joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cc00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41cc7b
test byte [ebx + 0x20], 0x30
je 0x41cc82
mov eax, dword [0x492e40]
test eax, eax
je 0x41cd0b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41cc72
cmp dword [eax + 0x14], 0
je 0x41cc95
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41cc65
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x41ccdf
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x41cc1d
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41ccac
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x41cd02
mov eax, dword [0x492e40]
test eax, eax
je 0x41cd31
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41cc72
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x41ccbf
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41ccbf
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e40], eax
jmp 0x41cc30
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e40], eax
jmp 0x41ccc8
Function at 0x420200
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040e080
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x4202ef
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x420393
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x420328
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x420320
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x420390
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x4203aa
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x420362
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x420362
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x420362
Function at 0x10005ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
mov eax, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
push 0
push 0
push str.SOFTWAREAtherosVistaAddOn_
push 0x80000001
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10006052
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.KeepAwakeFromPS
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006052
cmp dword [ebp - 4], eax
je 0x10006072
cmp byte [ebp + 8], 0xb
jne 0x10006067
push 0x80000003
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov esp, ebp
pop ebp
ret
push 0x80000000
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov esp, ebp
pop ebp
ret

Function at 0x10009630
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov edi, edx
cmp esi, ecx
je 0x10009711
cmp edi, ecx
je 0x10009711
mov al, 0x10
cmp byte [esi + 0x16], al
ja 0x10009711
cmp byte [esi + 0x2d], al
ja 0x10009711
cmp byte [esi + 0x34], 4
mov dword [esp + 8], 0x67452301
sete al
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
lea eax, [eax + eax + 4]
movzx edx, al
push edx
push esi
lea eax, [esp + 0x10]
call fcn.10009a70
movzx ecx, byte [esi + 0x16]
push ecx
lea edx, [esi + 6]
push edx
lea eax, [esp + 0x18]
call fcn.10009a70
cmp byte [esi + 0x34], 4
sete al
lea eax, [eax + eax + 4]
movzx edx, al
push edx
lea eax, [esi + 0x17]
push eax
lea eax, [esp + 0x20]
call fcn.10009a70
movzx edx, byte [esi + 0x2d]
push edx
add esi, 0x1d
push esi
lea eax, [esp + 0x28]
call fcn.10009a70
lea eax, [esp + 0x28]
push eax
call fcn.10009b90
add esp, 0x24
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10012385
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 0x12
call fcn.10012385
mov esp, ebp
pop ebp
ret

Function at 0x10009730
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x60], eax
push edi
mov edi, ecx
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [0x10016490]
imul ecx, ecx, 0x6255
add ecx, 0x3619
mov word [0x10016490], cx
movzx ecx, cx
add ecx, eax
xor eax, eax
lea edx, [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 4
push edx
lea eax, [esp + 0x10]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.10009a70
lea eax, [esp + 0x10]
push eax
call fcn.10009b90
mov ecx, dword [esp + 0x70]
add esp, 0xc
pop edi
xor ecx, esp
call fcn.10012385
mov esp, ebp
pop ebp
ret
Function at 0x1000a2e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0xc]
push ecx
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.10009a70
lea edx, [esp + 0x10]
push edx
call fcn.10009b90
mov ecx, dword [esp + 0x70]
add esp, 0xc
pop edi
xor ecx, esp
call fcn.10012385
mov esp, ebp
pop ebp
ret
Function at 0x1000adb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push edi
cmp esi, eax
jne 0x1000add6
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012385
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov eax, dword [esi]
push 0x10
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
call fcn.10009a70
push 1
push 0x100137fc
lea eax, [ebp - 0x70]
call fcn.10009a70
movzx edx, byte [esi + 0xc]
mov eax, dword [esi + 8]
push edx
push eax
lea eax, [ebp - 0x70]
call fcn.10009a70
lea ecx, [ebp - 0x70]
push ecx
lea edi, [ebp - 0x14]
call fcn.10009b90
mov edx, dword [esi + 4]
add esp, 0x1c
mov ecx, 0x10
mov eax, edi
call section..text
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10012385
mov esp, ebp
pop ebp
ret

Function at 0x1000b1ea
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1000b225
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1000b20c
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1000b21d
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1000b227
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1000b202
xor eax, eax
pop edi
pop esi
ret
Function at 0x1000d1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x1000d1f9
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1000d240
lea eax, [ebp - 0x714]
push eax
call fcn.1000b1ba
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1000b16f
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1000d24b
jmp 0x1000d250
jmp 0x1000cb4c

Function at 0x10010650
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x38
lea eax, [ebp - 0x13c]
push ebx
push eax
mov dword [ebp - 0x140], ebx
call sub.MSVCR100.dll_memset
push 0xff
lea ecx, [ebp - 0x103]
push ebx
push ecx
mov byte [ebp - 0x104], bl
call sub.MSVCR100.dll_memset
push 0x90
push str._Atheros_BtWlan_Coex_Agent_
push str.control__s__d
lea edx, [ebp - 0x104]
push pe_nt_image_headers32
push edx
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x2c
lea ecx, [ebp - 0x140]
lea eax, [ebp - 0x104]
push ecx
mov dword [ebp - 0x140], 0x3c
mov dword [ebp - 0x13c], 0x40
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], str.Open
mov dword [ebp - 0x130], 0x10013eb0
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x12c], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea edx, [ebp - 0x104]
push edx
push 0x90
push str._service__send__d_to_service__command_string__s_n
push 7
call fcn.10012310
mov ecx, dword [ebp - 4]
add esp, 0x10
lea eax, [ebx + 1]
xor ecx, ebp
pop ebx
call fcn.10012385
mov esp, ebp
pop ebp
ret

Function at 0x10012310
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x7ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call sub.MSVCR100.dll_memset
mov ecx, dword [0x10016108]
add esp, 0xc
cmp ecx, dword [ebp + 8]
ja 0x10012377
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x804]
push 0x800
push ecx
call dword [sym.imp.MSVCR100.dll__vsnprintf_s]
add esp, 0x14
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012385
mov esp, ebp
pop ebp
ret

Function at 0x10012385
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1001238f
repz ret
jmp fcn.10012725
Function at 0x4045fc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.0040715c
test esi, esi
jne 0x404634
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00407298
jmp 0x404652
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044e0
mov edi, eax
test esi, esi
je 0x404652
cmp dword [ebx], 0
je 0x404652
dec esi
jmp 0x40463b
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404684
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x544008], 0x8088405
inc edx
mov dword [ebx + 0x544008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406384
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x553050], 0
je 0x4063e5
cmp word [0x55332c], 0xd7b2
jne 0x4063ad
cmp dword [0x553334], 0
jbe 0x4063ad
mov eax, 0x553328
call dword [0x553344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406410
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x544030], 0
jne 0x406401
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x544038], 0
je 0x4065b6
mov edx, esi
mov eax, ebx
call dword [0x544038]
jmp 0x4065c5
mov eax, 8
call fcn.00404228
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x553051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x406558
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x407c58
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x407c9a
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x407cba
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040735c
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x409148
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4092af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040715c
cmp si, word [0x5447e0]
jb 0x4091e2
cmp si, word [0x5449e0]
ja 0x4091e2
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x4091e2
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x5447e0]
jae 0x4091bc
mov edi, ebx
dec edi
jmp 0x4091dd
cmp si, word [ebx*8 + 0x5447e0]
jbe 0x4091cc
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x4091dd
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x5447e4]
call fcn.00409058
jmp 0x4091e2
cmp edi, dword [ebp - 0xc]
jae 0x4091a6
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x409291
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x409291
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.0040735c
push dword [ebp - 0x164]
push 0x4092cc
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.0040735c
push dword [ebp - 0x168]
push 0x4092dc
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.0040735c
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00407714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4092b6
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00407154
ret
Function at 0x409468
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40956d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x555b58
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x555b70]
jne 0x4094b4
mov eax, esi
mov edx, 0x555b74
mov ecx, 0x55
call fcn.0040735c
push 0x555b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x409557
push 0x555b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.0040715c
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x409525
cmp byte [0x555b54], 0
je 0x4094ea
mov edx, esi
mov eax, ebx
call fcn.00409348
jmp 0x409525
mov edx, esi
mov eax, ebx
call fcn.00409148
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x409525
cmp dword [esi], 0
je 0x40950e
mov eax, esi
mov edx, 0x409588
call fcn.00407570
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00409148
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407570
push 0x555b58
call sub.kernel32.dll_EnterCriticalSection
mov word [0x555b70], bx
push 0xaa
mov eax, dword [esi]
call fcn.004071e8
push eax
push 0x555b74
call sub.kernel32.dll_lstrcpynW
push 0x555b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409574
lea eax, [ebp - 4]
call fcn.0040714c
ret
Function at 0x4097ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407144
xor eax, eax
push ebp
push 0x409991
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x4097ec
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x409806
push 0x105
mov eax, dword [ebp - 4]
call fcn.004071e8
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40997b
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4099a0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409895
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4099a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409895
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4099d4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409895
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409a08
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40997b
xor eax, eax
push ebp
push 0x409974
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.004095b0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409904
mov eax, dword [ebp - 0x10]
call fcn.00404228
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407308
jmp 0x40994f
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x409a48
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40994f
mov eax, dword [ebp - 0x10]
call fcn.00404228
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x409a48
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407308
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40997b
cmp dword [ebp - 8], 0
je 0x40996a
mov eax, dword [ebp - 8]
call fcn.00404244
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409998
lea eax, [ebp - 4]
call fcn.0040714c
ret
Function at 0x409c5c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.00407144
mov eax, dword [ebp - 0x21c]
call fcn.00407144
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x409dfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.0040715c
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.004071e8
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x409cfc
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x409d0e
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x409cf9
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x409dc7
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x409d37
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.004097ac
cmp dword [ebp - 0x220], 0
je 0x409d6f
push ebp
mov eax, dword [ebp - 0x220]
call fcn.00409b50
pop ecx
mov ebx, eax
jmp 0x409dc7
push ebp
call sub.kernel32.dll_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.00409468
mov eax, dword [ebp - 0x224]
call fcn.00409b50
pop ecx
mov ebx, eax
test bl, bl
jne 0x409dba
cmp byte [0x555b54], 0
jne 0x409dba
push ebp
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.00409468
mov eax, dword [ebp - 0x228]
call fcn.00409b50
pop ecx
mov ebx, eax
test bl, bl
jne 0x409dc7
push ebp
call fcn.00409c00
pop ecx
mov ebx, eax
test bl, bl
je 0x409ddd
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040735c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409e02
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.00407154
ret

Function at 0x40a684
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret