joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4212d9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x421307
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x42130e
cmp ebx, dword [eax + 4]
jae 0x42130e
xor eax, eax
jmp 0x4214fe
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x42131f
xor eax, eax
inc eax
jmp 0x4214fd
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x421335
cmp ecx, edx
jae 0x42147a
cmp dword [eax + 4], 0
je 0x42133e
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x421326
cmp dword [ebp + 8], 0
je 0x421360
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x42147a
cmp eax, esi
jae 0x42147a
mov eax, dword [0x455940]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x421385
cmp dword [esi*4 + 0x455948], edi
je 0x42147e
inc esi
cmp esi, eax
jl 0x421373
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4214fa
cmp dword [ebp - 8], 0x1000000
jne 0x4214fa
test byte [ebp - 0xc], 0xcc
je 0x421403
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4214fa
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4214fa
cmp word [eax + 0x18], 0x10b
jne 0x4214fa
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4214fa
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x421403
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x421403
test byte [ecx + 0x27], 0x80
jne 0x42147a
push 1
push 0x455988
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x421317
mov ecx, dword [0x455940]
test ecx, ecx
mov edx, ecx
jle 0x421437
lea eax, [ecx*4 + 0x455944]
cmp dword [eax], edi
je 0x421437
dec edx
sub eax, 4
test edx, edx
jg 0x42142b
test edx, edx
jne 0x421468
push 0xf
pop ebx
cmp ecx, ebx
jg 0x421444
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x42145c
lea eax, [edx*4 + 0x455948]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x42144a
cmp ecx, 0x10
jge 0x421468
inc ecx
mov dword [0x455940], ecx
push 0
push 0x455988
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x421317
xor eax, eax
jmp 0x4214fd
test esi, esi
jle 0x421317
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x455988
call ebx
test eax, eax
jne 0x421317
cmp dword [esi*4 + 0x455948], edi
je 0x4214d4
mov eax, dword [0x455940]
lea esi, [eax - 1]
test esi, esi
jl 0x4214c2
cmp dword [esi*4 + 0x455948], edi
je 0x4214be
dec esi
jns 0x4214b2
test esi, esi
jge 0x4214d2
cmp eax, 0x10
jge 0x4214cd
inc eax
mov dword [0x455940], eax
lea esi, [eax - 1]
jmp 0x4214d4
je 0x4214ec
xor ecx, ecx
test esi, esi
jl 0x4214ec
lea eax, [ecx*4 + 0x455948]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4214da
push 0
push 0x455988
call ebx
jmp 0x421317
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423c52
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x455a78], ebx
push esi
push edi
jne 0x423cd2
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x423d0d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x455a78], eax
je 0x423d0d
push 0x446f14
push edi
call esi
push 0x446f00
push edi
mov dword [0x455a7c], eax
call esi
cmp dword [0x455568], 2
mov dword [0x455a80], eax
jne 0x423cd2
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x455a88], eax
je 0x423cd2
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x455a84], eax
mov eax, dword [0x455a84]
test eax, eax
je 0x423d17
call eax
test eax, eax
je 0x423cfe
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x455a88]
test eax, eax
je 0x423cfe
test byte [ebp - 8], 1
jne 0x423d17
cmp dword [0x455574], 4
jb 0x423d11
or byte [ebp + 0x12], 0x20
jmp 0x423d36
xor eax, eax
jmp 0x423d46
or byte [ebp + 0x12], 4
jmp 0x423d36
mov eax, dword [0x455a7c]
test eax, eax
je 0x423d36
call eax
mov ebx, eax
test ebx, ebx
je 0x423d36
mov eax, dword [0x455a80]
test eax, eax
je 0x423d36
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x455a78]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427a7f
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0041b590
mov eax, dword [str.D__4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0042312a
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x427bb2
push 2
push esi
push dword [ebp + 8]
call fcn.0042312a
add esp, 0xc
cmp eax, ebx
je 0x427bb2
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x427b52
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0041aac0
push 0x8000
push dword [ebp + 8]
call fcn.004281b4
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x427b08
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.00420249
add esp, 0xc
cmp eax, 0xffffffff
je 0x427b28
sub edi, eax
test edi, edi
jg 0x427b00
jmp 0x427b40
call fcn.0041c4e6
cmp dword [eax], 5
jne 0x427b3d
call fcn.0041c4dd
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.004281b4
pop ecx
pop ecx
jmp 0x427b9a
jge 0x427b9a
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042312a
push dword [ebp + 8]
call fcn.0041c197
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x427b9a
call fcn.0041c4dd
mov dword [eax], 0xd
call fcn.0041c4e6
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0042312a
add esp, 0xc
mov eax, esi
pop edi
jmp 0x427bb4
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0041ab51
leave
ret
Function at 0x4286cf
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x4286e8
or eax, 0xffffffff
jmp 0x428749
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x428745
push 0x3d
push esi
call fcn.004288cf
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x428745
cmp esi, eax
je 0x428745
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x455588]
sete cl
cmp eax, dword [0x45558c]
mov dword [ebp - 8], ecx
jne 0x42872b
mov edi, eax
call fcn.0042866e
mov dword [0x455588], eax
cmp eax, ebx
jne 0x428784
cmp dword [ebp + 0xc], ebx
je 0x42874d
cmp dword [0x455590], ebx
je 0x42874d
call fcn.00427e6c
test eax, eax
je 0x428784
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x428756
xor eax, eax
jmp 0x428748
push 4
call fcn.0041baf0
cmp eax, ebx
pop ecx
mov dword [0x455588], eax
je 0x428745
mov dword [eax], ebx
cmp dword [0x455590], ebx
jne 0x428784
push 4
call fcn.0041baf0
cmp eax, ebx
pop ecx
mov dword [0x455590], eax
je 0x428745
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x455588]
call fcn.00428621
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x4287e5
cmp dword [esi], ebx
je 0x4287e5
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0041b9d8
cmp dword [ebp - 8], ebx
pop ecx
jne 0x4287c8
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x428826
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x4287bf
mov eax, edi
shl eax, 2
push eax
push dword [0x455588]
call fcn.0041bb38
cmp eax, ebx
pop ecx
pop ecx
je 0x428826
jmp 0x428821
cmp dword [ebp - 8], ebx
jne 0x428891
cmp edi, ebx
jge 0x4287f4
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x455588]
call fcn.0041bb38
cmp eax, ebx
pop ecx
pop ecx
je 0x428745
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x455588], eax
cmp dword [ebp + 0xc], ebx
je 0x42887b
push dword [ebp - 4]
call fcn.0041aba0
inc eax
inc eax
push eax
call fcn.0041baf0
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x42887b
push dword [ebp - 4]
push esi
call fcn.0041b680
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x428874
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0041b9d8
pop ecx
cmp dword [ebp - 8], ebx
je 0x428889
push dword [ebp - 4]
call fcn.0041b9d8
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x428748
push dword [ebp - 4]
call fcn.0041b9d8
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x428752
Function at 0x430dae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x54], 0
mov eax, dword [edi + 0x58]
mov esi, dword [edi + 0x5c]
mov dword [ebp - 4], eax
je 0x430de5
call fcn.0043990e
mov ebx, dword [eax + 0xc]
push 5
push dword [edi + 0x54]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x430df6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor ebx, ebx
inc ebx
test esi, esi
je 0x430e2f
cmp word [esi + 2], 0xffff
mov ecx, dword [esi]
jne 0x430e14
mov ecx, dword [esi + 0xc]
mov ax, word [esi + 0x12]
mov si, word [esi + 0x14]
jmp 0x430e1c
mov ax, word [esi + 0xa]
mov si, word [esi + 0xc]
test cx, 0x1801
jne 0x430e2d
test ax, ax
jne 0x430e2d
test si, si
je 0x430e2f
xor ebx, ebx
cmp dword [edi + 0x54], 0
je 0x430e3e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x433934
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x43396d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004189dd
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004189b8
pop esi
ret 4
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x434b74
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x434bb7
call fcn.0043990e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x434bb7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x434bd2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00433cec
test ebx, ebx
mov esi, eax
je 0x434bd0
test edi, edi
je 0x434bd0
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x436c89
Capabilities:
Get disk information

Disassembly:
mov eax, 0x43d300
call fcn.0041aa98
sub esp, 0x260
mov eax, dword [str.D__4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x264]
push eax
push edi
mov esi, 0x104
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor ebx, ebx
cmp eax, ebx
jne 0x436cd1
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x436cd5
cmp eax, esi
jb 0x436cdc
xor eax, eax
jmp 0x436db5
call fcn.00431677
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.00436c47
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x436da5
push ebx
push ebx
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x436d30
xor esi, esi
jmp 0x436da8
test byte [ebp - 0x268], 2
jne 0x436d40
push edi
call dword [sym.imp.USER32.dll_CharUpperW]
test byte [ebp - 0x268], 4
jne 0x436da5
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x436da5
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x264], ebx
je 0x436d2c
cmp dword [ebp - 0x264], edi
jbe 0x436d2c
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x264]
sub ecx, edi
sar ecx, 1
add ecx, eax
cmp ecx, esi
jge 0x436d2c
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor esi, esi
inc esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004010aa
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0041ab51
leave
ret 8
Function at 0x436f61
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x22c
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.0041aac0
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [edi + 4]
cmp eax, dword [0x445c10]
je 0x437068
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x436fd1
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x436fd8
cmp ebx, ebx
jne 0x436fd8
xor eax, eax
jmp 0x43706b
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x436fe5
mov byte [esi + 0x20], bl
jmp 0x436ff9
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00419c43
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.00419c43
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.00419c43
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x437054
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x437068
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x438644
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [str.D__4]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x438693
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
jne 0x438693
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43869f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0041ab51
leave
ret 8
Function at 0x438fa5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [str.D__4]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x438ff2
push dword [ebp + 8]
call fcn.0043b594
mov esi, eax
test esi, esi
je 0x43901a
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x43901a
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push 0x441ea0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0041ab51
leave
ret 0xc

Function at 0x43a3d3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [ebp + 0xc], 0x800
mov eax, dword [str.D__4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
jne 0x43a431
push 0x445608
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.0041be37
add esp, 0x10
cmp eax, 0xffffffff
je 0x43a445
cmp eax, esi
jae 0x43a445
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x43a447
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x43a3fc
jmp 0x43a448
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.0041ab51
leave
ret
Function at 0x43a468
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [str.D__4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebx, ebx
push 0x4456b4
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43a50a
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x28], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x2c], ecx
call esi
push dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x28], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x3c], eax
push 4
xor ebx, ebx
jmp 0x43a60c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x43a5ba
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43a60d
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43a5af
cmp dword [ebp - 0x34], 1
jne 0x43a5af
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x24]
push 0x445624
push eax
call fcn.0041bb02
add esp, 0xc
cmp eax, 1
jne 0x43a5af
mov eax, dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x28], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x48], eax
call esi
push 2
mov dword [ebp - 0x44], eax
pop esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43a60d
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x43a60d
lea ecx, [ebp - 0x28]
push ecx
push 0x43a452
push 1
push 0x10
push eax
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
cmp word [ebp - 0x28], bx
je 0x43a60d
movzx eax, word [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x48], eax
call esi
mov dword [ebp - 0x44], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x48], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x43a633
push dword [ebp + edi*4 - 0x48]
push dword [ebp + 8]
call fcn.0043a3d3
cmp eax, ebx
pop ecx
pop ecx
jne 0x43a635
inc edi
cmp edi, esi
jl 0x43a61c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0041ab51
leave
ret 4
Function at 0x43a644
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x451f04
je 0x43a700
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43a6e8
mov esi, dword [ebx + 4]
jmp 0x43a6e2
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43a6d2
cmp dword [ebp - 0xc], 4
jne 0x43a6d2
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x43a6ca
or dword [eax + 0x9c], ecx
jmp 0x43a6d2
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x43a696
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x43a679
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x43aabc
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x43d1da
call fcn.0041aa98
sub esp, 0x220
mov eax, dword [str.D__4]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x228]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x43abb5
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x43ab89
and dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x224]
call fcn.0040630c
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.0043aabc
mov ecx, dword [ebp - 0x224]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004010aa
test bl, bl
jne 0x43ab89
or dword [ebp - 4], 0xffffffff
jmp 0x43aafa
cmp esi, 0x103
je 0x43ab99
cmp esi, 0x3f2
jne 0x43aba9
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0041ab51
pop edi
pop esi
pop ebx
leave
ret 8