joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1445d8610
Capabilities:
Encrypt data using chaskey

Disassembly:
sub cl, 0x9d
pop rax
push rbp
movzx r8d, byte [rsp + 4]
rol cl, 1
ror bpl, 5
jae 0x1446752bf
add r8d, 0x4a08624
neg cl
xor cl, 0x98
mov esi, 0x9b8f8eb0
pop rsi
inc cl
call fcn.1445e1015
mov edi, 0xab311f07
lea rdx, [rdi + rdi*4 + 0x3424f91c]
movzx di, byte [r11]
movsx ebp, dx
lea rdx, [rdx + rdx*2 + 0x62316986]
mov sil, byte [r11 + 2]
and dil, sil
mov r8d, ebp
mov eax, ebp
xchg rdx, rax
not dil
mov word [r11 + 2], di
ror rax, 0x15
mov eax, dword [r9]
shl rbp, 0xf4
neg edx
lea r9, [r9 + rdx*2 - 0xd77e]
movsx esi, bp
xor eax, r10d
ror eax, 3
bswap eax
lea eax, [rax + r8 - 0x4be7f4a0]
shr si, 0xeb
bswap eax
shr bp, 0x4f
dec eax
or rbp, 0x7d1d9e8d
setns bpl
push r10
and rsi, rsi
rol si, 0x64
jbe 0x144620d9e
sbb al, 0xa
mov edx, ecx
ror al, 1
add al, 0xa7
movzx edi, r8w
or r8d, 0xfc37e1a5
xor al, 0x8b
dec al
ror al, 1
lea rsi, [rcx + r8*2 + 0x4da4ea37]
neg edx
sub al, cl
xor r10b, al
add rax, rsp
rol dx, 0xa5
mov qword [rax + rcx*4 - 0x18], rbp
sar rdx, cl
adc edi, dword [rcx + r9 - 5]
mov eax, 0x9934ef82
lea r9, [r9 + rcx*4 - 0x13]
neg r8b
dec rcx
xor edi, r10d
not rsi
movzx ebp, al
ror edi, 2
jmp 0x14467816d

Function at 0x1445dc7b1
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
not edx
sar rcx, 0x17
or cx, 0x3bbd
not edi
or edx, edi
neg word [rsp + rsi + 0xf]
jb 0x14460de04

Function at 0x1445e1bd4
Capabilities:
Parse pe header

Disassembly:
xor dword [rsp + rcx + 0x405f2495], r8d
mov r10, qword [rsp + rcx + 0x405f2495]
mov qword [rsp + rcx + 0x405f2495], rbp
movsxd r8, r8d
movzx edi, cx
add rbx, r8
lea rsi, [rsp + rdi - 0xdb33]
mov rbp, qword [rcx + rsi + 0x405f247d]
mov qword [r11 + rcx + 0x405f247d], rbp
lea r8, [rdi + rdi*8 - 0x36cf2b6a]
push r8
call fcn.1445e861b

Function at 0x144609f9d
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [r9 + rcx + 0x46228c9]
mov qword [rsp + rdx*2 - 0x1ae6e], 0xffffffff9005a5bb
lea r9, [r9 + rcx*4 + 0x1188a328]
movsx edi, cl

Function at 0x144611c36
Capabilities:
Encrypt data using chaskey

Disassembly:
pop r8
pop rdx
pop rsi
pop rsi
jmp fcn.144603746
mov r8, qword [rdi + rdx - 0x40017f0e]
ror di, 0xc3
not dil
not rax
mov qword [rdi + r11 - 0x4001cf1e], r8
mov eax, dword [r9 + rsi - 0x2e8dfefe]
lea r9, [rdi + r9 - 0x4001cf18]
xor eax, r10d
mov qword [rsp + rsi - 0x2e8dff00], rsi
mov edx, 0x2305c4ba
sub eax, 0xe72e5b84
not eax
sal esi, 0x1e
inc eax
movsx ecx, bpl
inc rcx
je 0x1445e60ae
rol eax, 1
or dx, 0xecac
jp 0x1446689fb
mov ebp, 0xf622da13
mov rbp, qword [r11]
mov r8d, 0x4eafd006
movzx eax, byte [r9 + r8 - 0x4eafd006]
movsx ecx, r8b
and r8w, 0x6281
xor al, r10b
sal r8, cl
ja 0x144675359
Function at 0x14461ea40
Capabilities:
Encode data using base64

