joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423373
Capabilities:
Print debug messages

Disassembly:
mov edx, dword [esp]
mov byte [esp + 4], 0x35
mov word [esp], bx
mov edx, 0x4118bc
bswap ax
lahf
mov eax, 0x411570
pushfd
lea esp, [esp + 0x10]
call fcn.004088ac
pushal
cmp dword [ebp - 8], 1
push 0xf51d7eb4
mov byte [esp + 4], dh
pushfd
push esi
lea esp, [esp + 0x2c]
jne 0x42624b
pushfd
mov word [esp], 0x9e12
mov byte [esp], 0xa1
push dword [esp]
mov dword [esp + 4], 0x4118e0
push esp
mov byte [esp], 0x40
call fcn.0041af51

Function at 0x4238c3
Capabilities:
Print debug messages

Disassembly:
movsx eax, dl
movzx ax, dl
mov dword [esp], 0
seto al
push 0
setne ah
jmp 0x425b09
movsx ax, dl
mov eax, dword [esp + 0x20]
push ecx
jmp loc.004111fe

Function at 0x423a53
Capabilities:
Read file on windows

Disassembly:
lea esp, [esp + 0x40]
call sub.ntdll.dll_NtReadFile
pushal
pushal
cmc
cmp eax, 0x103
pushfd
mov word [esp], 0xf643
call fcn.004255ce

Function at 0x423ab4
Capabilities:
Print debug messages

Disassembly:
push 0x6155eda7
pushfd
mov byte [esp + 4], bl
lea esp, [esp + 0x2c]
call sub.ntdll.dll_DbgPrint
cmc
pushfd
mov byte [esp], dh
add esp, 0xc
pushfd
pushal
call fcn.0041e6df

Function at 0x423c47
Capabilities:
Print debug messages

Disassembly:
stc
test byte [ebp - 1], 0x80
push eax
lea esp, [esp + 4]
jne 0x42353b
pushal
push 0x6db56eec
cmp dh, ch
cmp byte [ebp - 0x11], 0
pushal
pushfd
lea esp, [esp + 0x48]
je 0x42353b
clc
test di, 0x64f1
call fcn.0040cf85
not ah
mov ah, ch
mov eax, dword [esp + 0xc]
push ebp
call fcn.00424d88
jmp 0x4205ae
pushfd
lea esp, [esp + 0xc]
je 0x42353b
pushfd
mov dword [esp], 0x4116c8
push ecx
lea esp, [esp + 4]
call sub.ntdll.dll_DbgPrint
pushfd
mov ecx, dword [esp + 4]
pushal
mov al, byte [ebp - 0xf]
bswap ecx
mov byte [ebp - 0x13], al
cdq
lahf
setae dl
mov byte [ebp - 0x15], 1
push ecx
movzx cx, dl
mov edx, 0x4115e0
pushfd
lea eax, [0xe27124cf]
xchg cx, ax
mov eax, 0x411570
movzx cx, cl
lea ecx, [eax + 0xe2e3b7d]
mov cl, 0xc8
mov ecx, 1
push 0x9e4e673b
push 0x4682985d
pushfd
pushfd
lea esp, [esp + 0x40]
call fcn.004087e0
jmp 0x424c67
mov edx, dword [ebp - 4]
pushfd
lea esp, [esp + 4]
call fcn.0040c228
push edi
mov byte [ebp - 0xd], al
push dword [esp]
cmp byte [ebp - 0xd], 0
jmp 0x41f3e1
xchg edx, eax
pushfd
push ebx
mov word [esp + 4], 0xee2a
lea esp, [esp + 0x34]
call fcn.004087e0
rdtsc
setle ah
lea eax, [ebp - 0x36]
jmp 0x41e115
jmp 0x41df09

Function at 0x423d6e
Capabilities:
Print debug messages
Read file on windows

Disassembly:
lea esp, [esp + 8]
je 0x421f39
push esi
pushfd
pushfd
call fcn.0040c917
lea esp, [esp + 0x58]
call sub.ntdll.dll_NtReadFile
pushal
cmp eax, 0x103
mov byte [esp + 4], 0x4c
call fcn.0041d479
call fcn.0040ce45
cmp dx, dx
pushfd
test byte [ebp - 3], 0x80
push eax
jmp 0x4205e7

Function at 0x423e24
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 4]
call fcn.0040e018
test al, ch
call fcn.0042758f

Function at 0x423e34
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x30]
call sub.ntdll.dll_DbgPrint
shld ax, di, cl
add esp, 8
cwde
lea eax, [edx + 0x48e7281a]
not ax
pushal
mov eax, esi
push ebp
lea esp, [esp + 0x24]
call fcn.00408b30
jmp 0x41f549
Function at 0x423ee9
Capabilities:
Check http status code
Execute anti-debugging instructions
Print debug messages

Disassembly:
pushal
pushfd
pushfd
lea esp, [esp + 0x34]
je 0x4276c8
xadd dl, al
das
ror ah, 1
mov eax, dword [esp + 0x10]
rcr dh, cl
add dword [ebx + 0xc], eax
rdtsc
rdtsc
call fcn.00424669

Function at 0x423f2d
Capabilities:
Print debug messages

Disassembly:
mov edx, dword [esp + 8]
pushal
jmp 0x41eef0
push 0x883a2c7b
mov ecx, dword [esp + 0x30]
lea ecx, [ebp + 0x3deb4c44]
call fcn.0041eda4
jmp 0x41dd0b

Function at 0x423f32
Capabilities:
Print debug messages

Disassembly:
lea eax, [edi*4 + 0x4d5c6c08]
call fcn.00423090

Function at 0x423f3e
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0xc]
call sub.ntdll.dll_DbgPrint
mov ch, bh
seto ch
pushfd
mov ecx, dword [esp + 4]
push eax
pushal
lea esp, [esp + 0x2c]
jmp fcn.0041ea1f

