joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c89
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00531ed0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
pop esi
jne 0x402ceb
xor eax, eax
inc eax
cmp dword [ebp - 0x118], 0
je 0x402ce5
cmp dword [ebp - 0x118], eax
jne 0x402ceb
cmp byte [ebp - 6], 1
je 0x402ced
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532a3d
leave
ret

Function at 0x402cf9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
mov esi, ecx
call fcn.00531ed0
lea eax, [ebp - 0x20c]
push str.SOFTWARE_
push eax
call fcn.005325d3
lea eax, [ebp - 0x20c]
push str.SmartCloudWBInput
push eax
call fcn.005325a4
lea eax, [esi + 0x3c]
add esp, 0x1c
cmp dword [eax + 0x14], 8
jb 0x402d5d
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.005325d3
lea eax, [esi + 0x24]
pop ecx
cmp dword [eax + 0x14], 8
pop ecx
jb 0x402d77
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.005325d3
pop ecx
pop ecx
lea eax, [ebp - 0x620]
push eax
push 2
push ebx
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402de3
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
push 1
push ebx
push str.CfgRootPath
push dword [ebp - 0x620]
call esi
push edi
lea eax, [ebp - 0x61c]
push eax
push 1
push ebx
push str.CfgUserPath
push dword [ebp - 0x620]
call esi
pop edi
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00532a3d
leave
ret

Function at 0x4034ab
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.005325f3
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00410c1d
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.005325d3
mov eax, dword [ebp - 4]
add esp, 0x10
xor edi, edi
mov bl, 1
test eax, eax
js 0x403524
push 0x5c
pop ecx
cmp word [esi + edi*2], cx
jne 0x40351b
xor eax, eax
push esi
mov word [esi + edi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403511
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x403522
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + edi*2], cx
inc edi
cmp edi, eax
jle 0x4034ee
jmp 0x403524
xor bl, bl
push esi
call fcn.00410c26
pop ecx
pop edi
pop esi
movzx eax, bl
pop ebx
leave
ret
Function at 0x4035b9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00531ed0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
pop esi
jb 0x40360f
cmp dword [ebp - 0x118], 2
jb 0x40360f
xor eax, eax
inc eax
jmp 0x403619
cmp dword [ebp - 0x11c], 0xa
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532a3d
leave
ret

Function at 0x403c26
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
setne dl
mov eax, esi
mov dword [esi + 4], edx
pop esi
pop ebp
ret 4

Function at 0x403c73
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
push eax
call esi
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.00532a3d
leave
ret

Function at 0x403cd1
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
push eax
call esi
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
pop edi
xor ecx, ebp
pop esi
call fcn.00532a3d
leave
ret

Function at 0x403d2f
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call esi
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.00532a3d
leave
ret
Function at 0x403e28
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
push 0x403ec1
push esi
push esi
mov dword [0x5ba980], esi
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call esi
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov eax, dword [ebp - 0xc]
mov edx, dword [0x5ba980]
sub eax, dword [ebp - 0x14]
pop edi
pop esi
cmp edx, 1
jle 0x403eb5
test edx, edx
jle 0x403eb5
mov ecx, 0x5ba990
cmp dword [ecx], eax
cmovg eax, dword [ecx]
lea ecx, [ecx + 0x10]
dec edx
jne 0x403eaa
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532a3d
leave
ret
Function at 0x403f27
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x414], ax
xor edi, edi
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.00531ed0
lea eax, [ebp - 0x414]
push str.C:log_
push eax
call fcn.005325d3
xor eax, eax
push 0x3e6
mov word [ebp - 0xc0c], ax
lea eax, [ebp - 0xc0a]
push edi
push eax
call fcn.00531ed0
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push str._sgswb.log
push eax
call fcn.00532980
xor eax, eax
push esi
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push edi
push eax
call fcn.00531ed0
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00531ed0
add esp, 0x44
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0053260c
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x61c]
push eax
call esi
test eax, eax
je 0x404118
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.005325f3
lea eax, [ebp + eax*2 - 0x20a]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.005325d3
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push str._s_s.txt
push eax
call fcn.00532980
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc0c]
push 0x1f3
push eax
call fcn.00535c0e
xor eax, eax
add esp, 0x2c
mov word [ebp - 0x826], ax
lea eax, [ebp - 0x61c]
push eax
call esi
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x61c]
push 0x560380
push eax
cmovne edi, ebx
call fcn.00535e05
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x404117
test edi, edi
jne 0x4040bd
push esi
push 2
lea eax, [ebp - 0xc14]
push ebx
push eax
mov dword [ebp - 0xc14], 0xfeff
call fcn.00536347
add esp, 0x10
lea eax, [ebp - 0xc0c]
push eax
call fcn.005325f3
push esi
add eax, eax
push eax
lea eax, [ebp - 0xc0c]
push ebx
push eax
call fcn.00536347
push esi
push 2
lea eax, [ebp - 0xc10]
push ebx
push eax
mov dword [ebp - 0xc10], 0xd
call fcn.00536347
push esi
push 2
lea eax, [ebp - 0xc10]
push ebx
push eax
mov dword [ebp - 0xc10], 0xa
call fcn.00536347
push esi
call fcn.00536179
add esp, 0x38
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00532a3d
leave
ret