Disassembly:
mov word [r11 + rsi*8 - 0x3ff0], r8w
xor rdx, rsi
call fcn.144621ad8
dec dword [rsp + rdi - 0xac]
neg rsi
neg cl
not qword [rsp + rdi*4 - 0x2cc]
xor cl, 0x98
and qword [rsp + rdi - 0xad], 0x1ae639c
xor word [rsp + rdi - 0xa9], dx
setg al
inc cl
inc rbp
mov byte [rsp + rdi*2 - 0x15f], 0x3f
neg dx
ror cl, 1
xor cl, 0xa2
add cl, 0x82
call fcn.144671404
mov qword [rsp + rdi], 0x3501112f
not r8b
and rax, qword [rsp + rsi - 0x7fe]
not bpl
sar rax, cl
and r8b, bpl
jmp 0x1445dc40e

Function at 0x144629cef
Capabilities:
Encode data using base64

Disassembly:
setnp byte [rsp + rbp + 0xc]
movsxd rsi, esi
call fcn.14465cf37
movzx bp, byte ss:[rsi]
mov word [r11 + 6], bp
movsx ebp, cl
movsx edi, cl
and rbp, rbp
mov esi, dword [r9]
rol dx, 0x8f
add r9, 4
movzx eax, cl
xor esi, r10d
inc esi
shl al, 0xe6
dec rdx
xor esi, 0x8b996bbc
mov r8d, eax
lea rcx, [r8 + rdi*8 + 0x433e318a]
shl cl, 0x41
rol esi, 1
sub esi, 0xf2b36d99
ror r8d, cl
jae 0x1446283cb
jmp 0x144663e7e
mov qword [rsp + rbp*8 - 0x28], r10
xor dword [rsp + rbp + 2], esi
mov qword [rsp + rbp*4 - 0x18], 0xffffffffc22621b9
push rax
push rbp
mov r10, qword [rsp + rbp*4]
shr qword [rsp + rbp*4 - 0x12], 0x24
jne 0x1445ff9d4
mov ecx, 0xe31d618f
mov rsi, qword [r11]
lea rdx, [rcx*8 + 0x937ff97]
jmp 0x14461d639

Function at 0x144639bc2
Capabilities:
Encrypt data using chaskey

Disassembly:
setns dil
movsxd rcx, ecx
call fcn.144642014
inc r8d
shl di, 0xa8
lea rax, [rdx + rdx*8 + 0x1938c408]
inc al
xor r8d, 0xb988b7a5
not r8d
add ebp, 0x9dab32a8
sbb edx, eax
inc r8d
bswap rdx
movzx ecx, dil
push r10
lea rsi, [rax*2 - 0xd4bb6f6]
and eax, 0xfaabfebd
xor dword [rsp + rdi], r8d
or dl, 0x88
pop r10
ror cx, 0xc1
rol ebp, 0xc9
not al
movsxd r8, r8d
jnp 0x14460405c
shr di, 0x23
call fcn.14462e84e
neg sil
inc sil
sal qword [rsp + 0x2e], 0x7b
ror sil, 1
mov qword [rsp], rbp
xchg qword [rsp + 0x2a], rbp
ror word [rsp + rbp*2 + 0x30], 0xc1
not sil
push rbp
xor r10b, sil
lea rsi, [rsp + rsi + 0x48]
movzx edi, bp
lea rbp, [rbp + rbp*4 + 0xa1e8ebd]
movsx r8d, dil
mov byte [rsi + rbp - 0xa1e8ebd], cl
mov qword [rsp + rbp*2 - 0x143d1d3a], rbp
add qword [rsp + rdi], rbx
ret 0x40
mov ecx, dword [r9 + rdi*2 - 0x3c4]
lea r9, [r9 + r8 - 0x782bb6ab]
sal dx, 0x42
movzx esi, r8b
xor ecx, r10d
shl r8d, 0xe4
neg ecx
sub dil, sil
rol ecx, 3
mov eax, 0x53b5131e
bswap ecx
rol ecx, 1
push r10
dec bpl
xadd bpl, al
xor dword [rsp + rdi - 0x132], ecx
lea rdx, [rsi*8 - 0x39cf7a73]
neg rsi
rol eax, 0xa7
pop r10
jb 0x1445d6db6
mov qword [rsp + rbp - 0x4ca95021], rbx
ret 0x18
shl dx, 3
add al, 0x21
add bpl, 3
push rdi
mov qword [rsp + rax - 0x7ed44108], rax
ror bpl, 1
lea rax, [rdi*2 - 0x365611fa]
call fcn.1445d1709
xor r8b, dl
sub r8b, 0x87
dec qword [rsp + rdi - 0x3d81e5da]
xor r8b, dl
xor r10b, r8b
xchg word [rsp + rdi - 0x3d81e5dd], cx
lea r8, [rsp + r8 + 0x10]
pop rbp
mov word [r8 + rdi*2 - 0x7b03cbc4], ax
lea rdi, [rbp*4 - 0x1c57b67b]
lea r8, [rcx - 0x1ce5494f]
lea rdi, [rsp + r8 - 0x782bb6a9]
mov si, word [r8 + rdi - 0x782bb6b1]
mov word [r11 + r8 - 0x782bb6b3], si
pop rdi
ror dil, 0x64
jb 0x1445d85ab
Function at 0x144649f59
Capabilities:
Parse pe header

Disassembly:
not edi
dec dword [rsp + rcx - 0x8644]
sbb rdx, rdx
lea rbp, [rbp + rax*2 - 0x63f3e1e0]
lea edi, [rdi + rsi*2 - 0x71086e40]
bswap edi
mov qword [rsp + rcx - 0x863b], r10
xor dword [rsp + rcx - 0x863b], edi
xadd rcx, rbp
mov r10, qword [rsp + rdx*2 + 0x20]
rol r8, cl
sal byte [rsp + rdx*2 + 0xe], 0xc4
movsxd rdi, edi
adc rbx, rdi
not esi
call fcn.1445ed478
mov qword [rsp + rcx - 0x865b], rsi
shr rdi, 0xa
mov edi, dword [rcx + r9 - 0x865a]
mov ebp, edx
xor edi, r10d
add dword [rsp + rcx - 0x8646], ecx
adc dword [rsp + rcx - 0x864d], edx
mov r8d, eax
rol edi, 3
xor byte [rsp + rcx - 0x864e], cl
ja 0x144616a32

Function at 0x144657f61
Capabilities:
Encrypt data using chaskey

Disassembly:
sar cx, 0xa4
pop rax
pop rax
pop rdi
pop rbp
pop rsi
pop rbp
pop rax
pop rax
pop rdx
jne fcn.144603746
Function at 0x140864058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408641df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140864089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14086406f
add dl, dl
jne 0x140864096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408640f6
xor eax, eax
add dl, dl
jne 0x1408640a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408641ad
add dl, dl
jne 0x1408640b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408640c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408640d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408640dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408640ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14086407e
mov eax, 1
add dl, dl
jne 0x140864106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140864113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408640fb
sub eax, ebx
mov ebx, 1
jne 0x14086414c
mov ecx, 1
add dl, dl
jne 0x14086412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14086413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140864123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14086407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140864168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140864175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14086415d
cmp eax, 0x7d00
jae 0x14086419b
cmp eax, 0x500
jb 0x140864196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14086407e
cmp eax, 0x7f
ja 0x14086419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14086407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408641d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14086407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x403f20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x0044e098], 0
je 0x403fdb
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.0040a4d0
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x004470a0]
call fcn.0040a4d0
mov rcx, rsi
mov rdx, qword [0x004470a0]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.0040a4d0
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x403ff0
xor rcx, rcx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x405cc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
xor rsi, rsi
mov dword [rbx + 0x10], 0
mov dword [rbx + 0x14], 0
movzx rax, word [rbx + 8]
sub ax, 0xd7b1
test ax, ax
je 0x405d05
sub ax, 1
test ax, ax
je 0x405d1e
sub ax, 1
test ax, ax
jne 0x405fb8
invalid
mov ch, 2
add byte [rax], al
jmp 0x405d37
mov eax, 0x80000000
mov ecx, 3
lea rdx, [0x00405b90]
mov qword [rbx + 0x28], rdx
jmp 0x405d4e
mov eax, 0x40000000
mov ecx, 2
lea rdx, [0x00405bf0]
mov qword [rbx + 0x28], rdx
jmp 0x405d4e
mov eax, 0xc0000000
mov ecx, 3
lea rdx, [0x00405bf0]
mov qword [rbx + 0x28], rdx
lea rdx, [0x00405be0]
mov qword [rbx + 0x30], rdx
cmp word [rbx + 0x60], 0
jne 0x405e1d
cmp qword [rbx + 0x18], 0
jne 0x405d7d
lea rax, [rbx + 0x268]
mov qword [rbx + 0x18], rax
mov dword [rbx + 0xc], 0x80
lea rax, [0x00405be0]
mov qword [rbx + 0x38], rax
cmp word [rbx + 8], 0xd7b2
jne 0x405db6
lea rax, [0x0044e698]
cmp rbx, rax
jne 0x405da4
mov eax, 0xfffffff4
jmp 0x405daa
mov eax, 0xfffffff5
mov ecx, eax
call sub.kernel32.dll_GetStdHandle
mov qword [rbx], rax
jmp 0x405dc4
mov ecx, 0xfffffff6
call sub.kernel32.dll_GetStdHandle
mov qword [rbx], rax
cmp word [rbx + 0x2e8], 0
jne 0x405f7c
mov rcx, qword [rbx]
call sub.kernel32.dll_GetFileType
cmp eax, 2
jne 0x405e09
cmp word [rbx + 8], 0xd7b2
