joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a5110
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x11c], 0
jg 0x100a5123
or eax, 0xffffffff
pop ebx
ret 8
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push esi
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
cmp esi, edi
jge 0x100a5192
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [esp + 0x1c]
add eax, esi
push eax
mov eax, dword [ebx + 0x11c]
push eax
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jle 0x100a5159
add esi, eax
jmp 0x100a5132
jns 0x100a517b
call ebp
cmp eax, 0x2733
je 0x100a5132
mov eax, 0xfffffffb
mov ecx, ebx
push eax
call fcn.100a4bb0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
mov eax, 0xfffffffd
mov ecx, ebx
push eax
call fcn.100a4bb0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x100a5580
Capabilities:
Get local ipv4 addresses
Get mac address on windows
Get socket information

Disassembly:
mov eax, 0x289c
call fcn.100bc4b0
mov eax, dword [0x10157aa0]
xor eax, esp
mov dword [esp + 0x2898], eax
mov ecx, dword [ecx + 0x28]
mov dword [esp + 4], 0x10
push ebx
mov ebx, dword [esp + 0x28a8]
mov eax, dword [ecx]
push ebp
mov ebp, dword [esp + 0x28a8]
call dword [eax + 0x14]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x20]
mov eax, dword [eax + 4]
test eax, eax
jne 0x100a55ce
or eax, 0xffffffff
jmp 0x100a56d2
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jne 0x100a5600
push dword [esp + 0x14]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
mov edx, ebx
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x100a55f1
jmp 0x100a5616
movq xmm0, qword [str.127.0.0.1]
movq qword [ebx], xmm0
mov ax, word [0x100f7d74]
mov word [ebx + 8], ax
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x2880
push eax
lea eax, [esp + 0x28]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
lea edi, [esp + 0x24]
push esi
jmp 0x100a5640
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
push str._02X__02X__02X__02X__02X__02X
push ebp
call fcn.100bc1c0
add esp, 0x20
lea esi, [edi + 0x1ac]
mov eax, ebx
lea ecx, [esi + 4]
lea esp, [esp]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100a56b0
test dl, dl
je 0x100a56ac
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100a56b0
add ecx, 2
add eax, 2
test dl, dl
jne 0x100a5690
xor eax, eax
jmp 0x100a56b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100a56ce
mov esi, dword [esi]
test esi, esi
jne 0x100a5684
mov edi, dword [edi]
test edi, edi
jne 0x100a5640
or eax, 0xffffffff
jmp 0x100a56d0
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x28a0]
pop ebp
pop ebx
xor ecx, esp
call fcn.100bb5b4
add esp, 0x289c
ret 8
Function at 0x100a7130
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100ce0be
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10157aa0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.TORASPAPI::CTORATstpSPMdApi.0
mov dword [edi + 4], vtable.ToraBase::Handler.0
mov byte [edi + 0x11], 0
mov byte [edi + 0x10], 0
mov dword [esp + 0x28], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi], vtable.TORASPAPI::CTORATstpSPMdApiImpl.0
lea ecx, [edi + 0x24]
mov dword [edi + 4], vtable.TORASPAPI::CTORATstpSPMdApiImpl.1.0
mov byte [esp + 0x28], 1
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.100a8b40
mov dword [edi + 0x24], eax
lea ecx, [edi + 0x30]
mov byte [esp + 0x28], 2
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call fcn.100a8b40
mov dword [edi + 0x30], eax
push 0
lea eax, [esp + 0x20]
mov byte [esp + 0x2c], 3
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0x198
push eax
push 0x100a92a0
push 0x100a9300
lea ecx, [edi + 0x48]
mov dword [esp + 0x2c], 0xa000
call fcn.1000f8e0
mov dword [edi + 0xa8], 0xf
mov dword [edi + 0xa4], 0
mov byte [edi + 0x94], 0
mov dword [edi + 0xc0], 0xf
mov dword [edi + 0xbc], 0
mov byte [edi + 0xac], 0
mov dword [edi + 0xd8], 0xf
mov dword [edi + 0xd4], 0
mov byte [edi + 0xc4], 0
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0xdc], 0
mov al, byte [eax]
mov byte [edi + 0x92], al
mov byte [edi + 0x14], 0
movdqu xmmword [edi + 0x7c], xmm0
mov dword [edi + 0x8c], 0
mov byte [esp + 0x28], 7
mov word [edi + 0x90], 0
call fcn.100111d0
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x100a96e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100ce3ce
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x10157aa0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
call fcn.10011160
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x30], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esi], vtable.ToraBase::UMulticastSocket.0
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], 1
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], 0x80
push eax
lea edi, [esi + 0xc]
mov dword [esp + 0x2c], 0x40
push 0xc
mov ecx, edi
mov dword [esp + 0x34], 0x80
call fcn.1000f6c0
xorps xmm0, xmm0
mov byte [esp + 0x2c], 1
mov ecx, esi
movdqu xmmword [esi + 0x40], xmm0
call fcn.100a9900
test al, al
jne 0x100a97ac
push str....._sourcemulticast_numulticastsocket.cpp
push 0x17
push str.GetAdaptersInfo_Failed
push str.RuntimeError:_s_in_line__d_of_file__s_n
call fcn.100bde8c
add eax, 0x40
push eax
call fcn.100be158
call fcn.100bde8c
add eax, 0x40
push eax
call fcn.100be01b
add esp, 0x18
xor eax, eax
mov byte [eax], al
push 0x24
call fcn.100badd8
add esp, 4
mov dword [esp + 0x1c], eax
mov byte [esp + 0x2c], 2
test eax, eax
je 0x100a97d9
lea ecx, [esp + 0xf]
mov byte [esp + 0xf], 0
push ecx
push 0
push edi
mov ecx, eax
call fcn.1000fc50
jmp 0x100a97db
xor eax, eax
mov dword [esi + 0x3c], eax
mov eax, esi
mov byte [esi + 8], 0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret

Function at 0x100a9900
Capabilities:
Get local ipv4 addresses

Disassembly:
mov eax, 0x28c8
call fcn.100bc4b0
mov eax, dword [0x10157aa0]
xor eax, esp
mov dword [esp + 0x28c4], eax
push ebx
push edi
push 0x3f
xor edi, edi
mov byte [esp + 0x2890], 0
lea eax, [esp + 0x2891]
mov ebx, ecx
push edi
push eax
call fcn.100bc130
add esp, 0xc
mov dword [esp + 8], 0x2880
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x100a99a4
push str....._sourcemulticast_numulticastsocket.cpp
push 0xd3
push str.GetAdaptersInfo_Failed
push str.RuntimeError:_s_in_line__d_of_file__s_n
call fcn.100bde8c
add eax, 0x40
push eax
call fcn.100be158
call fcn.100bde8c
add eax, 0x40
push eax
call fcn.100be01b
add esp, 0x18
xor eax, eax
pop edi
mov byte [eax], al
xor al, al
pop ebx
mov ecx, dword [esp + 0x28c4]
xor ecx, esp
call fcn.100bb5b4
add esp, 0x28c8
ret
push esi
lea esi, [esp + 0x10]
lea esp, [esp]
push 0x40
lea eax, [esp + 0x2894]
push 0
push eax
call fcn.100bc130
lea eax, [esi + 0x1b0]
add esp, 0xc
lea edx, [esp + 0x2890]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x100a99d3
cmp dword [esi + 0x1a0], 6
jne 0x100a99fc
push 0
lea eax, [esp + 0x2894]
inc edi
push eax
lea ecx, [ebx + 0xc]
call fcn.1000fa90
mov esi, dword [esi]
test esi, esi
jne 0x100a99b0
mov ecx, dword [esp + 0x28d0]
xor eax, eax
test edi, edi
pop esi
pop edi
setg al
pop ebx
xor ecx, esp
call fcn.100bb5b4
add esp, 0x28c8
ret
Function at 0x100a9a30
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x28
mov eax, dword [0x10157aa0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov edi, dword [esp + 0x44]
mov esi, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
push eax
push 0x1002
push 0xffff
push dword [esi + 4]
mov dword [esp + 0x30], 0x989680
call dword [sym.imp.WSOCK32.dll_setsockopt]
test edi, edi
je 0x100a9a8e
push edi
lea ecx, [esi + 0xc]
call fcn.1000fa40
test eax, eax
jne 0x100a9aae
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, eax
test edi, edi
jne 0x100a9aae
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, eax
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [esp + 0x20], xmm0
mov word [esp + 0x20], ax
mov eax, dword [esp + 0xc]
movzx eax, word [eax]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
push edi
mov word [esp + 0x26], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push 0x10
push eax
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
jns 0x100a9b09
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100bb5b4
add esp, 0x28
ret 0x10
xorps xmm0, xmm0
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_inet_addr]
movq qword [esp + 0x18], xmm0
call ebp
push edi
mov dword [esp + 0x18], eax
call ebp
push 8
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0xc
push 0
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
js 0x100a9af3
mov edi, dword [esp + 0x10]
mov ecx, 0x100f7dd4
mov eax, edi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100a9b70
test dl, dl
je 0x100a9b6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100a9b70
add eax, 2
add ecx, 2
test dl, dl
jne 0x100a9b50
xor eax, eax
jmp 0x100a9b75
sbb eax, eax
or eax, 1
test eax, eax
je 0x100a9ba6
mov byte [esi + 8], 1
xorps xmm0, xmm0
movdqu xmmword [esi + 0x40], xmm0
mov eax, 2
mov word [esi + 0x40], ax
mov eax, dword [esp + 0xc]
movzx eax, word [eax]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
push edi
mov word [esi + 0x42], ax
call ebp
mov dword [esi + 0x44], eax
mov ecx, dword [esp + 0x30]
mov al, 1
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.100bb5b4
add esp, 0x28
ret 0x10
Function at 0x100a9bc0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0
push 2
push 2
mov edi, ecx
call dword [sym.imp.WSOCK32.dll_socket]
push 4
lea ecx, [esp + 0x10]
mov dword [edi + 4], eax
push ecx
push 4
push 0xffff
push eax
mov dword [esp + 0x20], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov ebx, dword [sym.imp.WSOCK32.dll_ioctlsocket]
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x8004667e
push dword [edi + 4]
call ebx
test eax, eax
jns 0x100a9c56
call esi
cmp eax, 4
je 0x100a9c00
push str....._sourcemulticast_numulticastsocket.cpp
push 0x42
push str.Can_not_set_FIONBIO_for_socket
push str.RuntimeError:_s_in_line__d_of_file__s_n
call fcn.100bde8c
add eax, 0x40
push eax
call fcn.100be158
call fcn.100bde8c
add eax, 0x40
push eax
call fcn.100be01b
add esp, 0x18
xor eax, eax
mov byte [eax], al
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x100a9c60
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x10157aa0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
xorps xmm0, xmm0
push esi
push edi
mov esi, ecx
mov dword [esp + 8], 0x10
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
push ecx
push 0
push dword [esp + 0x34]
movdqu xmmword [esp + 0x1c], xmm0
push eax
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_recvfrom]
mov edi, eax
test edi, edi
jle 0x100a9cd1
cmp byte [esi + 8], 0
je 0x100a9cd1
lea ecx, [esi + 0x40]
mov esi, 0xc
lea edx, [esp + 0xc]
lea esp, [esp]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x100a9ce6
add edx, 4
add ecx, 4
sub esi, 4
jae 0x100a9cc0
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100bb5b4
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.100bb5b4
add esp, 0x18
ret 8
Function at 0x404630
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407260
test esi, esi
jne 0x404668
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040739c
jmp 0x404686
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404574
mov edi, eax
test esi, esi
je 0x404686
cmp dword [ebx], 0
je 0x404686
dec esi
jmp 0x40466f
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4063d8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x526054], 0
je 0x406439
cmp word [0x526330], 0xd7b2
jne 0x406401
cmp dword [0x526338], 0
jbe 0x406401
mov eax, 0x52632c
call dword [0x526348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406464
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x522030], 0
jne 0x406455
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4065c4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x522038], 0
je 0x4065ea
mov edx, esi
mov eax, ebx
call dword [0x522038]
jmp 0x4065f9
mov eax, 8
call fcn.004042b0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x526055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40658c
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x409458
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4095bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00407260
cmp si, word [0x5227f4]
jb 0x4094f2
cmp si, word [0x5229f4]
ja 0x4094f2
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x4094f2
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x5227f4]
jae 0x4094cc
mov edi, ebx
dec edi
jmp 0x4094ed
cmp si, word [ebx*8 + 0x5227f4]
jbe 0x4094dc
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x4094ed
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x5227f8]
call fcn.00409368
jmp 0x4094f2
cmp edi, dword [ebp - 0xc]
jae 0x4094b6
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4095a1
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4095a1
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00407448
push dword [ebp - 0x164]
push 0x4095dc
