joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f778
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x49f78a
add esp, 0xfffffff0
call fcn.004052c4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043b1c4
mov eax, dword [0x4aff30]
mov dword [eax + 4], ebx
mov dword [eax], 0x49fbd4
mov eax, dword [0x4aff3c]
mov dword [eax + 4], ebx
mov dword [eax], 0x49fbe0
mov eax, ebx
call fcn.0049fbec
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x424790]
call fcn.00404d78
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x424790]
call fcn.00404d78
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x424790]
call fcn.00404d78
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x424790]
call fcn.00404d78
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x424790]
call fcn.00404d78
mov dword [ebx + 0x78], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x44], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x49a520
push eax
push 0
push 0
mov eax, dword [0x4b00cc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4466e8]
call fcn.0044b6f0
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4466e8]
call fcn.0044b6f0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4466e8]
call fcn.0044b6f0
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x4466e8]
call fcn.0044b6f0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4466e8]
call fcn.0044b6f0
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.004a0144
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x49ffb4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x49ffb4
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x49ffb4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x49ffb4
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x49ffb4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x49f905
call fcn.0040531c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x49fd54
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ff01
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x49fee2
mov dl, 1
mov eax, dword [0x426d58]
call fcn.00432c3c
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.004069e0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x49fed1
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004824a4
test al, al
je 0x49fec4
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x49ff10
lea eax, [ebp - 0x394]
call fcn.00411cd8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x49fec4
xor eax, eax
push ebp
push 0x49febd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x49ff80
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x49fea6
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406bc8
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x49fea6
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fec4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x49fdc7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.00432b78
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ff08
lea eax, [ebp - 0x3a0]
call fcn.004069d0
ret

Function at 0x4a0a60
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4b6280]
cmp byte [eax + 0xad], 0
jne 0x4a0ad2
cmp dword [0x4b6298], 0
jne 0x4a0a92
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4afe00]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4b6298], eax
cmp dword [0x4b6294], 0
jne 0x4a0aad
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4b6294], eax
cmp dword [0x4b629c], 0
jne 0x4a0ad2
push esp
push 0
push 0
mov eax, dword [0x4afdfc]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4b629c], eax
pop edx
ret
Function at 0x4a0df8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4a0e0f
add esp, 0xfffffff0
call fcn.004052c4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043b1c4
mov eax, dword [0x4afe6c]
cmp byte [eax], 0
jne 0x4a0e3c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4b00ac]
cmp word [eax + 2], 0
jne 0x4a0e56
mov eax, dword [0x4b00ac]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004a2ef0
mov eax, dword [0x4b0180]
cmp word [eax + 2], 0
jne 0x4a0e70
mov eax, dword [0x4b0180]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004a3100
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x4466e8]
call fcn.0044b6f0
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4a36b0
mov dl, 1
mov eax, dword [0x424790]
call fcn.00404d78
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x424790]
call fcn.00404d78
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x449d80]
call fcn.004524e8
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4a1050
mov eax, dword [0x4affa8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0045297c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4a3998
mov dl, 1
mov eax, dword [0x424790]
call fcn.00404d78
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4affa8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00411b24
test eax, eax
je 0x4a0f81
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00411908
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00411b08
test eax, eax
je 0x4a0f99
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406bc8
push ebx
push 0x4a28c0
call fcn.00496b08
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4afe6c]
cmp byte [eax], 0
jne 0x4a0fea
mov eax, ebx
call fcn.004a11c4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004a3bc4
mov eax, ebx
call fcn.004a47f8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4a1047
call fcn.0040531c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1498
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4a153a
cmp dword [ebx + 0x94], 0
jne 0x4a1534
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4a13e4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4a1534
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4a14fa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4a1534
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0042f564
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4a1509
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4a1758
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4b6280]
cmp dword [eax + 0x170], 0
je 0x4a18bd
test bl, bl
jne 0x4a180b
cmp dword [esi + 0x9c], 0
jne 0x4a1800
mov eax, esi
call fcn.004a4648
push eax
push 0x4a1664
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4a17d1
mov eax, dword [0x4b6280]
cmp byte [eax + 0xd3], 0
je 0x4a17d1
mov eax, dword [esi + 0xd8]
call fcn.00407fe4
mov edi, eax
cmp edi, 0
jl 0x4a17d1
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a17ba
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a1800
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0042f564
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a17e0
inc dword [esi + 0x9c]
jmp 0x4a18bd
cmp dword [esi + 0x9c], 0
jle 0x4a18bd
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4a18bd
cmp dword [esi + 0x44], 0
je 0x4a1868
mov eax, dword [0x4b6280]
cmp byte [eax + 0xd3], 0
je 0x4a1868
mov eax, dword [esi + 0xd8]
call fcn.00407fe4
mov edi, eax
cmp edi, 0
jl 0x4a1868
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a1851
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a1897
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0042f564
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a1877
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4949e0]
call fcn.004081a4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4a250c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4a2577
cmp byte [ebx + 0xd3], 0
jne 0x4a2577
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406b1c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4a2564
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a2584
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004069e0
jmp 0x4a2584
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004069e0
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4a3dac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4a3e1a
mov eax, esi
call fcn.0047c608
test al, al
je 0x4a3e1a
mov eax, dword [ebx + 0x84]
call fcn.0047c288
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a3e1a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4a3e0e
push 0
mov eax, dword [ebx + 0x84]
call fcn.0047c288
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0047325c
jmp 0x4a3e1a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004a3be4
pop esi
pop ebx
ret

Function at 0x4a4f20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4a4fbc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00404548
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00411684
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00406c0c
lea eax, [ebp - 8]
mov ecx, 0x4a4fd4
mov edx, dword [ebp - 4]
call fcn.00406478
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406be4
mov eax, dword [ebp - 0x14]
call fcn.00411560
test al, al
je 0x4a4f94
push 1
mov eax, dword [ebp - 8]
call fcn.00406578
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4fc3
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004069d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406054
ret

Function at 0x4a68cc
Capabilities:
Hide graphical window

Disassembly:
call fcn.004a68bc
test al, al
je 0x4a68fa
mov eax, dword [0x4b0160]
mov eax, dword [eax]
cmp dword [eax + 0x44], 0
je 0x4a68fa
push 0
mov eax, dword [0x4b0160]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.0047c288
push eax
call sub.user32.dll_ShowWindow
ret
push 0
mov eax, dword [0x4b0160]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x404548
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406864
test esi, esi
jne 0x404580
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004069a0
jmp 0x40459e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040448c
mov edi, eax
test esi, esi
je 0x40459e
cmp dword [ebx], 0
je 0x40459e
dec esi
jmp 0x404587
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405de0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x51f050], 0
je 0x405e41
cmp word [0x51f32c], 0xd7b2
jne 0x405e09
cmp dword [0x51f334], 0
jbe 0x405e09
mov eax, 0x51f328
call dword [0x51f344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405e6c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x518030], 0
jne 0x405e5d
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405fec
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x518034], 0
je 0x406012
mov edx, esi
mov eax, ebx
call dword [0x518034]
jmp 0x406021
mov eax, 8
call fcn.004041d4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x51f051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405fb4
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408698
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4087ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406864
cmp si, word [0x5187dc]
jb 0x408732
cmp si, word [0x5189dc]
ja 0x408732
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408732
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x5187dc]
jae 0x40870c
mov edi, ebx
dec edi
jmp 0x40872d
cmp si, word [ebx*8 + 0x5187dc]
jbe 0x40871c
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x40872d
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x5187e0]
call fcn.004085a8
jmp 0x408732
cmp edi, dword [ebp - 0xc]
jae 0x4086f6
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4087e1
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4087e1
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a4c
push dword [ebp - 0x164]
push 0x40881c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406a4c
push dword [ebp - 0x168]
push 0x40882c
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a4c
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406e04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408806
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.0040685c
ret
Function at 0x4089b8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408abd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x521b58
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x521b70]
jne 0x408a04
mov eax, esi
mov edx, 0x521b74
mov ecx, 0x55
call fcn.00406a4c
push 0x521b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408aa7
push 0x521b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406864
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408a75
cmp byte [0x521b54], 0
je 0x408a3a
mov edx, esi
mov eax, ebx
call fcn.00408898
jmp 0x408a75
mov edx, esi
mov eax, ebx
call fcn.00408698
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408a75
cmp dword [esi], 0
je 0x408a5e
mov eax, esi
mov edx, 0x408ad8
call fcn.00406c60
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408698
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406c60
push 0x521b58
call sub.kernel32.dll_EnterCriticalSection
mov word [0x521b70], bx
push 0xaa
mov eax, dword [esi]
call fcn.004068f0
push eax
push 0x521b74
call sub.kernel32.dll_lstrcpynW
push 0x521b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ac4
lea eax, [ebp - 4]
call fcn.00406854
ret
Function at 0x408cfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040684c
xor eax, eax
push ebp
push 0x408ee1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408d3c
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x408d56
push 0x105
mov eax, dword [ebp - 4]
call fcn.004068f0
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x408ecb
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408ef0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408de5
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408ef0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408de5
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408f24
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408de5
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408f58
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x408ecb
xor eax, eax
push ebp
push 0x408ec4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408b00
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408e54
mov eax, dword [ebp - 0x10]
call fcn.004041d4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406a10
jmp 0x408e9f
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x408f98
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408e9f
mov eax, dword [ebp - 0x10]
call fcn.004041d4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x408f98
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406a10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ecb
cmp dword [ebp - 8], 0
je 0x408eba
mov eax, dword [ebp - 8]
call fcn.004041f0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ee8
lea eax, [ebp - 4]
call fcn.00406854
ret
Function at 0x4091ac
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.0040684c
mov eax, dword [ebp - 0x21c]
call fcn.0040684c
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x40934b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406864
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.004068f0
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x40924c
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x40925e
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x409249
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x409317
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x409287
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00408cfc
cmp dword [ebp - 0x220], 0
je 0x4092bf
push ebp
mov eax, dword [ebp - 0x220]
call fcn.004090a0
pop ecx
mov ebx, eax
jmp 0x409317
push ebp
call sub.kernel32.dll_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.004089b8
mov eax, dword [ebp - 0x224]
call fcn.004090a0
pop ecx
mov ebx, eax
test bl, bl
jne 0x40930a
cmp byte [0x521b54], 0
jne 0x40930a
push ebp
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.004089b8
mov eax, dword [ebp - 0x228]
call fcn.004090a0
pop ecx
mov ebx, eax
test bl, bl
jne 0x409317
push ebp
call fcn.00409150
pop ecx
mov ebx, eax
test bl, bl
je 0x40932d
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406a4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409352
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.0040685c
ret

Function at 0x409ac4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret