joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0282
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004a01fe
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4a03f1
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4a03f1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4a03a6
jg 0x4a02de
test eax, eax
je 0x4a039c
push 1
push 0x1000
call fcn.0048f6fe
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4a0301
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4a0393
push 0x8000
push ebx
call fcn.0048de33
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4a032a
jg 0x4a0325
cmp ecx, 0x1000
jb 0x4a032a
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00493e27
add esp, 0x10
cmp eax, 0xffffffff
je 0x4a036f
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4a0325
jl 0x4a0356
test ecx, ecx
jne 0x4a0317
push dword [ebp - 0xc]
push ebx
call fcn.0048de33
push esi
call fcn.0048f75b
add esp, 0xc
xor ebx, ebx
jmp 0x4a03ff
cmp byte [edi + 0x24], 0
je 0x4a0386
cmp dword [edi + 0x20], 5
jne 0x4a0386
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4a0391
mov ebx, dword [edi + 0x18]
jmp 0x4a0393
xor ebx, ebx
push esi
call fcn.0048f75b
pop ecx
jmp 0x4a03ff
test ecx, ecx
jg 0x4a0368
jl 0x4a03a6
test eax, eax
jae 0x4a0368
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00495d94
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4a03c6
cmp byte [edi + 0x1c], 0
je 0x4a0368
jmp 0x4a03f7
push ebx
call fcn.0048ae38
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4a0368
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4a03ff
cmp byte [edi + 0x1c], 0
je 0x4a03fc
mov ebx, dword [edi + 0x18]
jmp 0x4a03ff
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00495d94
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a0990
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a09bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a09bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1002aaee
pop dword [ebp - 0x24]
mov eax, 0xd00bf547
sub eax, 0xc0094a59
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xefd0b507
add dword [ebp - 0x34], 0x5e819044
mov dword [ebp - 0x30], 0x63d443ac
add dword [ebp - 0x30], 0xce5f0899
mov dword [ebp - 0x2c], 0xa1d0c027
add dword [ebp - 0x2c], 0xaa7b8407
mov dword [ebp - 0x28], 0xd0eb7aa9
sub dword [ebp - 0x28], 0xd0eb7aa9
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x7d510c88
add dword [ebp - 0x34], 0xf7215cce
mov dword [ebp - 0x30], 0x2e335e44
sub dword [ebp - 0x30], 0xecc6fccf
mov dword [ebp - 0x2c], 0x23760896
add dword [ebp - 0x2c], 0x3ff963d6
mov dword [ebp - 0x28], 0xf51bb3b5
sub dword [ebp - 0x28], 0xf51bb3b5
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x354dc
push 0
call eax
mov ecx, 0x296031ce
add ecx, 0xd6a0118a
mov edi, eax
mov ebx, 0x2f3e2c21
add ebx, 0xe0c569df
add ebx, dword [ebp - 0x24]
mov edx, 0x4c08b889
add edx, 0xbefb3cbf
xor dword [ebp - 0x10], 0xd79366a4
mov esi, dword [ebx]
xor dword [ebp - 4], 0x4ecd8cef
xor esi, edx
xor dword [ebp - 0x1c], 0xad885726
mov dword [edi], esi
sub dword [ebp - 0x1c], 0x2b66bec8
add edi, 0xdd43cae0
sub edi, 0xdd43cadc
add ebx, 0xaddb9ea9
sub ebx, 0xaddb9ea5
loop 0x1002ac06
add eax, 0x4a0bdfa2
sub eax, 0x4a0adf6f
mov ebx, eax
add eax, 0x3f442609
sub eax, 0x3f442604
mov ecx, 0xcc60b899
add ecx, 0x439f4767
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x40536d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx edx, byte [ebp - 1]
xor ecx, ecx
mov eax, 0xa4bcacac
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
sub eax, ecx
mov dword [ebp - 0x1c], 0xffffe55d
sub dword [ebp - 0x1c], ecx
mov ecx, dword [0x41fc7c]
push esi
push edi
mov dword [ebp + 0x10], 0xa4b55c75
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
movzx esi, byte [eax]
or ecx, 0xdb24be64
xor edx, edx
mov eax, 0x63d91ef9
div ecx
xor edx, edx
mov ecx, 0x28c0d7d5
push 0x1c
mov edi, 0x2500f7af
div ecx
mov eax, 0x1aa3
mov ecx, edx
or ecx, 0x7e13da94
xor edx, edx
div ecx
xor edx, edx
mov ecx, eax
or ecx, 0xf2f55726
pop eax
div ecx
mov ecx, dword [ebp - 0xc]
or ecx, 0x15318b43
xor edx, edx
push 0x2b
div ecx
mov eax, esi
shl eax, 0x10
sub eax, dword [ebp - 0xc]
imul eax, eax, 0x468c
sub eax, 0xfc87648
mov ecx, edx
xor edx, edx
div edi
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
or edi, 0xa08d82a
imul ecx, edx
imul ecx, ecx, 0x58ddf8ba
or ecx, 0x40cb69bf
xor edx, edx
div ecx
mov ecx, esi
shl ecx, 0xe
xor edx, edx
shl esi, 0x14
or esi, 0x6a4344c9
or eax, ecx
pop ecx
sub ecx, eax
or ecx, 0x7ddc12c4
push 0x74
pop eax
div ecx
xor edx, edx
push 6
mov ecx, eax
pop eax
div edi
xor edx, edx
push 4
div esi
pop eax
xor ecx, edx
or ecx, 0xd92e6d28
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x28]
imul eax, eax, 0x709e
mov dword [0x41fc7c], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 0xc]
mov cl, byte [ecx + eax]
mov byte [ebp - 3], cl
movzx ecx, cl
mov dword [ebp - 0x18], eax
mov eax, ecx
mov dword [ebp - 0x10], ecx
call fcn.00405288
movzx esi, byte [ebp + 0x10]
mov dword [0x41fc7c], eax
mov eax, ecx
jmp loc.0043c000
Function at 0x409b0a
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
add esi, 0
neg ecx
mov dword [0x40d9dc], esi
sub edi, 0
not ecx
mov dword [0x40d9d8], edi
or ebx, 0
not ecx
mov dword [0x40d9e8], ebx
pop eax
jmp fcn.004057c0
Function at 0x298072e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29876b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807306
xor eax, eax
jmp 0x298073c1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807328
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807328
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298073c1
cmp dword [esi + 0x4c], 0
je 0x298073bf
call fcn.29806a7d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x29807352
push dword [esi + 0x4c]
push eax
call fcn.2984e5dc
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x298073bf
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x298073bf
cmp eax, 1
jle 0x2980738d
cmp eax, 3
jne 0x298073bf
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x29807344
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x298073b1
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x298073bf
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x298073c1
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801cc0
leave
ret 4
Function at 0x29826d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29854690
call fcn.2985114e
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x29826f9e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2984e5dc
add esp, 0x10
test eax, eax
js 0x29826f98
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29826e21
push edi
call fcn.29827ddd
pop ecx
test al, al
je 0x29826e21
mov eax, edi
call fcn.29851670
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x29826e33
push edi
lea ecx, [ebp - 0x424]
call fcn.2984e5dc
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2984e5dc
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x29826f98
push 0x60
push ebx
push eax
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29826e8b
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828150
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29826e8b
call fcn.29825061
mov ebx, eax
jmp 0x29826f67
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x29826eb2
call fcn.29825061
jmp 0x29826f5a
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x29826ea8
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x29826ee5
mov ebx, 0x8007000e
jmp 0x29826f5c
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2984e5dc
jmp 0x29826f0b
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x29826ede
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2984e5dc
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2984e5dc
mov ebx, eax
test edi, edi
je 0x29826f67
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29826f80
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826f90
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826f86
mov eax, ebx
jmp 0x29826fcc
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x29826fb3
lea ecx, [ebp - 0x418]
call fcn.29825bb4
or dword [ebp - 4], 0xffffffff
jmp 0x29826fc3
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x29826fb9
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851106
ret 0x10
Function at 0x2984e5dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x2984e5eb
pop dword [ebp - 0x50]
mov eax, 0xf11851c0
add eax, 0x386c942b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x772d32f5
add dword [ebp - 0x60], 0xd7251256
mov dword [ebp - 0x5c], 0xe27583c1
add dword [ebp - 0x5c], 0x4fbdc884
mov dword [ebp - 0x58], 0xebbced35
sub dword [ebp - 0x58], 0x9f70a907
mov dword [ebp - 0x54], 0x82e067e3
sub dword [ebp - 0x54], 0x82e067e3
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x399cfbf7
sub dword [ebp - 0x60], 0xc52a92a1
mov dword [ebp - 0x5c], 0x1cfe2385
add dword [ebp - 0x5c], 0x246e3df0
mov dword [ebp - 0x58], 0xd45ba534
sub dword [ebp - 0x58], 0x70ec38c8
mov dword [ebp - 0x54], 0x7e92f330
add dword [ebp - 0x54], 0x816d0cd0
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x68910786
add eax, 0xc0f46932
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x49d95
push 0
call eax
mov ecx, 0x9e057d0
sub ecx, 0x9e00a56
xor edx, edx
add edx, eax
mov ebx, 0x29896400
add ebx, dword [ebp - 0x50]
mov esi, 0xe3eddc32
add dword [ebp - 0x44], edi
mov edi, dword [ebx]
xor dword [ebp - 0x3c], 0x7e972c23
sub edi, esi
xor dword [ebp - 0x18], 0xb589bee6
mov dword [edx], edi
mov dword [ebp - 0x10], 0x41a0af77
add edx, 0xdb9e1d9d
add edx, 0x2461e267
add ebx, 0x15336137
add ebx, 0xeacc9ecd
loop 0x2984e6fe
add eax, 0x275527c1
add eax, 0xd8ac00fa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x29800000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x404594
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406898
test esi, esi
jne 0x4045cc
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004069d4
jmp 0x4045ea
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044d8
mov edi, eax
test esi, esi
je 0x4045ea
cmp dword [ebx], 0
je 0x4045ea
dec esi
jmp 0x4045d3
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405e14
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x53b050], 0
je 0x405e75
cmp word [0x53b32c], 0xd7b2
jne 0x405e3d
cmp dword [0x53b334], 0
jbe 0x405e3d
mov eax, 0x53b328
call dword [0x53b344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405ea0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x534030], 0
jne 0x405e91
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x534034], 0
je 0x406046
mov edx, esi
mov eax, ebx
call dword [0x534034]
jmp 0x406055
mov eax, 8
call fcn.00404220
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x53b051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405fe8
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408680
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4087e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406898
cmp si, word [0x5347dc]
jb 0x40871a
cmp si, word [0x5349dc]
ja 0x40871a
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x40871a
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x5347dc]
jae 0x4086f4
mov edi, ebx
dec edi
jmp 0x408715
cmp si, word [ebx*8 + 0x5347dc]
jbe 0x408704
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408715
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x5347e0]
call fcn.00408590
jmp 0x40871a
cmp edi, dword [ebp - 0xc]
jae 0x4086de
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4087c9
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4087c9
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a98
push dword [ebp - 0x164]
push 0x408804
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406a98
push dword [ebp - 0x168]
push 0x408814
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a98
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4087ee
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406890
ret
Function at 0x4089a0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408aa5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x53db58
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x53db70]
jne 0x4089ec
mov eax, esi
mov edx, 0x53db74
mov ecx, 0x55
call fcn.00406a98
push 0x53db58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408a8f
push 0x53db58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406898
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408a5d
cmp byte [0x53db54], 0
je 0x408a22
mov edx, esi
mov eax, ebx
call fcn.00408880
jmp 0x408a5d
mov edx, esi
mov eax, ebx
call fcn.00408680
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408a5d
cmp dword [esi], 0
je 0x408a46
mov eax, esi
mov edx, 0x408ac0
call fcn.00406cac
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408680
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406cac
push 0x53db58
call sub.kernel32.dll_EnterCriticalSection
mov word [0x53db70], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406924
push eax
push 0x53db74
call sub.kernel32.dll_lstrcpynW
push 0x53db58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408aac
lea eax, [ebp - 4]
call fcn.00406888
ret
Function at 0x408ce4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406880
xor eax, eax
push ebp
push 0x408ec9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408d24
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x408d3e
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406924
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x408eb3
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408ed8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408dcd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408ed8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408dcd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408f0c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408dcd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408f40
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x408eb3
xor eax, eax
push ebp
push 0x408eac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408ae8
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408e3c
mov eax, dword [ebp - 0x10]
call fcn.00404220
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406a44
jmp 0x408e87
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x408f80
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408e87
mov eax, dword [ebp - 0x10]
call fcn.00404220
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x408f80
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406a44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408eb3
cmp dword [ebp - 8], 0
je 0x408ea2
mov eax, dword [ebp - 8]
call fcn.0040423c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ed0
lea eax, [ebp - 4]
call fcn.00406888
ret
Function at 0x409194
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.00406880
mov eax, dword [ebp - 0x21c]
call fcn.00406880
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x409333
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406898
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.00406924
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x409234
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x409246
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x409231
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x4092ff
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x40926f
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00408ce4
cmp dword [ebp - 0x220], 0
je 0x4092a7
push ebp
mov eax, dword [ebp - 0x220]
call fcn.00409088
pop ecx
mov ebx, eax
jmp 0x4092ff
push ebp
call sub.kernel32.dll_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.004089a0
mov eax, dword [ebp - 0x224]
call fcn.00409088
pop ecx
mov ebx, eax
test bl, bl
jne 0x4092f2
cmp byte [0x53db54], 0
jne 0x4092f2
push ebp
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.004089a0
mov eax, dword [ebp - 0x228]
call fcn.00409088
pop ecx
mov ebx, eax
test bl, bl
jne 0x4092ff
push ebp
call fcn.00409138
pop ecx
mov ebx, eax
test bl, bl
je 0x409315
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406a98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40933a
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.00406890
ret

Function at 0x409aac
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret