joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d2b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x43b208
push 0x434ae0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x441f9c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
cmp dword [0x4425b4], 0
jne 0x42d38b
mov eax, dword [0x4425b0]
test eax, eax
jne 0x42d38b
mov ecx, dword [0x4425bc]
test ecx, ecx
je 0x42d328
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x4425b0]
mov ecx, dword [0x4425bc]
test eax, eax
jne 0x42d38b
test ecx, ecx
jne 0x42d339
call fcn.00424ca0
test eax, eax
je 0x42d34c
lea eax, [ebp - 0x20]
push eax
push dword [section..data]
call fcn.004249d0
test eax, eax
jne 0x42d38b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x42d381
cmp eax, 0x7e
je 0x42d381
cmp eax, 0x78
je 0x42d381
cmp eax, 1
je 0x42d381
cmp eax, 0x32
je 0x42d381
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x4425b0], 1
mov dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.0042d3c5
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42d460
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 8], esi
call fcn.004016a0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x42d527
push eax
push 0x401580
push dword [edi]
call fcn.004017d0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x42d527
push eax
push 0x43e058
push dword [edi]
call fcn.00401820
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x42d527
push 0x10
mov dword [ebp - 8], 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
sete bl
test esi, esi
je 0x42d523
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
movups xmmword [esi], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x42d523
push esi
push 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x42d523
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0
push 0x10
push esi
push dword [edi]
call fcn.00401850
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x42d539
push edi
call fcn.00401790
mov eax, dword [ebp - 8]
add esp, 4
test eax, eax
je 0x42d548
jmp 0x42d53c
mov eax, dword [ebp - 8]
push eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
je 0x42d556
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42db50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436279
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x441f9c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], esi
push 0xc
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00434566
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.00434566
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 8], eax
push str.HKEY_CURRENT_USERSoftwareAdobeAdobe_AcrobatDC
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0042e510
push str.HKEY_CURRENT_USERSoftwareAdobeAcrobat_ReaderDC
mov ecx, esi
call fcn.0042e510
push str.HKEY_CURRENT_USERSoftwareAdobeAdobe_SynchronizerDC
mov ecx, esi
call fcn.0042e510
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42dc49
push str.AdobeAcrobatDC
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0042e2a0
push 0
push 0x1c
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42dc88
push str.AdobeAcrobatDC
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0042e2a0
push 0
push 0x1a
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42dcc7
push str.AdobeLinguisticsDictionaries
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0042e2a0
push str.SOFTWAREPoliciesAdobeAdobe_AcrobatDCFeatureLockDown
mov ecx, esi
call fcn.0042e320
push str.SOFTWAREPoliciesAdobeAcrobat_ReaderDCFeatureLockDown
mov ecx, esi
call fcn.0042e320
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004345b0
mov esp, ebp
pop ebp
ret
Function at 0x42e320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x441f9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [ebp - 0x810]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e4ef
lea eax, [ebp - 0x814]
mov dword [ebp - 0x808], 0x400
push eax
push 0x20019
push 0
push str.cAllowedRegistryPaths
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e421
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push str.tWhiteList
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e415
mov eax, dword [ebp - 0x808]
add eax, eax
cmp eax, 0x800
jae 0x42e500
xor ecx, ecx
mov word [ebp + eax - 0x804], cx
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x80c], ecx
push 0x438e70
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
push eax
mov ecx, esi
call fcn.0042e510
lea eax, [ebp - 0x80c]
push eax
push 0x438e70
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
test eax, eax
jne 0x42e3f2
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x818]
push eax
push 0x20019
push 0
push 0x438e74
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e4e3
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0x400
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push str.tWhiteList
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e4d7
mov eax, dword [ebp - 0x808]
add eax, eax
cmp eax, 0x800
jae 0x42e500
xor ecx, ecx
mov word [ebp + eax - 0x804], cx
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x80c], ecx
push 0x438e70
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
push eax
mov ecx, esi
call fcn.0042e2a0
lea eax, [ebp - 0x80c]
push eax
push 0x438e70
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
test eax, eax
jne 0x42e4b4
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004345b0
mov esp, ebp
pop ebp
ret 4
call fcn.00434973
int3

Function at 0x4316c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push esi
push eax
push 1
push eax
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4316f5
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
leave
ret
push str.unable_to_create_tls_index
lea ecx, [ebp - 0x1c]
call fcn.0042eec6
push 0x43b62c
lea eax, [ebp - 0x1c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x433b52
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov ecx, esi
call fcn.0042fc62
cmp dword [esi + 4], ebx
je 0x433d36
mov ecx, esi
call fcn.0042fc62
xor edi, edi
inc edi
cmp dword [esi + 4], edi
jne 0x433b9b
push ebx
mov ecx, esi
call fcn.0042f163
movzx eax, ax
push eax
call fcn.00433fd7
add esp, 4
test al, al
je 0x433b9b
mov eax, edi
jmp 0x433d38
mov ecx, esi
call fcn.0042fc62
cmp dword [esi + 4], 3
push 2
pop edi
jne 0x433c07
push ebx
mov ecx, esi
call fcn.0042f163
movzx eax, ax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
pop ecx
test eax, eax
je 0x433c07
xor eax, eax
mov ecx, esi
inc eax
push eax
call fcn.0042f163
cmp ax, 0x3a
jne 0x433c07
push edi
mov ecx, esi
call fcn.0042f163
movzx eax, ax
push eax
call fcn.00433fd7
add esp, 4
test al, al
je 0x433c07
mov ecx, esi
call fcn.0042fc62
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x433d38
mov ecx, esi
call fcn.0042fc62
cmp dword [esi + 4], edi
jbe 0x433d32
push ebx
mov ecx, esi
call fcn.0042f163
movzx eax, ax
push eax
call fcn.00433fd7
add esp, 4
test al, al
je 0x433d32
xor eax, eax
mov ecx, esi
inc eax
push eax
call fcn.0042f163
movzx eax, ax
push eax
call fcn.00433fd7
add esp, 4
test al, al
je 0x433d32
push edi
mov ecx, esi
call fcn.0042f163
movzx eax, ax
push eax
call fcn.00433fd7
add esp, 4
test al, al
jne 0x433d36
mov ecx, esi
inc edi
call fcn.0042fc62
cmp edi, dword [esi + 4]
jae 0x433c93
push edi
mov ecx, esi
call fcn.0042f163
movzx eax, ax
push eax
call fcn.00433fd7
add esp, 4
test al, al
je 0x433c6e
mov ecx, esi
call fcn.0042fc62
cmp dword [esi + 4], edi
je 0x433d36
mov ecx, esi
inc edi
call fcn.0042fc62
cmp dword [esi + 4], edi
je 0x433d36
push edi
mov ecx, esi
call fcn.0042f163
movzx eax, ax
push eax
call fcn.00433fd7
add esp, 4
test al, al
jne 0x433d36
mov ecx, esi
inc edi
call fcn.0042fc62
cmp edi, dword [esi + 4]
jae 0x433cf1
push edi
mov ecx, esi
call fcn.0042f163
movzx eax, ax
push eax
call fcn.00433fd7
add esp, 4
test al, al
je 0x433ccc
mov ecx, esi
call fcn.0042fc62
lea eax, [edi + 1]
cmp dword [esi + 4], eax
ja 0x433d36
mov ecx, esi
call fcn.0042fc62
cmp dword [esi + 4], edi
jne 0x433d1b
movzx eax, word [0x441f94]
mov ecx, esi
push eax
call fcn.0042f58e
mov ecx, esi
call fcn.0042fc62
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb ebx, ebx
neg ebx
mov eax, ebx
jmp 0x433d38
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x433d76
Capabilities:
Check if file exists

Disassembly:
push 0x49c
mov eax, 0x436c69
call fcn.00434ed9
mov esi, dword [ebp + 8]
mov ecx, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x470], esi
call fcn.0042fc62
cmp dword [esi + 4], 0
jne 0x433da8
mov eax, 0xffffe89d
jmp 0x433faa
xor ebx, ebx
lea ecx, [ebp - 0x488]
push ebx
push 0xffffffffffffffff
push 0x439710
call fcn.0042ef2b
push ebx
lea eax, [ebp - 0x488]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.0042fa80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
mov esi, eax
call fcn.0042f0b1
lea ecx, [ebp - 0x480]
call fcn.0042f08f
cmp esi, 0xffffffff
je 0x433dfa
mov eax, 0xffffe8c2
jmp 0x433faa
mov esi, dword [ebp - 0x470]
mov ecx, esi
call fcn.0042fc62
lea ecx, [ebp - 0x46c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x433f47
mov ecx, esi
call fcn.0042fc62
lea ecx, [ebp - 0x48c]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
test esi, esi
jne 0x433e4b
inc eax
jmp 0x433faa
cmp esi, 0x105
jbe 0x433e5d
mov eax, 0xffffe8c1
jmp 0x433faa
push esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x488]
call fcn.0042ef80
lea eax, [ebp - 0x488]
mov dword [ebp - 4], 1
push eax
call fcn.00433b52
pop ecx
test eax, eax
je 0x433e9f
mov dword [edi], 2
mov dword [edi + 4], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
jmp 0x433f0a
movzx eax, word [ebp + esi*2 - 0x21e]
push eax
call fcn.00433fd7
add esp, 4
test al, al
je 0x433ef0
lea esi, [esi*2 - 2]
cmp esi, 0x20a
jae 0x433fd1
xor eax, eax
mov word [ebp + esi - 0x21c], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x470], eax
cmp eax, 0xffffffff
jne 0x433f27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x433f05
cmp eax, 3
je 0x433f05
xor ebx, ebx
inc ebx
jmp 0x433f0a
mov ebx, 0xffffe8c2
lea ecx, [ebp - 0x478]
call fcn.0042f0b1
lea ecx, [ebp - 0x480]
call fcn.0042f08f
mov eax, ebx
jmp 0x433faa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.0042f0b1
lea ecx, [ebp - 0x480]
call fcn.0042f08f
mov eax, dword [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x46c], 0x10
push 0
pop eax
setne al
inc eax
mov dword [edi], eax
cmp dword [ebp - 0x450], 0
jne 0x433fb0
mov eax, dword [ebp - 0x44c]
mov dword [edi + 4], eax
lea eax, [ebp - 0x458]
push eax
call fcn.004343fc
cmp dword [ebp - 0x468], 0
pop ecx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
jne 0x433f95
cmp dword [ebp - 0x464], 0
je 0x433fa2
lea eax, [ebp - 0x468]
push eax
call fcn.004343fc
pop ecx
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0xc], edx
call fcn.00434e94
ret
push str.file_size_larger_than_4GB_encountered
lea ecx, [ebp - 0x4a8]
call fcn.0042eec6
push 0x43b62c
lea eax, [ebp - 0x4a8]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
call fcn.00434973
int3
Function at 0x43445a
Capabilities:
Create directory