Function at 0x40490e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call fcn.00531ed0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x404960
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
inc eax
leave
ret 8
Function at 0x404967
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x828]
push ebx
push eax
call fcn.00531ed0
push 0x10
lea eax, [ebp - 0x7e4]
push ebx
push eax
mov dword [ebp - 0x828], 0x44
call fcn.00531ed0
push esi
lea eax, [ebp - 0x7d4]
push 0x560274
push eax
call fcn.00532980
add esp, 0x24
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x828]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4049fe
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00532a3d
leave
ret 4

Function at 0x404a0e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call fcn.005325f3
pop ecx
test eax, eax
je 0x404a6d
push ebx
push 0x3c
xor ebx, ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.00531ed0
add esp, 0xc
xor ecx, ecx
inc ecx
push ecx
push ebx
push ebx
mov eax, str.open
push esi
push eax
push ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebx
cmp eax, 0x20
ja 0x404a6a
push esi
mov ecx, edi
call fcn.00404967
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4
Function at 0x40523b
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x30], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov esi, eax
test esi, esi
je 0x4052bf
push edi
shl eax, 2
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x405284
push edi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov esi, eax
test esi, esi
jne 0x405288
xor eax, eax
jmp 0x4052be
push 0x28
lea eax, [ebp - 0x2c]
dec esi
push eax
push dword [edi + esi*4]
call sub.IMM32.dll_ImmGetIMEFileNameW
test eax, eax
je 0x4052ac
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4052b2
test esi, esi
jne 0x405288
jmp 0x4052b5
mov ebx, dword [edi + esi*4]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00532a3d
leave
ret 4
Function at 0x40561b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
push str.Control_PanelInput_MethodHot_Keys_
lea eax, [ebp - 0x194]
push str._s_s
push eax
call fcn.00532980
add esp, 0x10
lea eax, [ebp - 0x198]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x194]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40567a
xor eax, eax
jmp 0x40570f
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0
push str.Key_Modifiers
push dword [ebp - 0x198]
mov dword [ebp - 0x1a4], 3
mov dword [ebp - 0x1a0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4056c8
push dword [ebp - 0x198]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405673
mov eax, dword [ebp - 0x19c]
mov ecx, 0xc004
and eax, ecx
cmp eax, ecx
sete al
mov byte [edi], al
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0
push str.Virtual_Key
push dword [ebp - 0x198]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4056ba
mov ax, word [ebp - 0x19c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00532a3d
leave
ret 8

Function at 0x405c38
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00531ed0
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00531ed0
mov ecx, dword [0x5baad0]
add esp, 0x18
call fcn.004c1c65
mov ecx, eax
call fcn.0040cc58
mov ecx, dword [0x5baad0]
pop esi
test eax, eax
je 0x405cb3
call fcn.0041928f
mov ecx, eax
call fcn.004015e1
push eax
push str._sImeReg64.exe
jmp 0x405cc5
call fcn.0041928f
mov ecx, eax
call fcn.004015e1
push eax
push str._sImeReg32.exe
lea eax, [ebp - 0x20c]
push eax
call fcn.00532980
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405d48
mov ecx, dword [0x5baad0]
call fcn.0041928f
mov ecx, eax
call fcn.00402c89
test eax, eax
push str._InstallIME_gswb
lea eax, [ebp - 0x20c]
push eax
je 0x405d1b
mov ecx, dword [0x5baad0]
call fcn.0040cd9f
mov ecx, eax
call fcn.0040490e
jmp 0x405d48
lea eax, [ebp - 0x414]
push 0x560288
push eax
call fcn.00532980
mov ecx, dword [0x5baad0]
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call fcn.0040cd9f
mov ecx, eax
call fcn.00404a0e
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.00532a3d
leave
ret
Function at 0x408ab5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00531ed0
add esp, 0xc
jmp 0x408afe
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x408b17
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x408aec
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00532a3d
leave
ret 4

Function at 0x408b26
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00531ed0
add esp, 0xc
lea eax, [ebp - 0x210]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
mov esi, ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x408ba7
mov eax, esi
inc esi
cmp eax, 0x28
jg 0x408bb8
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push ecx
push edi
mov dword [ebp - 0x210], 0x104
call ebx
test eax, eax
je 0x408b7c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00532a3d
leave
ret 4

Function at 0x409243
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
movzx ecx, word [ebp + 8]
push esi
push 0x100
mov esi, 0x5bb300
push esi
push 2
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x409dd3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x600
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x600], ecx
push esi
lea ecx, [ebp - 0x5f4]
call fcn.004082a8
mov eax, dword [0x5bacac]
mov dword [0x5bacb0], eax
lea eax, [ebp - 0x5f8]
push eax
push 9
xor esi, esi
push esi
push str.SOFTWAREMicrosoftCTFTIP
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409ec5
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00531ed0
add esp, 0xc
jmp 0x409e9c
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x5f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x409e9b
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x5f4]
push eax
call fcn.005325d3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x600]
lea eax, [ebp - 0x5f4]
push eax
push dword [ebp - 0x5fc]
call fcn.0040ae78
push dword [ebp - 0x5fc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x5f8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x409e44
push dword [ebp - 0x5f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00532a3d
leave
ret

Function at 0x409ed2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea eax, [esi + 2]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x560c1c
push dword [ebp + 0xc]
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x64
call edi
test eax, eax
je 0x409f10
xor eax, eax
jmp 0x409f63
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x66]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.Profile
push dword [ebp + 0xc]
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x64
call edi
test eax, eax
jne 0x409f0c
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0xcc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.KeyboardLayout
push dword [ebp + 0xc]
call edi
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
leave
ret 8
Function at 0x409f69
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2ec], ecx
lea ecx, [ebp - 0x2e0]
push ecx
push str.34745C63_B2F0_4784_8B67_5E12C8701A31
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40a081
mov eax, dword [esi]
push edi
push 0x10
mov dword [esi + 4], eax
xor edi, edi
lea eax, [esi + 0xc]
push edi
push eax
call fcn.005360d8
movzx eax, ax
mov dword [ebp - 0x2e8], eax
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00531ed0
add esp, 0x18
jmp 0x40a04e
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40a04d
lea ecx, [ebp - 0x2dc]
call fcn.004080c8
mov eax, dword [ebp - 0x2e8]
push dword [ebp - 0x2e4]
mov ecx, dword [ebp - 0x2ec]
mov word [ebp - 0x2dc], ax
lea eax, [ebp - 0x2dc]
push eax
call fcn.00409ed2
test eax, eax
je 0x40a041
lea eax, [ebp - 0x2dc]
push eax
mov ecx, esi
call fcn.0040c4c7
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x409fe1
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
jmp 0x40a096
mov eax, dword [esi + 4]
sub eax, dword [esi]
mov ecx, 0xd0
cdq
idiv ecx
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00532a3d
leave
ret 8

Function at 0x40a0a5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push str.34745C63_B2F0_4784_8B67_5E12C8701A31
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40a154
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xc]
push eax
lea eax, [esi + 2]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.Default
push dword [ebp - 8]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 0xc], 0x64
call edi
test eax, eax
jne 0x40a154
lea eax, [ebp + 0xc]
push eax
lea eax, [esi + 0x66]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.Profile
push dword [ebp - 8]
mov dword [ebp - 4], ebx
mov dword [ebp + 0xc], 0x64
call edi
test eax, eax
jne 0x40a154
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [esi + 0xcc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.KeyboardLayout
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40a154
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40a156
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8