joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4033db
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403412
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40340e
jmp 0x403400
cmp esi, eax
jae 0x403412
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403400
cmp esi, eax
jb 0x403419
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4049d0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea edi, [eax + 4]
push edi
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x404a21
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 2
push 0
push 0
push 0
push 1
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x404a30
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x56a5dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push ecx
push eax
mov edi, edx
push str._s_failed_w_err_0x_08lx
lea edx, [ebp - 0x20c]
call fcn.00404ad0
add esp, 0xc
add edi, 4
push edi
push 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x404aba
push 0
lea eax, [ebp - 0x214]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
lea edx, [ebp - 0x20c]
push esi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret 4
Function at 0x404db0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x404de9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.004faf08
add esp, 8
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 8], eax
test eax, eax
je 0x404e6e
mov eax, dword [ebp + 8]
push edi
push 2
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x404e2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x54bef8
call fcn.004faf08
add esp, 8
pop edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
push 1
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ebx, eax
test ebx, ebx
jne 0x404e5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig2_failed_w_err_0x_08lx_n
call fcn.004faf08
add esp, 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e90
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51faeb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x56a5dc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x206
xor ebx, ebx
mov edi, ecx
lea edx, [ebp - 0x21a]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x23c], eax
mov word [ebp - 0x21c], cx
call fcn.004fd040
xor eax, eax
add esp, 0xc
mov word [ebp - 0x238], ax
push 1
mov eax, 0x54bef4
lea esi, [ebp - 0x238]
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], ebx
call fcn.00401fb0
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x404f47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.004faf08
add esp, 8
jmp 0x40506e
push 3
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x404f70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.004faf08
add esp, 8
jmp 0x40506e
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404f80
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x238]
call fcn.00401ce0
push 1
mov eax, 0x54bef4
lea ecx, [ebp - 0x238]
call fcn.00401ce0
cmp dword [ebp - 0x224], 8
mov eax, dword [ebp - 0x238]
jae 0x404fc8
lea eax, [ebp - 0x238]
mov edx, dword [ebp - 0x23c]
push 0
push 0
push 0x54c364
push 0
push 0
push eax
push 1
push 2
push 0x110
push 0xf01ff
push edx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x40500c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
call fcn.004faf08
jmp 0x40505b
push edi
push str._s_is_installed._n
call fcn.004faf08
add esp, 8
push 0x114
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40503b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x54bef8
jmp 0x405056
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x40505e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartService_failed_w_err_0x_08lx_n
call fcn.004020e0
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
test esi, esi
je 0x40506e
push esi
call edi
cmp dword [ebp - 0x224], 8
jb 0x405086
mov eax, dword [ebp - 0x238]
push eax
call fcn.00406b3b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
Function at 0x4050b0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x56a5dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push edi
push 1
push eax
mov ebx, ecx
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
jne 0x405115
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.004faf08
add esp, 8
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
push esi
push 0x10124
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40513a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x54bef8
jmp 0x4051e3
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4051c4
push ebx
push str.Stopping__s.
call fcn.004faf08
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [ebp - 0x20]
push ecx
push esi
call ebx
test eax, eax
je 0x40519c
cmp dword [ebp - 0x1c], 3
jne 0x40519c
push 0x54c0bc
call fcn.004faf08
add esp, 4
push 0x3e8
call edi
lea edx, [ebp - 0x20]
push edx
push esi
call ebx
test eax, eax
jne 0x405177
cmp dword [ebp - 0x1c], 1
jne 0x4051ad
mov eax, dword [ebp - 0x24]
push eax
push 0x54c0c0
jmp 0x4051b6
mov ecx, dword [ebp - 0x24]
push ecx
push str._n_s_failed_to_stop._n
call fcn.004faf08
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4051dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteService_failed_w_err_0x_08lx_n
jmp 0x4051e3
push ebx
push str._s_is_removed._n
call fcn.004faf08
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test esi, esi
je 0x4051fb
push esi
call edi
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
Function at 0x405210
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x56a5dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push 0
push 0
mov esi, ecx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x405256
push 0x14
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x405269
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40529d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
cmp eax, 4
je 0x4052f2
cmp eax, 1
jne 0x4052f4
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
setne bl
test bl, bl
je 0x405278
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
jne 0x4052f4
mov edi, edi
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1c], 4
je 0x4052f2
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
je 0x4052d0
jmp 0x4052f4
mov bl, 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
Function at 0x405320
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x56a5dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push edi
push 1
push eax
mov ebx, ecx
push eax
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x21], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2c], edi
test edi, edi
jne 0x40538c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.004faf08
mov al, byte [ebp - 0x21]
add esp, 8
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
push esi
push 0x10124
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4053b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x54bef8
call fcn.004faf08
jmp 0x405443
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x405446
push ebx
push str.Stopping__s.
