joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b7de0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6b7fac
sub esp, 0x34
lea eax, [0x7bf340]
mov dword [esp], eax
call fcn.0040eaf0
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x64]
mov edx, dword [esp + 4]
mov dword [esp + 0x24], edx
mov ebx, dword [eax + 0x68]
mov ecx, dword [ecx + 0x10]
mov ebp, dword [eax + 0x74]
mov eax, dword [eax + 0x78]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x1e
mov dword [esp + 0xc], 0x1e
mov dword [esp], ebx
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x6b7f74
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x1e
mov dword [esp + 0x30], 0x1e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
cmp ecx, 3
jbe 0x6b7fa5
add ecx, 0xfffffffc
mov edx, dword [eax]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 0x1a
lea ecx, [eax + 4]
mov dword [esp + 0x28], ecx
cmp edx, 0x4034b50
jne 0x6b7f4c
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
cmp ecx, 0x16
jb 0x6b7f9e
lea ebx, [edx - 0x16]
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and ebx, 0x16
lea esi, [eax + ebx + 4]
mov dword [esp + 0x28], esi
lea edi, [ecx - 0x16]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebp
cmp edi, 1
jbe 0x6b7f97
movzx eax, word [eax + ebx + 4]
add ecx, 0xffffffe8
mov dword [esp + 0x2c], ecx
lea ecx, [edx - 0x18]
mov dword [esp + 0x30], ecx
neg ecx
sar ecx, 0x1f
and ecx, 2
lea edx, [esi + ecx]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
cmp ebp, 1
jbe 0x6b7f90
movzx ecx, word [esi + ecx]
add ebp, 0xfffffffe
mov dword [esp + 0x2c], ebp
add ebx, 0xfffffffe
mov dword [esp + 0x30], ebx
neg ebx
sar ebx, 0x1f
and ebx, 2
add edx, ebx
mov dword [esp + 0x28], edx
lea eax, [eax + ecx + 0x1e]
mov dword [esp + 0x3c], eax
sar eax, 0x1f
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
add esp, 0x34
ret
mov eax, dword [0xcad270]
mov ecx, dword [0xcad274]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x34
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
add esp, 0x34
ret
call fcn.00426a70
ud2
call fcn.00426a70
ud2
call fcn.00426ad0
ud2
call fcn.00426a70
ud2
call fcn.0044c200
jmp fcn.006b7de0
Function at 0x403770
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403813
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00415434
pop ecx
pop ecx
test eax, eax
je 0x4037fc
test ebx, ebx
je 0x4037f0
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00415434
pop ecx
pop ecx
test eax, eax
jle 0x4037fc
push ebx
call fcn.00404730
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.0040470f
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x4037bd
xor edi, edi
cmp ebx, edi
jne 0x403817
xor eax, eax
jmp 0x403883
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403846
call fcn.00404730
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403813
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403813
call fcn.00404730
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403836
cmp dword [ebp - 0x70], edi
je 0x403879
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040470f
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004085d9
add ebp, 0x9c
leave
ret
Function at 0x404925
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.00404792
push 8
mov esi, eax
call fcn.004046c8
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404990
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x404997
and dword [ebx + 4], 0
jmp 0x4049ac
xor eax, eax
jmp 0x404a77
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x404a5d
push edi
call fcn.00407d90
pop ecx
cmp eax, 4
jl 0x404983
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x404983
add eax, 0xfffffffd
push 0x4197ac
push eax
mov dword [ebp - 0x74], eax
call fcn.004085f0
pop ecx
pop ecx
test eax, eax
je 0x4049f2
push 0x4197a8
push dword [ebp - 0x74]
call fcn.004085f0
pop ecx
pop ecx
test eax, eax
jne 0x404983
push 0x3b
push edi
call fcn.00409780
pop ecx
pop ecx
test eax, eax
jne 0x404983
push dword [ebp - 0x78]
call fcn.00407d90
push edi
mov ebx, eax
call fcn.00407d90
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.004046c8
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.00415434
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.00415434
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.004047e8
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x404983
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.00404730
push ebx
call fcn.00404730
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004085d9
add ebp, 0x214
leave
ret
Function at 0x407d7a
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x41e210
call fcn.0040d880
xor esi, esi
cmp dword [0x422fe8], esi
jne 0x407c3a
push esi
push esi
push 1
push esi
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x407c4d
mov dword [ebp - 0x1c], esi
jmp 0x407c83
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x407c48
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x407c48
cmp dword [eax + 0x400074], 0xe
jbe 0x407c48
xor ecx, ecx
cmp dword [eax + 0x4000e8], esi
setne cl
mov dword [ebp - 0x1c], ecx
call fcn.0040d85e
test eax, eax
jne 0x407c94
push 0x1c
call fcn.00415434
pop ecx
call fcn.0040d6e3
test eax, eax
jne 0x407ca5
push 0x10
call fcn.00415434
pop ecx
call fcn.0040d2f3
mov dword [ebp - 4], esi
call fcn.00415434
test eax, eax
jns 0x407cbe
push 0x1b
call fcn.00415434
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x422fe4], eax
call fcn.00415434
mov dword [0x421270], eax
call fcn.0040105b
test eax, eax
jns 0x407ce4