Disassembly:
push 0x30
mov eax, 0x436d42
call fcn.00434ea5
xor ebx, ebx
xorps xmm0, xmm0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
movups xmmword [ebp - 0x1c], xmm0
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0042fc62
cmp dword [edi + 4], ebx
je 0x434511
mov ecx, edi
call fcn.0042fc62
mov esi, eax
mov ecx, edi
movzx eax, word [0x441f94]
push eax
call fcn.0042fa04
test eax, eax
je 0x4344fc
mov ecx, edi
call fcn.0042fc62
mov eax, dword [edi + 4]
mov ecx, edi
dec eax
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
call fcn.0042ffc6
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.0042f6ab
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.0042f0b1
lea ecx, [ebp - 0x34]
call fcn.0042f08f
lea ecx, [ebp - 0x24]
call fcn.0042fc62
cmp dword [ebp - 0x20], ebx
je 0x4344fa
lea ecx, [ebp - 0x24]
call fcn.0042fc62
mov esi, eax
jmp 0x4344fc
mov esi, ebx
test esi, esi
je 0x434511
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x434514
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x43452a
push ecx
call fcn.004345fc
mov eax, dword [ebp - 0x14]
pop ecx
push 2
push eax
call fcn.00434596
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
pop ecx
pop ecx
test eax, eax
je 0x434548
push eax
call fcn.004345fc
mov ebx, dword [ebp - 0x1c]
pop ecx
push 1
push ebx
call fcn.00434596
pop ecx
pop ecx
mov eax, esi
call fcn.00434e7f
ret
Function at 0x5a41b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005a4140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005a4140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005a4140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005a4140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x5a4bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5a4c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5b687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5a4c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5a4c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4094b4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069c4
xor eax, eax
push ebp
push 0x409574
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004072b0
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407460
mov eax, dword [ebx]
call fcn.0040937c
test al, al
jne 0x409551
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004072b0
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407460
mov eax, dword [ebx]
call fcn.0040937c
test al, al
jne 0x409551
mov eax, ebx
call fcn.004068e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40957b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406940
lea eax, [ebp - 4]
call fcn.004068e0
ret

Function at 0x409e20
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x41a8e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41a941
test eax, edx
je 0x41a944
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41a8ff
movzx eax, word [eax]
sub eax, ecx
jmp 0x41a926
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41a927
add ecx, 4
js 0x41a917
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41a924
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41a926
xor eax, eax
ret
test eax, eax
je 0x41a950
test edx, edx
jne 0x41a8f0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41e914
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41e94d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406a48
jmp 0x41e956
mov eax, ebx
mov edx, esi
call fcn.00406ca0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41e960
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41e982
movzx eax, word [esp]
jmp 0x41e984
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41f640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41f765
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041f450
mov esi, eax
mov eax, dword [0x4b6184]
cmp byte [eax], 0
je 0x41f70d
mov eax, dword [0x4b5f4c]
call fcn.0040480c
call fcn.004044cc
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41f618]
call fcn.00408350
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41f780
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41f749
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4b5ee4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4b9c34]
call fcn.00408444
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f76c
lea eax, [ebp - 4]
mov edx, dword [0x41f618]
call fcn.0040835c
ret

Function at 0x4207a4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42087a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406ce8
lea eax, [ebp - 4]
call fcn.00406e50
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407224
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x420864
mov eax, ebx
call fcn.00404350
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42085d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407224
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x420847
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42088c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x420847
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420864
mov eax, dword [ebp - 0x10]
call fcn.0040436c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420881
lea eax, [ebp - 4]
call fcn.004068e0
ret