joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f9d2c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1011a0e8
push 0x1011a0e0
push str.FlsAlloc
push 0x1f
call fcn.100f9b97
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100f9d60
push dword [ebp + 8]
mov ecx, esi
call dword [0x101102e8]
call esi
jmp 0x100f9d66
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100f9daa
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1011a0f8
push 0x1011a0f0
push str.FlsGetValue
push 0x21
call fcn.100f9b97
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100f9de1
push dword [ebp + 8]
mov ecx, esi
call dword [0x101102e8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100f9de9
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1011a100
push 0x1011a0f8
push str.FlsSetValue
push 0x22
call fcn.100f9b97
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100f9e23
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x101102e8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x100f9ec1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.GetTempPath2W
push 0x10119fd4
push str.GetTempPath2W
push 5
call fcn.100f9b97
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100f9efb
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x101102e8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetTempPathW]
Function at 0x100fdc7f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100fdd1c
push ebx
push esi
call fcn.100fdc48
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100fc04a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100fdcc9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100fdd1b
push edi
push eax
call fcn.100f43af
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100fdce9
call fcn.100f43fd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100fdd1a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100fc04a
add esp, 0x20
test eax, eax
jne 0x100fdd08
push edi
call fcn.100f43fd
jmp 0x100fdd10
push ebx
call fcn.100f43fd
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100fdd1f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100fdd30
pop esi
ret
push ebx
push edi
push esi
call fcn.100fdc48
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100f43af
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100fdd58
push ebx
push esi
push edi
call fcn.100c9a70
add esp, 0xc
push 0
call fcn.100f43fd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100fe4b2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100fdfcd
Function at 0x10104dd0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100f4a3c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10104e3f
cmp esi, dword [ebp - 4]
je 0x10104e3a
cmp dword [ebp + 0xc], 0
je 0x10104e3a
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10104e17
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10104922
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10104e41
xor eax, eax
inc eax
jmp 0x10104e41
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10104ea6
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1012f018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100f4a3c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100f4a3c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10104f1d
cmp word [ecx], dx
je 0x10104f1d
mov eax, dword [0x1011acd4]
push edi
dec eax
push eax
push 0x1011abc0
call fcn.10104e45
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10104f90
cmp word [eax], dx
je 0x10104f90
mov eax, dword [edi]
test eax, eax
je 0x10104f41
cmp word [eax], dx
je 0x10104f41
lea eax, [ebp - 0x10]
push eax
call fcn.10104828
jmp 0x10104f4a
lea eax, [ebp - 0x10]
push eax
call fcn.101048c3
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10104fba
mov eax, dword [0x1011abbc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1011a8b0
call fcn.10104e45
add esp, 0xc
test al, al
je 0x10104fba
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10104f85
cmp word [eax], di
je 0x10104f85
lea eax, [ebp - 0x10]
push eax
call fcn.10104828
pop ecx
jmp 0x10104fbc
lea eax, [ebp - 0x10]
push eax
call fcn.101048c3
jmp 0x10104f82
mov eax, dword [edi]
test eax, eax
je 0x10104fa7
cmp word [eax], dx
je 0x10104fa7
lea eax, [ebp - 0x10]
push eax
call fcn.101047dd
pop ecx
jmp 0x10104fba
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10105085
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10104cca
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10105085
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10105085
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10105085
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10105012
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100fa009
test ebx, ebx
je 0x10105080
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100fa009
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10105085
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10105085
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10100b7b
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10105087
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bf15
leave
ret
Function at 0x10107c9b
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10107c17
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10107e0a
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10107e0a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10107dbf
jg 0x10107cf7
test eax, eax
je 0x10107db5
push 1
push 0x1000
call fcn.100f8fc4
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10107d1a
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10107dac
push 0x8000
push ebx
call fcn.10107b48
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10107d43
jg 0x10107d3e
cmp ecx, 0x1000
jb 0x10107d43
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100ff4ab
add esp, 0x10
cmp eax, 0xffffffff
je 0x10107d88
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10107d3e
jl 0x10107d6f
test ecx, ecx
jne 0x10107d30
push dword [ebp - 0xc]
push ebx
call fcn.10107b48
push esi
call fcn.100f43fd
add esp, 0xc
xor ebx, ebx
jmp 0x10107e18
cmp byte [edi + 0x24], 0
je 0x10107d9f
cmp dword [edi + 0x20], 5
jne 0x10107d9f
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10107daa
mov ebx, dword [edi + 0x18]
jmp 0x10107dac
xor ebx, ebx
push esi
call fcn.100f43fd
pop ecx
jmp 0x10107e18
test ecx, ecx
jg 0x10107d81
jl 0x10107dbf
test eax, eax
jae 0x10107d81
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1010007e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10107ddf
cmp byte [edi + 0x1c], 0
je 0x10107d81
jmp 0x10107e10
push ebx
call fcn.10102cde
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10107d81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10107e18
cmp byte [edi + 0x1c], 0
je 0x10107e15
mov ebx, dword [edi + 0x18]
jmp 0x10107e18
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1010007e
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003910
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xe5
hlt
aas
inc ebp
sbb eax, 0x9d531500
add al, 0x99
push es
in al, 0x89
and al, 0x10
adc dword [eax - 0x3a], ebp
jb 0x10003922
mov word [edx - 0x5b], ss
push es
sahf
ja 0x10003964
rcr edi, 1
mov ch, 0xf7
popal
jle 0x100039a0
xor ch, byte [edi + 0x32b5ca0d]
cld
mov ecx, dword [ebx + ebp*8 - 0x79]
mov ah, 0xfc
fist dword [eax]
arpl word [ecx + eax*8 - 0x793dd17e], di
loope 0x1000397f
dec esp
jmp 0x100038c4
ret 0xe186
inc ebx
jns 0x1000399a
loope 0x10003947
dec edx
aad 0x29
invalid
jecxz 0x1000393a
sbb al, 0x90
hlt
pop es
mov al, byte [0x8338bc5d]
invalid
dec edi
popfd
dec edx
invalid
out dx, al
cmpsw word [esi], word es:[edi]
mov ebp, 0x8b8ca6d3
aam 0x4e
pop eax
sbb byte [ebp - 0x34e36370], cl
les edx, [eax + 0x5e]
jmp 0x100039b1

Function at 0x10517058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105171a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1051707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1051706a
add dl, dl
jne 0x10517089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105170dc
xor eax, eax
add dl, dl
jne 0x10517096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1051717d
add dl, dl
jne 0x105170a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105170b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105170bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105170c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105170d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10517075
mov eax, 1
add dl, dl
jne 0x105170ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105170f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105170e1
sub eax, ebx
mov ebx, 1
jne 0x10517128
mov ecx, 1
add dl, dl
jne 0x1051710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10517119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10517105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10517075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1051713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1051714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10517136
cmp eax, 0x7d00
jae 0x1051716d
cmp eax, 0x500
jb 0x10517168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10517075
cmp eax, 0x7f
ja 0x10517170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10517075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1051719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10517075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4058c4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405b54
mov byte [esp], al
cmp byte [esp], 0
jne 0x405a44
test edi, edi
je 0x405a44
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405984
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x40595f
cmp edi, 0xffffffff
je 0x405923
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405923
mov byte [esp], 0
jmp 0x405a44
mov ebx, dword [esi]
cmp ebx, 1
jg 0x40595f
test ebx, ebx
jne 0x405955
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x405955
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405a44
call 0x405b94
dec ebp
test ebp, ebp
jg 0x405908
cmp edi, 0xffffffff
je 0x405984
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405982
mov byte [esp], 0
jmp 0x405a44
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4058d2
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405984
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405ab0
mov edx, eax
mov ebx, dword [0x4b68f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4059e8
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4059e6
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4059e8
xor edi, edi
cmp byte [esp], 0
je 0x405a0e
mov ebx, dword [esi]
test bl, 1
jne 0x405a24
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4059ee
mov byte [esp + 1], 1
jmp 0x405a24
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405a0e
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x40599b
cmp byte [esp], 0
je 0x405a44
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406398
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x4b8b18
cmp dword [ebp + 0xc], 2
jl 0x4063ac
mov ebx, 0x4b8b48
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x4063e4
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x402c44
mov dword [0x4b6018], eax
mov eax, 0x402c4c
mov dword [0x4b601c], eax
mov eax, ebx
call fcn.0040627c
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x406419
cmp al, 3
jge 0x406419
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40642a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x406435
call dword [ecx + eax*4]
cmp dword [0x4b603c], 0
jne 0x40644b
mov byte [0x4b6044], 1
fnstcw word [0x4b3028]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.004066e8
call fcn.0040632c
ret 4

Function at 0x406650
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4b6058], 0
je 0x4066b7
cmp word [0x4b6344], 0xd7b2
jne 0x406679
cmp dword [0x4b634c], 0
jbe 0x406679
mov eax, 0x4b6340
call dword [0x4b635c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4066e4
call fcn.0040713c
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b3032], 0
jne 0x4066d3
push 0
push 0x4b39ba
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x408d30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408e95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004068e8
cmp si, word [0x4b39f8]
jb 0x408dc8
cmp si, word [0x4b3bf8]
ja 0x408dc8
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x408dc8
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4b39f8]
jae 0x408da2
mov edi, ebx
dec edi
jmp 0x408dc3
cmp si, word [ebx*8 + 0x4b39f8]
jbe 0x408db2
inc ebx
mov dword [ebp - 8], ebx
jmp 0x408dc3
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4b39fc]
call fcn.00408c50
jmp 0x408dc8
cmp edi, dword [ebp - 8]
jae 0x408d8c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x408e77
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408e77
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004074e0
push dword [ebp - 0x160]
push 0x408eb0
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004074e0
push dword [ebp - 0x164]
push 0x408ec0
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004074e0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00407718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408e9c
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406948
ret
Function at 0x409048
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40914b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b8b88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4b8ba0]
jne 0x409094
mov eax, esi
mov edx, 0x4b8ba2
mov ecx, 0x55
call fcn.004074e0
push 0x4b8b88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x409135
push 0x4b8b88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.004068e8
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x409103
cmp byte [0x4b8b84], 0
je 0x4090c8
mov edx, esi
mov eax, ebx
call fcn.00408f2c
jmp 0x409103
mov edx, esi
mov eax, ebx
call fcn.00408d30
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x409103
cmp dword [esi], 0
je 0x4090ec
mov eax, esi
mov edx, 0x409164
call fcn.00407638
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408d30
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407638
push 0x4b8b88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4b8ba0], bx
push 0xaa
mov eax, dword [esi]
call fcn.0040743c
push eax
push 0x4b8ba2
call sub.kernel32.dll_lstrcpynW
push 0x4b8b88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409152
lea eax, [ebp - 4]
call fcn.004068e8
ret
Function at 0x409380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069cc
xor eax, eax
push ebp
push 0x4095a5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x4093c0
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x4093da
push 0x105
mov eax, dword [ebp - 4]
call fcn.0040743c
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40958f
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4095b4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4094a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4095b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4094a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4095f0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4094a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4095f0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4094a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409624
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4094a9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409658
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40958f
xor eax, eax
push ebp
push 0x409588
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040918c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409518
mov eax, dword [ebp - 0x10]
call fcn.004048d4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004074a4
jmp 0x409563
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x409698
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409563
mov eax, dword [ebp - 0x10]
call fcn.004048d4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x409698
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004074a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40958f
cmp dword [ebp - 8], 0
je 0x40957e
mov eax, dword [ebp - 8]
call fcn.004048f0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4095ac
lea eax, [ebp - 4]
call fcn.004068e8
ret