]
jne 0x420e48
sub esp, 0xc
push edi
call fcn.0041f964
add esp, 8
lea eax, [esp + 0xc]
push 1
push eax
call fcn.00420b6c
add esp, 0x10
mov eax, dword [0x50c888]
test eax, eax
je 0x420e48
sub esp, 0xc
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
add esp, 0xc
mov dword [0x50c888], 0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x421538
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
sub esp, 0x64
mov esi, dword [esp + 0x70]
mov dword [esp], 0x50c8dc
call sub.KERNEL32.DLL_EnterCriticalSection
sub esp, 4
mov eax, dword [0x50fd8c]
cmp eax, 0x232
jl 0x4215a2
mov eax, dword [esp + 0x74]
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0x20726f72
mov dword [esp + 0x1c], 0x72652065
mov dword [esp + 0x18], 0x726f6870
mov dword [esp + 0x14], 0x616d6553
mov dword [esp + 4], eax
lea edi, [esp + 0x14]
mov dword [esp], edi
call fcn.00414770
mov dword [esp], edi
call fcn.0041f714
mov eax, dword [0x50fd8c]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x50c8dc]
mov dword [esp], eax
call sub.KERNEL32.DLL_InitializeCriticalSection
sub esp, 4
mov eax, dword [0x50fd8c]
lea ecx, [eax + 1]
mov dword [0x50fd8c], ecx
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x50c8dc]
mov dword [esi], eax
mov dword [esp], 0x50c8dc
call sub.KERNEL32.DLL_LeaveCriticalSection
add esp, 0x60
pop esi
pop edi
ret

Function at 0x4215e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
sub esp, 0x58
mov eax, dword [esp + 0x60]
mov byte [esp + 0x18], 0
mov dword [esp + 0x14], 0x20726f72
mov dword [esp + 0x10], 0x72652065
mov dword [esp + 0xc], 0x726f6870
mov dword [esp + 8], 0x616d6553
mov dword [esp + 4], eax
lea esi, [esp + 8]
mov dword [esp], esi
call fcn.00414770
mov dword [esp], esi
call fcn.0041f714
add esp, 0x58
pop esi
ret

Function at 0x425830
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x5101bc]
mov dword [esp], eax
call fcn.004f8670
sub esp, 4
mov esi, eax
test esi, esi
je 0x425897
xor edi, edi
nop
cmp edi, 3
ja 0x425897
inc edi
xor ebx, ebx
xor eax, eax
nop word [eax + eax]
cmp byte [ebx*8 + 0x5101c0], 0
je 0x42588d
mov ecx, dword [ebx*8 + 0x5101c4]
test ecx, ecx
je 0x42588d
mov edx, dword [esi + ebx*4]
test edx, edx
je 0x42588d
mov dword [esi + ebx*4], 0
mov dword [esp], edx
call ecx
mov eax, 1
inc ebx
cmp ebx, 0x32
jne 0x425860
test eax, eax
jne 0x425850
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x42ecf4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0042f1b4
mov byte [esp], al
cmp byte [esp], 0
jne 0x42ee7d
test edi, edi
je 0x42ee7d
mov byte [esp + 1], 0
test ebp, ebp
jle 0x42edbd
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x42ed98
cmp edi, 0xffffffff
je 0x42ed59
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x42ed59
mov byte [esp], 0
jmp 0x42ee7d
cmp dword [esi], 1
jg 0x42ed98
cmp dword [esi], 0
jne 0x42ed8a
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x42ed8a
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x42ee7d
lea eax, [esp + 0xc]
call fcn.0042e9a4
dec ebp
test ebp, ebp
jg 0x42ed3e
cmp edi, 0xffffffff
je 0x42edbd
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x42edbb
mov byte [esp], 0
jmp 0x42ee7d
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x42ed02
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x42edbd
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0042eef8
mov edx, eax
mov ebx, dword [0x510eac]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x42ee21
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x42ee1f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x42ee21
xor edi, edi
cmp byte [esp], 0
je 0x42ee47
mov ebx, dword [esi]
test bl, 1
jne 0x42ee5d
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x42ee27
mov byte [esp + 1], 1
jmp 0x42ee5d
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x42ee47
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x42edd4
cmp byte [esp], 0
je 0x42ee7d
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42fc70
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x51060c], 0
je 0x42fcd7
cmp word [0x5108f8], 0xd7b2
jne 0x42fc99
cmp dword [0x510900], 0
jbe 0x42fc99
mov eax, 0x5108f4
call dword [0x510910]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x42fd04
call fcn.00430940
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x4fdcfc], 0
jne 0x42fcf3
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x42fe98
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4fdcc0], 0
je 0x42fec3
mov edx, edi
mov eax, esi
call dword [0x4fdcc0]
mov ebx, eax
jmp 0x42fed4
mov eax, 8
call fcn.0042d170
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x51060d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x42fe60
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
jne 0x42ff04
mov eax, ebx
call fcn.0042d18c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x43385c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4339c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0042ffd8
cmp si, word [0x4fe6cc]
jb 0x4338f4
cmp si, word [0x4fe8cc]
ja 0x4338f4
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x4338f4
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4fe6cc]
jae 0x4338ce
mov edi, ebx
dec edi
jmp 0x4338ef
cmp si, word [ebx*8 + 0x4fe6cc]
jbe 0x4338de
inc ebx
mov dword [ebp - 8], ebx
jmp 0x4338ef
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4fe6d0]
call fcn.00433778
jmp 0x4338f4
cmp edi, dword [ebp - 8]
jae 0x4338b8
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4339a3
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x4339a3
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00430ce4
push dword [ebp - 0x160]
push 0x4339e0
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00430ce4
push dword [ebp - 0x164]
push 0x4339f0
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00430ce4
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00430f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4339ca
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00430038
pop eax
jmp eax
Function at 0x433b78
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x433c7e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5131cc
call sub.KERNEL32.DLL_EnterCriticalSection
cmp bx, word [0x5131e4]
jne 0x433bc4
mov eax, esi
mov edx, 0x5131e6
mov ecx, 0x55
call fcn.00430ce4
push 0x5131cc
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x433c66
push 0x5131cc
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
call fcn.0042ffd8
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x433c33
cmp byte [0x5131c8], 0
je 0x433bf8
mov edx, esi
mov eax, ebx
call fcn.00433a5c
jmp 0x433c33
mov edx, esi
mov eax, ebx
call fcn.0043385c
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0x433c33
cmp dword [esi], 0
je 0x433c1c
mov eax, esi
mov edx, 0x433c98
call fcn.00430e3c
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0043385c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00430e3c
push 0x5131cc
call sub.KERNEL32.DLL_EnterCriticalSection
mov word [0x5131e4], bx
mov eax, dword [esi]
call fcn.00430c48
mov ecx, eax
mov eax, 0x5131e6
mov edx, 0xaa
call fcn.004336d8
push 0x5131cc
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433c85
lea eax, [ebp - 4]
call fcn.0042ffd8
pop eax
jmp eax