push 8
call fcn.00415434
pop ecx
call fcn.0040cf3b
test eax, eax
jns 0x407cf5
push 9
call fcn.00415434
pop ecx
push 1
call fcn.00415434
pop ecx
cmp eax, esi
je 0x407d08
push eax
call fcn.00415434
pop ecx
mov eax, dword [0x421294]
mov dword [0x421298], eax
push eax
push dword [0x42128c]
push dword [0x421288]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], esi
jne 0x407d35
push eax
call fcn.00415434
call fcn.00408d12
jmp 0x407d6a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.0040d8c5
ret
call fcn.00415434
jmp 0x407c19

Function at 0x4085d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420030]
jne 0x4085e3
repz ret
jmp fcn.004101ab
Function at 0x415434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x415443
pop dword [ebp - 0x28]
mov eax, 0x3ac22bce
add eax, 0xc57f2875
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x5570c130
add dword [ebp - 0x38], 0xf8e1841b
mov dword [ebp - 0x34], 0x44b441b0
add dword [ebp - 0x34], 0xed7f0a95
mov dword [ebp - 0x30], 0xd38036bd
add dword [ebp - 0x30], 0x78cc0d71
mov dword [ebp - 0x2c], 0x53d407f4
sub dword [ebp - 0x2c], 0x53d407f4
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa0246be
add eax, 0xf63f3992
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x6dd10b92
sub dword [ebp - 0x38], 0xf95ea23c
mov dword [ebp - 0x34], 0xf0e1908
add dword [ebp - 0x34], 0x325e486d
mov dword [ebp - 0x30], 0xd9da27e0
sub dword [ebp - 0x30], 0x766abb74
mov dword [ebp - 0x2c], 0x9059bbc2
add dword [ebp - 0x2c], 0x6fa6443e
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xb92e992f
sub eax, 0xb8ed18e3
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3b826
push 0
call eax
mov ecx, 0x2d033258
sub ecx, 0x2d02eace
xor ebx, ebx
add ebx, eax
mov esi, 0x42d800
add esi, dword [ebp - 0x28]
mov edi, 0x2b53e8ff
sub edi, 0x5a020f93
xor dword [ebp - 0x14], 0xd3acc40a
mov edx, dword [esi]
add edx, edi
sub dword [ebp - 0x20], 0x5b1e14f2
mov dword [ebx], edx
add dword [ebp - 0x24], esi
add ebx, 0x616eacf4
add ebx, 0x9e915310
add esi, 4
loop 0x415561
add eax, 0x97efa340
add eax, 0x68116dbb
xor ebx, ebx
add ebx, eax
add eax, 0x674f375d
sub eax, 0x674f3758
mov ecx, 0xd0e369bf
add ecx, 0x2f5c9641
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40645d
pop dword [ebp - 0x4c]
mov eax, 0x5e29b22b
add eax, 0xa216b232
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xb58040fc
sub dword [ebp - 0x5c], 0x672dfbb1
mov dword [ebp - 0x58], 0xfb3ee757
sub dword [ebp - 0x58], 0xc90b9b12
mov dword [ebp - 0x54], 0xc9690a59
sub dword [ebp - 0x54], 0x7d1cc62b
mov dword [ebp - 0x50], 0xa2458f5f
sub dword [ebp - 0x50], 0xa2458f5f
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x6a25e8a5
sub eax, 0x69e5682d
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x47de3756
add dword [ebp - 0x5c], 0x2c943200
mov dword [ebp - 0x58], 0x2f908e03
add dword [ebp - 0x58], 0x11dbd372
mov dword [ebp - 0x54], 0x54f465d3
sub dword [ebp - 0x54], 0xf184f967
mov dword [ebp - 0x50], 0xd263d86
add dword [ebp - 0x50], 0xf2d9c27a
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x40a111f3
add eax, 0xbf9f6e89
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x35efb
push 0
call eax
mov ecx, 0x4389
mov edi, eax
mov edx, 0x133cbc50
sub edx, 0x12f7a850
add edx, dword [ebp - 0x4c]
mov esi, 0xc16a630f
sub dword [ebp - 0x18], edi
mov ebx, dword [edx]
sub dword [ebp - 0x44], 0x7c1ea5de
xor ebx, esi
xor dword [ebp - 0x18], 0xa7919e6d
mov dword [edi], ebx
sub dword [ebp - 0x48], 0xb5a46ca5
add edi, 0xdbcf9efe
add edi, 0x24306106
add edx, 4
loop 0x406573
add eax, 0x100f7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfd82b35e
sub ecx, 0xfd42b35e
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x404590
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4045d2
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x4045f2
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.004078f0
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x4047e8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406e94
test esi, esi
jne 0x40481e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406ffc
jmp 0x40483c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040472c
mov edi, eax
test esi, esi
je 0x40483c
cmp dword [ebx], 0
je 0x40483c
dec esi
jmp 0x404825
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x405bf4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405fe0
mov byte [esp], al
cmp byte [esp], 0
jne 0x405d7d
test edi, edi
je 0x405d7d
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405cb4
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x405c8f
cmp edi, 0xffffffff
je 0x405c53
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405c53
mov byte [esp], 0
jmp 0x405d7d
mov ebx, dword [esi]
cmp ebx, 1
jg 0x405c8f
test ebx, ebx
jne 0x405c88
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402594
test eax, eax
jne 0x405c88
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405d7d
pause
dec ebp
test ebp, ebp
jg 0x405c38
cmp edi, 0xffffffff
je 0x405cb4
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405cb2
mov byte [esp], 0
jmp 0x405d7d
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x405c02
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402594
cmp ebx, eax
jne 0x405cb4
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405df0
mov edx, eax
mov ebx, dword [0x5528c8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x405d1b
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405d19
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x405d1b
xor edi, edi
cmp byte [esp], 0
je 0x405d44
mov ebx, dword [esi]
test bl, 1
jne 0x405d5d
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402594
cmp ebx, eax
jne 0x405d21
mov byte [esp + 1], 1
jmp 0x405d5d
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402594
cmp ebx, eax
jne 0x405d44
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x405cce
cmp byte [esp], 0
je 0x405d7d
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406af8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x552050], 0
je 0x406b59
cmp word [0x55232c], 0xd7b2
jne 0x406b21
cmp dword [0x552334], 0
jbe 0x406b21
mov eax, 0x552328
call dword [0x552344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406b84
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x54c028], 0
jne 0x406b75
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x54c02c], 0
je 0x406d7b
mov edx, edi
mov eax, esi
call dword [0x54c02c]
mov ebx, eax
jmp 0x406d8c
mov eax, 8
call fcn.004043d8
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x552051], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406d18
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x406dc1
mov edx, 8
mov eax, ebx
call fcn.004043f4
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x408f8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4090f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406e94
cmp si, word [0x54c7fc]
jb 0x409024
cmp si, word [0x54c9fc]
ja 0x409024
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x409024
mov ebx, dword [ebp - 8]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x54c7fc]
jae 0x408ffe
mov edi, ebx
dec edi
jmp 0x40901f
cmp si, word [ebx*8 + 0x54c7fc]
jbe 0x40900e
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40901f
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x54c800]
call fcn.00408e9c
jmp 0x409024
cmp edi, dword [ebp - 8]
jae 0x408fe8
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4090d3
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4090d3
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004078f0
push dword [ebp - 0x160]
push 0x40910c
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004078f0
push dword [ebp - 0x164]
push 0x40911c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004078f0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00407b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4090f8
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406ef4
ret
Function at 0x4092a4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4093a7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x554b51
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x554b6a]
jne 0x4092f0
mov eax, esi
mov edx, 0x554b6c
mov ecx, 0x55
call fcn.004078f0
push 0x554b51
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x409391
push 0x554b51
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406e94
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40935f
cmp byte [0x554b50], 0
je 0x409324
mov edx, esi
mov eax, ebx
call fcn.00409188
jmp 0x40935f
mov edx, esi
mov eax, ebx
call fcn.00408f8c
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40935f
cmp dword [esi], 0
je 0x409348
mov eax, esi
mov edx, 0x4093c0
call fcn.00407a48
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408f8c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407a48
push 0x554b51
call sub.kernel32.dll_EnterCriticalSection
mov word [0x554b6a], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407854
push eax
push 0x554b6c
call sub.kernel32.dll_lstrcpynW
push 0x554b51
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093ae
lea eax, [ebp - 4]
call fcn.00406e94
ret
Function at 0x4095dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f78
xor eax, eax
push ebp
push 0x409801
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40961c
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x409636
push 0x105
mov eax, dword [ebp - 4]
call fcn.00407854
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x4097eb
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409810
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409705
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409810
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409705
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40984c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409705
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40984c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409705
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409880
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409705
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4098b4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4097eb
xor eax, eax
push ebp
push 0x4097e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.004093e8
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409774
mov eax, dword [ebp - 0x10]
call fcn.004043d8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004078b4
jmp 0x4097bf
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x4098f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4097bf
mov eax, dword [ebp - 0x10]
call fcn.004043d8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x4098f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004078b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4097eb
cmp dword [ebp - 8], 0
je 0x4097da
mov eax, dword [ebp - 8]
call fcn.004043f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409808
lea eax, [ebp - 4]
call fcn.00406e94
ret