jne 0x405df8
call sub.kernel32.dll_GetConsoleOutputCP
mov word [rbx + 0x2e8], ax
jmp 0x405f7c
call sub.kernel32.dll_GetConsoleCP
mov word [rbx + 0x2e8], ax
jmp 0x405f7c
movzx rax, word [0x0044e998]
mov word [rbx + 0x2e8], ax
jmp 0x405f7c
lea rdx, [0x00405c60]
mov qword [rbx + 0x38], rdx
lea rdx, [rbx + 0x60]
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
mov rcx, rdx
mov edx, eax
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
jne 0x405e6d
mov word [rbx + 8], 0xd7b0
call sub.kernel32.dll_GetLastError
mov esi, eax
jmp 0x405fb8
mov qword [rbx], rax
cmp word [rbx + 8], 0xd7b3
jne 0x405f63
mov word [rbx + 8], 0xd7b2
mov rcx, qword [rbx]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
jne 0x405ea1
mov rcx, rbx
call fcn.00405c90
mov esi, eax
jmp 0x405fb8
sub eax, 0x80
test eax, eax
jge fcn.00405eae
xor rax, rax
Function at 0x407fc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov ebx, edx
mov rax, qword [rbp + 0x28]
mov r13d, dword [rax + 0x18]
mov rcx, qword [rbp + 0x28]
call fcn.00408310
mov esi, eax
test sil, sil
jne 0x408182
test ebx, ebx
je 0x408182
xor rdi, rdi
test r13d, r13d
jle 0x4080a7
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov dword [rbp + 0x3c], 0
test r13d, r13d
jle 0x408086
cmp ebx, 0xffffffff
je 0x408033
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x408033
xor rsi, rsi
jmp 0x408182
mov rax, qword [rbp + 0x28]
cmp dword [rax], 1
jg 0x408086
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0
jne 0x408074
xor eax, eax
mov ecx, 1
mov rdx, qword [rbp + 0x28]
lock cmpxchg dword [rdx], ecx
test eax, eax
jne 0x408074
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov sil, 1
jmp 0x408182
lea rcx, [rbp + 0x3c]
call fcn.00407cc0
sub r13d, 1
test r13d, r13d
jg 0x40801a
nop
cmp ebx, 0xffffffff
je 0x4080a7
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jb 0x4080a2
xor rsi, rsi
jmp 0x408182
sub eax, r14d
sub ebx, eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x407fdd
mov edx, ecx
add edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x4080a7
nop
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov rcx, qword [rbp + 0x28]
call fcn.00408230
xor rcx, rcx
mov rdx, rax
mov r8d, ebx
mov rax, qword [0x0044e990]
call qword [rax + 0x20]
test eax, eax
sete sil
cmp ebx, 0xffffffff
je 0x408111
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jae 0x40810e
sub eax, r14d
sub ebx, eax
jmp 0x408111
xor rbx, rbx
test sil, sil
je 0x408143
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov eax, ecx
test eax, 1
jne 0x408140
mov edx, ecx
sub edx, 2
or edx, 1
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x408116
mov dil, 1
nop
jmp 0x408160
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov edx, ecx
sub edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x408143
mov dil, 1
test dil, dil
je 0x4080ca
nop
test sil, sil
je 0x408182
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov eax, esi
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x4099f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x0044e098], 0
je 0x409a8e
cmp word [0x0044e3a8], 0xd7b2
jne 0x409a23
cmp dword [0x0044e3b0], 0
jbe 0x409a23
lea rcx, [0x0044e3a0]
call qword [0x0044e3c8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x00448780]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x00409ac4]
call fcn.0040a810
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x409ab0
cmp byte [0x0044703a], 0
jne 0x409ab0
xor rcx, rcx
lea rdx, [0x00448780]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x40c240
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x00452e60]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x00452e88], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x00452e58], al
cmp byte [0x00452e58], 0
je 0x40c2df
lea rcx, [0x0040c2e4]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040c2fe]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00452e40], rax
lea rcx, [0x0040c2e4]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040c31c]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00452e48], rax
lea rcx, [0x0040c2e4]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040c33a]
call sub.kernel32.dll_GetProcAddress
mov qword [0x00452e50], rax
add rsp, 0x28
ret
Function at 0x40c5c0
Capabilities:
Get geographical location

Disassembly:
push rbp
sub rsp, 0x1d0
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], rdx
mov word [rbp + 0x4e], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
call fcn.00409e30
movzx rax, word [rbp + 0x4e]
cmp word [0x00448bf8], ax
ja 0x40c6a8
movzx rax, word [rbp + 0x4e]
cmp ax, word [0x00448ff8]
mov word [rbp + 0x4e], ax
ja 0x40c6a8
mov ecx, 0x40
xor r8, r8
cmp ecx, r8d
jb 0x40c6a7
mov eax, ecx
add eax, r8d
mov r9d, 2
xor edx, edx
div r9d
lea rdx, [0x00448bf8]
mov r9d, eax
add r9, r9
movzx r10, word [rbp + 0x4e]
cmp word [rdx + r9*8], r10w
jbe 0x40c661
mov ecx, eax
sub ecx, 1
jmp 0x40c6a2
lea rdx, [0x00448bf8]
mov r8d, eax
add r8, r8
movzx r9, word [rbp + 0x4e]
cmp word [rdx + r8*8], r9w
jae 0x40c683
mov r8d, eax
add r8d, 1
jmp 0x40c6a2
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
lea r8, [0x00448c00]
mov eax, eax
add rax, rax
mov r8, qword [r8 + rax*8]
call fcn.0040c450
jmp 0x40c6a7
cmp ecx, r8d
jae 0x40c630
nop
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0
jne 0x40c78a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c78a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040aba0
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.0040aba0
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.0040aba0
mov rcx, qword [rbp + 0x40]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x0040c7e4]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x0040c7f4]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.0040af60
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.00409f10
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x1d0]
pop rbp
ret
Function at 0x40ca00
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x00452e60]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x00452e88], ax
jne 0x40ca6b
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00452e8a]
mov r8d, 0x55
call fcn.0040aba0
lea rcx, [0x00452e60]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40cb76
lea rcx, [0x00452e60]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.00409e30
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40cb30
cmp byte [0x00452e58], 0
je 0x40cac4
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.0040c890
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.0040a320
jmp 0x40cb30
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.0040c5c0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040a320
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x40cb30
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x40cb0f
mov rcx, qword [rbp + 0x28]
lea rdx, [0x0040cbc4]
call fcn.0040ad50
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.0040c5c0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.0040ad50
lea rcx, [0x00452e60]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x00452e88], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.0040aaf0
lea rcx, [0x00452e8a]
mov edx, 0xaa
mov r8, rax
call fcn.0040c370
lea rcx, [0x00452e60]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.00409f10
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x40d5a0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.00409fc0
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040aba0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.0040ae40
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.0040d3c0
test al, al
jne 0x40d66e
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.0040aba0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.0040ae40
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.0040d3c0
test al, al
jne 0x40d66e
mov rcx, qword [rbp + 0x20]
call fcn.00409e30
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00409f10
lea rcx, [rbp + 0x70]
call fcn.00409e30
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret