joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418c29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x418ce7
cmp dword [esi + 0x20], 0
je 0x418ce7
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x418ce7
cmp dword [ebp + 8], 0
je 0x418ce7
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00415f9a
push 0x574b50
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x418cb8
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x418ce7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004b1f09
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x418cd8
test edi, edi
je 0x418cd8
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x418ce3
mov ecx, esi
call fcn.004189cb
mov eax, ebx
jmp 0x418ce9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41d687
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5651b0
call fcn.00547ae9
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x41d6ad
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41d70d
call fcn.0041ef33
push eax
lea ecx, [ebp - 0x10]
call fcn.004028b7
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5729c8]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0054feb6
push eax
call fcn.00402ff5
add esp, 0x14
test esi, esi
je 0x41d700
push esi
call fcn.0054c6c0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040af4d
mov eax, ebx
call fcn.00547ab2
ret 8

Function at 0x4268c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x4268e2
call fcn.00415f9a
mov esi, dword [eax + 0xc]
push 0x5751c4
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x426938
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x426938
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x426917
xor esi, esi
jmp 0x42692d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00426941
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x42693a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4b254e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x4b2579
cmp dword [ebx + 0x80], 0
jne 0x4b2579
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.00415f9a
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.004b280a
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4b25b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00415f9a
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4b25ea
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004b2609
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4b46f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x4b474a
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4b4723
call fcn.00420692
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4b4738
call fcn.00420692
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4b474a
call fcn.00420692
call fcn.00415f9a
cmp dword [eax + 0x3c], 0
je 0x4b475f
push edi
mov ecx, ebx
call fcn.004b3e24
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004b4931
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4b4788
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4b4794
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x50c3d5
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.00552c3f
pop ecx
test eax, eax
jne 0x50c417
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00410a55
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x50c3dd
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x51ac23
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.0041d264
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.0051ae3c
cmp esi, 3
je 0x51ac61
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x51acaa
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x51ac84
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00418284
jmp 0x51ac95
push 0xff
mov ecx, esi
call fcn.0040ae13
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004107f3
jmp 0x51acce
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x51acce
push dword [esi]
push dword [ebp - 4]
call fcn.0048b43c
pop edi
pop esi
leave
ret 0xc

Function at 0x51ad93
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0051ae3c
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x51addb
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00418284
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004107f3
jmp 0x51ade6
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0048b43c
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x541445
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00546bfc
call fcn.00415fee
cmp dword [eax + 0x14], 0
jne 0x541460
mov ecx, esi
pop esi
jmp fcn.00540770
pop esi
ret

Function at 0x5422fd
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401d67
call fcn.00415fee
cmp dword [eax + 0x14], 0
jne 0x542318
mov ecx, esi
pop esi
jmp fcn.00541b78
pop esi
ret

Function at 0x5602fc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055ffbc
Function at 0x406ac0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004093e4
test esi, esi
jne 0x406af6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040956c
jmp 0x406b14
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004069a4
mov edi, eax
test esi, esi
je 0x406b14
cmp dword [ebx], 0
je 0x406b14
dec esi
jmp 0x406afd
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x408098
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040847c
mov byte [esp], al
cmp byte [esp], 0
jne 0x408222
test edi, edi
je 0x408222
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408162
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x40813d
cmp edi, 0xffffffff
je 0x4080fd
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4080fd
mov byte [esp], 0
jmp 0x408222
mov ebx, dword [esi]
cmp ebx, 1
jg 0x40813d
test ebx, ebx
jne 0x40812f
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40812f
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408222
lea eax, [esp + 0xc]
call fcn.00407d78
dec ebp
test ebp, ebp
jg 0x4080e2
cmp edi, 0xffffffff
je 0x408162
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408160
mov byte [esp], 0
jmp 0x408222
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4080a6
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408162
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408290
mov edx, eax
mov ebx, dword [0x6828fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4081c6
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4081c4
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4081c6
xor edi, edi
cmp byte [esp], 0
je 0x4081ec
mov ebx, dword [esi]
test bl, 1
jne 0x408202
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4081cc
mov byte [esp + 1], 1
jmp 0x408202
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4081ec
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408179
cmp byte [esp], 0
je 0x408222
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409044
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x68205c], 0
je 0x4090ab
cmp word [0x682348], 0xd7b2
jne 0x40906d
cmp dword [0x682350], 0
jbe 0x40906d
mov eax, 0x682344
call dword [0x682360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4090d8
call fcn.00409c28
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x678032], 0
jne 0x4090c7
push 0
push 0x6789c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4092a4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x678034], 0
je 0x4092cf
mov edx, edi
mov eax, esi
call dword [0x678034]
mov ebx, eax
jmp 0x4092e0
mov eax, 8
call fcn.004066e0
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x68205d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40926c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409310
mov eax, ebx
call fcn.004066fc
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40bba8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40bd0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004093e4
cmp si, word [0x678a00]
jb 0x40bc40
cmp si, word [0x678c00]
ja 0x40bc40
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40bc40
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x678a00]
jae 0x40bc1a
mov edi, ebx
dec edi
jmp 0x40bc3b
cmp si, word [ebx*8 + 0x678a00]
jbe 0x40bc2a
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40bc3b
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x678a04]
call fcn.0040bac8
jmp 0x40bc40
cmp edi, dword [ebp - 8]
jae 0x40bc04
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40bcef
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40bcef
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a0d8
push dword [ebp - 0x160]
push 0x40bd28
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a0d8
push dword [ebp - 0x164]
push 0x40bd38
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a0d8
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040a310
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bd14
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409444
ret
Function at 0x40bec0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bfc4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x684b8c
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x684ba4]
jne 0x40bf0c
mov eax, esi
mov edx, 0x684ba6
mov ecx, 0x55
call fcn.0040a0d8
push 0x684b8c
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40bfae
push 0x684b8c
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.004093e4
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40bf7b
cmp byte [0x684b88], 0
je 0x40bf40
mov edx, esi
mov eax, ebx
call fcn.0040bda4
jmp 0x40bf7b
mov edx, esi
mov eax, ebx
call fcn.0040bba8
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40bf7b
cmp dword [esi], 0
je 0x40bf64
mov eax, esi
mov edx, 0x40bfdc
call fcn.0040a230
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040bba8
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a230
push 0x684b8c
call sub.kernel32.dll_EnterCriticalSection
mov word [0x684ba4], bx
mov eax, dword [esi]
call fcn.0040a034
mov ecx, eax
mov eax, 0x684ba6
mov edx, 0xaa
call fcn.0040ba28
push 0x684b8c
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bfcb
lea eax, [ebp - 4]
call fcn.004093e4
ret
Function at 0x40c1f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x40c419
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40c234
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40c24e
mov eax, dword [ebp - 4]
call fcn.0040a034
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040ba28
cmp word [ebp - 0x21a], 0
je 0x40c403
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c428
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c31d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c428
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c31d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c464
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c31d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c464
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c31d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c498
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c31d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c4cc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40c403
xor eax, eax
push ebp
push 0x40c3fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040c004
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40c38c
mov eax, dword [ebp - 0x10]
call fcn.004066e0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040a09c
jmp 0x40c3d7
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40c50c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40c3d7
mov eax, dword [ebp - 0x10]
call fcn.004066e0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40c50c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040a09c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c403
cmp dword [ebp - 8], 0
je 0x40c3f2
mov eax, dword [ebp - 8]
call fcn.004066fc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c420
lea eax, [ebp - 4]
call fcn.004093e4
ret
Function at 0x40c708
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x40c7c8
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a0d8
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a288
mov eax, dword [ebx]
call fcn.0040c5d0
test al, al
jne 0x40c7a5
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a0d8
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a288
mov eax, dword [ebx]
call fcn.0040c5d0
test al, al
jne 0x40c7a5
mov eax, ebx
call fcn.004093e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c7cf
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409444
lea eax, [ebp - 4]
call fcn.004093e4
ret

Function at 0x4214f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x42154d
test eax, edx
je 0x421550
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42150b
movzx eax, word [eax]
sub eax, ecx
jmp 0x421532
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x421533
add ecx, 4
js 0x421523
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x421530
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x421532
xor eax, eax
ret
test eax, eax
je 0x42155c
test edx, edx
jne 0x4214fc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x422a34
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x422a61
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4