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00407448
push dword [ebp - 0x168]
push 0x4095ec
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00407448
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00407800
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4095c6
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00407258
ret
Function at 0x4095f0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 6], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x4097d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x528b5c
call sub.kernel32.dll_EnterCriticalSection
movzx eax, word [0x528b74]
cmp ax, word [ebp - 2]
jne 0x409648
mov eax, dword [ebp - 6]
mov edx, 0x528b78
mov ecx, 0x55
call fcn.00407448
push 0x528b5c
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4097c0
push 0x528b5c
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [ebp - 6]
xor edx, edx
call fcn.00407260
push 2
movzx eax, word [ebp - 2]
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x409788
cmp byte [0x528b58], 0
je 0x40973e
call dword [0x528b50]
mov word [ebp - 0x16], ax
movzx eax, word [ebp - 2]
push eax
call dword [0x528b54]
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x409737
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x528b4c]
test al, al
je 0x409710
mov eax, dword [ebp - 0xc]
add eax, eax
call fcn.004042b0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x528b4c]
mov edx, dword [ebp - 0xc]
sub edx, 2
test edx, edx
jb 0x409705
inc edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
jne 0x409701
mov ecx, dword [ebp - 0x10]
mov word [ecx + eax*2], 0x2c
inc eax
dec edx
jne 0x4096ee
mov eax, dword [ebp - 6]
mov edx, dword [ebp - 0x10]
call fcn.0040740c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409788
movzx eax, word [ebp - 0x16]
push eax
call dword [0x528b54]
cmp dword [ebp - 0x10], 0
je 0x409736
mov eax, dword [ebp - 0x10]
call fcn.004042cc
ret
mov edx, dword [ebp - 6]
movzx eax, word [ebp - 2]
call fcn.00409458
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp ax, word [ebp - 2]
je 0x409788
mov eax, dword [ebp - 6]
cmp dword [eax], 0
je 0x40976d
mov eax, dword [ebp - 6]
mov edx, 0x4097f0
call fcn.0040765c
mov eax, dword [ebp - 6]
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x1c]
call fcn.00409458
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 6]
call fcn.0040765c
mov eax, dword [ebp - 6]
push 0x528b5c
call sub.kernel32.dll_EnterCriticalSection
movzx eax, word [ebp - 2]
mov word [0x528b74], ax
push 0xaa
mov eax, dword [ebp - 6]
mov eax, dword [eax]
call fcn.004072ec
push eax
push 0x528b78
call sub.kernel32.dll_lstrcpynW
push 0x528b5c
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4097dd
lea eax, [ebp - 0x1c]
call fcn.00407250
ret
Function at 0x409ec4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.00407248
mov eax, dword [ebp - 0x21c]
call fcn.00407248
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x40a063
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00407260
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.004072ec
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x409f64
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x409f76
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x409f61
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x40a02f
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x409f9f
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00409a14
cmp dword [ebp - 0x220], 0
je 0x409fd7
push ebp
mov eax, dword [ebp - 0x220]
call fcn.00409db8
pop ecx
mov ebx, eax
jmp 0x40a02f
push ebp
call sub.kernel32.dll_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.004095f0
mov eax, dword [ebp - 0x224]
call fcn.00409db8
pop ecx
mov ebx, eax
test bl, bl
jne 0x40a022
cmp byte [0x528b58], 0
jne 0x40a022
push ebp
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.004095f0
mov eax, dword [ebp - 0x228]
call fcn.00409db8
pop ecx
mov ebx, eax
test bl, bl
jne 0x40a02f
push ebp
call fcn.00409e68
pop ecx
mov ebx, eax
test bl, bl
je 0x40a045
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00407448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a06a
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.00407258
ret

Function at 0x40a820
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret