joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bf40
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40df00
call fcn.0040c5e8
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x40f754
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x40bd15
cmp eax, esi
jne 0x40bd08
xor esi, esi
inc esi
mov edi, esi
jmp 0x40bd18
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40bcec
xor esi, esi
inc esi
cmp dword [0x40f758], esi
jne 0x40bd2a
push 0x1f
call fcn.004a2000
pop ecx
jmp 0x40bd64
cmp dword [0x40f758], ebx
jne 0x40bd5e
mov dword [0x40f758], esi
push 0x401698
push 0x40168c
call fcn.0040be9e
pop ecx
pop ecx
test eax, eax
je 0x40bd64
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40be8e
mov dword [0x40ee70], esi
cmp dword [0x40f758], esi
jne 0x40bd87
push 0x401688
push 0x40164c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40f758], 2
test edi, edi
jne 0x40bd94
xor eax, eax
mov ecx, 0x40f754
xchg dword [ecx], eax
cmp dword [0x40f764], 0
je 0x40bdc0
push 0x40f764
call fcn.0040c440
pop ecx
test eax, eax
je 0x40bdc0
push ebx
push 2
push ebx
mov esi, dword [0x40f764]
mov ecx, esi
call dword [0x4101d0]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x40bd4d
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, si
ja 0x40be2b
test ax, ax
je 0x40bdfa
test edx, edx
jne 0x40be2b
test ax, ax
je 0x40bdfa
cmp ax, si
ja 0x40bdfa
add ecx, 2
mov dword [ebp - 0x20], ecx
movzx eax, word [ecx]
jmp 0x40bde5
test byte [ebp - 0x3c], 1
je 0x40be06
movzx eax, word [ebp - 0x38]
jmp 0x40be09
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x40ee6c], eax
cmp dword [0x40ee84], 0
jne 0x40be73
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x40be3c
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40bdd4
cmp dword [0x40ee70], 0
jne 0x40be87
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x40ee6c]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.0040c535
jmp 0x40bcc3

Function at 0x40c324
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40df40
call fcn.0040c5e8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40c384
cmp eax, 0xffffffff
je 0x40c384
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40c37d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40c37d
cmp edx, 0x10000000
jae 0x40c37d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40c37a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c3f0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40c42e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40c426
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40c430
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40c416
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40c500
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40c531
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40c531
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40c531
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x408d6c
Capabilities:
Create process on windows

Disassembly:
push 0x238
mov eax, 0x4394d8
call fcn.0041ea10
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x228]
push str.ProcessRequestFromArmService...
call fcn.004020ed
xor ebx, ebx
lea eax, [ebp - 0x228]
push ebx
push eax
push 2
mov dword [ebp - 4], ebx
call fcn.00403025
mov ecx, dword [ebp - 0x228]
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00401a64
lea ecx, [ebp - 0x244]
call fcn.0040be6e
xor edi, edi
lea ecx, [ebp - 0x240]
inc edi
push esi
mov dword [ebp - 4], edi
call fcn.00402209
lea ecx, [ebp - 0x21c]
call fcn.00401369
mov byte [ebp - 4], 2
call fcn.0040fd19
push eax
lea ecx, [ebp - 0x22c]
call fcn.00401330
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 3
push eax
call fcn.00405bd7
pop ecx
test eax, eax
jne 0x408e4b
push str.Helper_finished__get_adobearm.exe_path_failed
lea ecx, [ebp - 0x228]
call fcn.004020ed
push 6
pop ebx
push ebx
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 4
push eax
push edi
call fcn.00403025
mov ecx, dword [ebp - 0x228]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00401a64
push ebx
call fcn.0040a158
pop ecx
jmp 0x40924a
call fcn.0040fd19
push eax
lea ecx, [ebp - 0x238]
call fcn.00401330
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x244]
call fcn.0040c293
push str.SYSTEM
push dword [ebp - 0x238]
call fcn.00423b8e
pop ecx
pop ecx
test eax, eax
mov dword [ebp - 0x234], ebx
push 1
mov edi, ebx
pop eax
cmove edi, eax
test edi, edi
jne 0x408ebb
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], ebx
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00406954
add esp, 0xc
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.00402458
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x228], esi
push 6
pop ebx
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], bl
call fcn.00407c3f
test eax, eax
jne 0x408fa0
lea ecx, [ebp - 0x244]
call fcn.00407ca7

Function at 0x40a5d1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
xor esi, esi
call fcn.004020ed
mov eax, dword [ebp - 8]
mov edi, dword [eax - 0xc]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a642
mov ecx, dword [ebp + 0x18]
cmp ecx, 1
je 0x40a61d
cmp ecx, 2
je 0x40a61d
push edi
jmp 0x40a621
lea eax, [edi + edi]
push eax
push dword [ebp + 0x14]
push ecx
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401a64
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x40a653
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0xf003f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a6b7
push esi
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
test esi, esi
pop esi
cmove edi, eax
mov eax, edi
pop edi
leave
ret
Function at 0x418060
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call dword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x4180d8
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
call fcn.00418010
push str.WavePad_Internal
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
test esi, esi
mov dword [esp + 4], eax
je 0x4180b6
mov ecx, dword [0x4c9abc]
push 0x4c97ac
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea edx, [esp + 4]
push 1
push edx
call dword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
mov ecx, eax
pop esi
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
xor eax, eax
test ecx, ecx
setne al
add esp, 8
ret
xor ecx, ecx
xor eax, eax
test ecx, ecx
setne al
pop esi
add esp, 8
ret

Function at 0x42c052
Capabilities:
Encode data using xor

Disassembly:
push edx
insb byte es:[edi], dx
in eax, dx
or dword [ecx], edi
sar bl, 0xb4
push esp
inc dword [edx + 0x3cde63b3]
jmp 0x42c090
push edi
mov dl, 0x75
mov dword [0x4d55fa7c], eax
jl 0x42c08c
push ebp
dec ebp
xchg esi, eax
cmpsb byte [esi], byte es:[edi]
pop edi
invalid

Function at 0x450289
Capabilities:
Encode data using xor

Disassembly:
into
fnstsw word [ebp - 0x5889afa2]
add esi, ebx
mov bh, cl
push ebp
out 0xca, al
mov esi, 0x22b032ad
xor dh, byte [eax + 0x35586b22]
popal
imul edi, dword [ecx + edi*2 - 0x5f], 0xffffffdf
sub eax, 0xef3319cd
xor ebp, edi
pop es
pop ebx
dec eax
scasb al, byte es:[edi]
lodsb al, byte [esi]
mov bl, 0x59
out dx, eax
outsb dx, byte [esi]
sub ebx, dword [edi - 0x61]
ficomp dword [eax - 0x2d]
sub eax, 0x455e7d9a
jg 0x450298
xchg ebx, eax
jmp dword [0x578d08bd]
Function at 0x4ac253
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x6c], 0xf
Function at 0x4bcb0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c6370
cmp edx, dword [eax]
je 0x4bcb2f
add eax, 8
inc ecx
cmp eax, 0x4c6400
jl 0x4bcb20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c6370]
jne 0x4bcc5d
mov eax, dword [0x4cacfc]
cmp eax, 1
je 0x4bcc37
test eax, eax
jne 0x4bcb60
cmp dword [0x4c629c], 1
je 0x4bcc37
cmp edx, 0xfc
je 0x4bcc5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bcb97
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bd4f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd980
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bcbda
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd980
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1c84
push edi
call fcn.004bf850
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bd4f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd500
lea eax, [ebp - 0xa0]
push 0x4c1c64
push eax
call fcn.004bd500
push dword [esi + 0x4c6374]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd500
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bf7c4
add esp, 0x2c
pop edi
jmp 0x4bcc5d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c6374]
push 0
push eax
push dword [esi]
call fcn.004bd980
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40455c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406a28
test esi, esi
jne 0x404594
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406b64
jmp 0x4045b2
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044a0
mov edi, eax
test esi, esi
je 0x4045b2
cmp dword [ebx], 0
je 0x4045b2
dec esi
jmp 0x40459b
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405e28
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x565054], 0
je 0x405e89
cmp word [0x565330], 0xd7b2
jne 0x405e51
cmp dword [0x565338], 0
jbe 0x405e51
mov eax, 0x56532c
call dword [0x565348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405eb4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x55c030], 0
jne 0x405ea5
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406034
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x55c034], 0
je 0x40605a
mov edx, esi
mov eax, ebx
call dword [0x55c034]
jmp 0x406069
mov eax, 8
call fcn.004041e8
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x565055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405ffc
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.KERNEL32.DLL_CreateThread_1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4088f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408a5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406a28
cmp si, word [0x55c7dc]
jb 0x40898e
cmp si, word [0x55c9dc]
ja 0x40898e
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x40898e
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x55c7dc]
jae 0x408968
mov edi, ebx
dec edi
jmp 0x408989
cmp si, word [ebx*8 + 0x55c7dc]
jbe 0x408978
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408989
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x55c7e0]
call fcn.00408804
jmp 0x40898e
cmp edi, dword [ebp - 0xc]
jae 0x408952
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408a3d
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x408a3d
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW_1
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW_1
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406c38
push dword [ebp - 0x164]
push 0x408a78
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406c38
push dword [ebp - 0x168]
push 0x408a88
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406c38
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406ff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408a62
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406a20
ret
Function at 0x408c14
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408d19
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x567b5c
call sub.KERNEL32.DLL_EnterCriticalSection_1
cmp bx, word [0x567b74]
jne 0x408c60
mov eax, esi
mov edx, 0x567b78
mov ecx, 0x55
call fcn.00406c38
push 0x567b5c
call sub.KERNEL32.DLL_LeaveCriticalSection_1
jmp 0x408d03
push 0x567b5c
call sub.KERNEL32.DLL_LeaveCriticalSection_1
mov eax, esi
xor edx, edx
call fcn.00406a28
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x408cd1
cmp byte [0x567b58], 0
je 0x408c96
mov edx, esi
mov eax, ebx
call fcn.00408af4
jmp 0x408cd1
mov edx, esi
mov eax, ebx
call fcn.004088f4
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408cd1
cmp dword [esi], 0
je 0x408cba
mov eax, esi
mov edx, 0x408d34
call fcn.00406e4c
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004088f4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406e4c
push 0x567b5c
call sub.KERNEL32.DLL_EnterCriticalSection_1
mov word [0x567b74], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406ab4
push eax
push 0x567b78
call sub.KERNEL32.DLL_lstrcpynW
push 0x567b5c
call sub.KERNEL32.DLL_LeaveCriticalSection_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d20
lea eax, [ebp - 4]
call fcn.00406a18
ret
Function at 0x408f58
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a10
xor eax, eax
push ebp
push 0x40913d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408f98
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW_1
jmp 0x408fb2
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406ab4
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.KERNEL32.DLL_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x409127
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40914c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
je 0x409041
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40914c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
je 0x409041
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409180
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
je 0x409041
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4091b4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x409127
xor eax, eax
push ebp
push 0x409120
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408d5c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4090b0
mov eax, dword [ebp - 0x10]
call fcn.004041e8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406be4
jmp 0x4090fb
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x4091f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4090fb
mov eax, dword [ebp - 0x10]
call fcn.004041e8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x4091f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409127
cmp dword [ebp - 8], 0
je 0x409116
mov eax, dword [ebp - 8]
call fcn.00404204
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409144
lea eax, [ebp - 4]
call fcn.00406a18
ret
Function at 0x409408
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.00406a10
mov eax, dword [ebp - 0x21c]
call fcn.00406a10
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x4095a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406a28
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.00406ab4
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.KERNEL32.DLL_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.KERNEL32.DLL_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x4094a8
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x4094ba
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x4094a5
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x409573
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x4094e3
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00408f58
cmp dword [ebp - 0x220], 0
je 0x40951b
push ebp
mov eax, dword [ebp - 0x220]
call fcn.004092fc
pop ecx
mov ebx, eax
jmp 0x409573
push ebp
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.00408c14
mov eax, dword [ebp - 0x224]
call fcn.004092fc
pop ecx
mov ebx, eax
test bl, bl
jne 0x409566
cmp byte [0x567b58], 0
jne 0x409566
push ebp
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.00408c14
mov eax, dword [ebp - 0x228]
call fcn.004092fc
pop ecx
mov ebx, eax
test bl, bl
jne 0x409573
push ebp
call fcn.004093ac
pop ecx
mov ebx, eax
test bl, bl
je 0x409589
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4095ae
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.00406a20
ret

Function at 0x40d2fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x567c5c
push 0xa
push 0x40d390
mov eax, dword [0x567c40]
push eax
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40d320
call fcn.0041a5a4
push ebx
mov eax, dword [0x567c40]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40d337
call fcn.0041a5a4
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40d349
call fcn.0041a5a4
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x567c60], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x567c64], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x567c68], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x567c6c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x567c70], ecx
add edx, dword [eax + 0x14]
mov dword [0x567c74], edx
pop esi
pop ebx
ret