call fcn.004faf08
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [ebp - 0x20]
push ecx
push esi
call ebx
test eax, eax
je 0x405418
cmp dword [ebp - 0x1c], 3
jne 0x405418
push 0x54c0bc
call fcn.004faf08
add esp, 4
push 0x3e8
call edi
lea edx, [ebp - 0x20]
push edx
push esi
call ebx
test eax, eax
jne 0x4053f3
cmp dword [ebp - 0x1c], 1
jne 0x405432
mov eax, dword [ebp - 0x28]
push eax
push 0x54c0c0
call fcn.004faf08
mov byte [ebp - 0x21], 1
jmp 0x405440
mov ecx, dword [ebp - 0x28]
push ecx
push str._n_s_failed_to_stop._n
call fcn.004faf08
mov edi, dword [ebp - 0x2c]
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test esi, esi
je 0x405456
push esi
call edi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
Function at 0x405470
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4054a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed___d__n
call fcn.00402280
add esp, 8
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
push 2
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4054d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed___d__n
call fcn.00402280
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
ret
cmp byte [ebp + 0xc], 0
mov eax, 2
je 0x4054e4
mov eax, 3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x405526
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig_failed___d__n
call fcn.00402280
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebp
ret
push str.Service_disabled_successfully._n
call fcn.00402280
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebp
ret
Function at 0x406350
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x56a5dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
push esi
call fcn.00406280
add esp, 4
test eax, eax
je 0x40638b
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x410]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x406395
lea eax, [ebp - 0x410]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4063b0
sub eax, edx
sar eax, 1
lea ecx, [ebp + eax*2 - 0x412]
movzx eax, word [ecx]
mov edx, 0x2f2f
cmp ax, dx
je 0x4063d8
cmp eax, 0x2f
jne 0x4063e0
mov eax, 0x2f30
mov word [ecx], ax
lea eax, [ebp - 0x410]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4063f0
sub eax, edx
push pe_nt_image_headers32
sar eax, 1
lea ecx, [ebp - 0x208]
mov esi, eax
push 0
push ecx
mov dword [ebp - 0x418], esi
call fcn.004fd040
add esp, 0xc
xor ebx, ebx
test esi, esi
jle 0x406529
xor edx, edx
mov word [ebp - 0x412], dx
movzx eax, word [ebp + ebx*2 - 0x410]
mov ecx, 0x2f2f
cmp ax, cx
je 0x40647e
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x414]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406451
lea edi, [ebp - 0x208]
sub eax, edx
add edi, 0xfffffffe
jmp 0x406470
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x406470
jmp 0x4064dc
push 0
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4064a3
push 0x80
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, 0x2f2f
lea eax, [ebp - 0x414]
mov word [ebp - 0x414], cx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4064b7
lea edi, [ebp - 0x208]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4064d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x418]
and ecx, 3
dec eax
rep movsb byte es:[edi], byte [esi]
cmp ebx, eax
jne 0x40651c
push 0
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40651c
push 0x80
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc ebx
cmp ebx, dword [ebp - 0x418]
jl 0x406430
lea ecx, [ebp - 0x208]
push ecx
call fcn.00406280
mov ecx, dword [ebp - 4]
add esp, 4
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.004fa0b9
mov esp, ebp
pop ebp
ret
Function at 0x406860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4068d2
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4068a1
cmp eax, 2
jne 0x4068bc
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x4068cc
test eax, eax
je 0x4068c7
test al, 1
jne 0x4068bc
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4068cc
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x408402
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x56a5dc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x408447
push 0x523078
push 4
push eax
call fcn.004fb96f
push eax
call fcn.00403470
add esp, 0x10
jmp 0x40845d
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4084dd
push edi
call fcn.004fc05a
mov edi, dword [eax]
call fcn.004fc05a
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.004fbff7
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.004fc05a
cmp dword [eax], 0
je 0x4084b1
call fcn.004fc05a
push dword [eax]
call fcn.00406ebf
pop ecx
jmp 0x4084b8
call fcn.004fc05a
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
pop edi
je 0x4084dd
cmp dword [ebp - 0x234], esi
jae 0x4084dd
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4084df
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004fa0b9
leave
ret
Function at 0x408a49
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x56a5dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.004089aa
pop ecx
cmp eax, esi
je 0x408b33
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x408b33
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.004fd040
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x408b33
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x408b33
cmp esi, 0x14
jge 0x408b33
push 0x10
push 0
push edi
call fcn.004fd01b
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x408b22
call fcn.004fc05a
cmp dword [eax], 0x22
je 0x408b22
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.004fb954
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x408af8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x56bb6c], 0
jne 0x408bbe
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x408be7
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.00408402
pop ecx
pop ecx
test eax, eax
jne 0x408be9
inc edi
cmp edi, esi
jl 0x408bc4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa0b9
leave
ret 8

Function at 0x40d197
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x56a5dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x40d1cc
xor eax, eax
jmp 0x40d21f
lea eax, [ebp - 0x210]
push eax
call fcn.004fb954
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x40d1fd
push 0x54b87c
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004fd0ba
add esp, 0xc
test eax, eax
jne 0x40d1c8
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004fd0ba
add esp, 0xc
test eax, eax
jne 0x40d1c8
lea eax, [ebp - 0x210]
push eax
call fcn.004089aa
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004fa0b9
leave
ret