Function at 0x424033
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0xc]
je 0x41ec26
jmp 0x4242e0
pushal
mov byte [esp], 0xb3
xor eax, eax
stc
jmp loc.0041a364

Function at 0x42413a
Capabilities:
Print debug messages

Disassembly:
pushal
lea esp, [esp + 0x28]
call fcn.0040cc8a
call fcn.00420f0f
jmp 0x41e11a

Function at 0x424489
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 0x24], ebx
push ebp
jmp loc.0040c89b
jmp 0x4253d5
pop edi
invalid
pushfd
pushal
call fcn.0040d2f9
add byte [eax], al
js 0x42215a
pop es
clc
pop ebp
add bl, dh
sbb esi, edx
cmp dword [esi - 3], 0x33
outsd dx, dword [esi]
sub eax, dword [esi]
add byte [eax + 0x68], ah
pushal
push 0x783fd3b9
push ebx
mov dword [esp + 0x28], eax
jmp 0x420535
jge 0x422163
push 0x1bac8bb
pushal
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
je 0x42055b
pushal
lea esp, [esp + 0x20]
call sub.ntdll.dll_NtClose
pushal
lea esp, [esp + 0x20]
jmp loc.0040cfc4
lea esp, [esp + 0x48]
call sub.ntdll.dll_DbgPrint
ror ax, 9
add esp, 8
lahf
push 0xccf1de7f
mov eax, esi
pushal
pushal
pushfd
lea esp, [esp + 0x48]
call fcn.00408b30
bswap ax
bswap ax
movzx ax, cl
not eax
mov eax, dword [esp + 0xc]
pushal
push ecx
mov dword [esp + 0x20], eax
push 0xb59be8fd
pushal
lea esp, [esp + 0x44]
call sub.ntdll.dll_NtClose
jmp 0x422650

Function at 0x4246be
Capabilities:
Execute anti-debugging instructions
Print debug messages

Disassembly:
lea esp, [esp + 0x24]
call fcn.00408040
bswap cx
movzx cx, bl
movzx dx, al
setle dl
mov edx, 0x411570
pushal
not cl
pushal
mov ecx, dword [ebp - 4]
call fcn.00426ccf

Function at 0x424bb2
Capabilities:
Print debug messages

Disassembly:
call fcn.00422af1
mov byte [esp + 4], 0xa
push 0x5d699ba4
pushfd
lea esp, [esp + 0x2c]
je 0x42353b
push 0xfc203bc8
mov dword [esp], 0x4116e4
pushfd
lea esp, [esp + 4]
jle 0x424135
push 0xbe1d3982
lea esp, [esp + 4]
call sub.ntdll.dll_DbgPrint
not cl
not ecx
pop ecx
pushal
pushal
lea esp, [esp + 0x40]
call fcn.0040fe64
aas
xor edx, edx
call fcn.004219fb
Function at 0x424ed0
Capabilities:
Print debug messages

Disassembly:
push esi
lea esp, [esp + 4]
call fcn.004101a8
call fcn.00420b67
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx + 0x5a], dl
push ecx
pop edx
movzx edx, al
lea ecx, [ebp - 8]
bswap ax
jmp 0x427118
lea esp, [esp + 0x30]
je 0x41f983
jmp 0x425470
push ebx
mov byte [esp], bh
call fcn.0042567d

Function at 0x424fa5
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt di, 1
pushfd
cmp byte [ebp - 0x12], 0
pushal
lea esp, [esp + 0x2c]
je 0x42353b
bswap cx
lea edx, [ecx*2 - 0x101a60bb]
push 0xc254648a
rdtsc
mov dword [esp], 0
rdtsc
xchg ah, dh
lea ecx, [ebp - 0x11]
rdtsc
bswap dx
jg 0x425133
mov edx, 0x411620
movzx ax, dl
mov eax, 0x411570
jmp loc.0040d1b5

Function at 0x4253e4
Capabilities:
Print debug messages

Disassembly:
push edi
lea eax, [ebx + ebp*4 + 0x28]
push ebp
call fcn.004227eb
lahf
mov eax, esp
pushfd
jmp 0x4227c5
test eax, eax
push ebp
jmp 0x425c06
push esi
lea esp, [esp + 0x1c]
je 0x421833
not dl
movzx dx, bl
bswap edx
push 0x7baf0b9a
mov edx, eax
setg al
pop eax
jmp 0x423cc8

Function at 0x4255ce
Capabilities:
Print debug messages

Disassembly:
push 0
jmp 0x41ddb9
lea esp, [esp + 0x48]
jne 0x4227e1
cwde
not al
push 0
lahf
jmp 0x4226a6

Function at 0x425b17
Capabilities:
Print debug messages

Disassembly:
mov byte [ebp - 0x10], 0
seto al
bswap edx
lea eax, [ebp - 0x36]
pop edx
movsx dx, al
mov edx, dword [ebp - 4]
lea esp, [esp + 0x3c]
jg 0x41f17d
call fcn.0040c228
pushal
mov byte [ebp - 0xd], al
pushfd
cmp byte [ebp - 0xd], 0
push 0x7e768c9f
lea esp, [esp + 0x28]
jne 0x421f39
push eax
call fcn.0042736e

Function at 0x425b58
Capabilities:
Print debug messages

Disassembly:
mov byte [esp + 0x10], 0xb3
lea esp, [esp + 0x40]
call sub.ntdll.dll_wcscat
pushal
clc
pushfd
add esp, 0x2c
pushfd
pushal
push 0xffbbe377
pushfd
lea esp, [esp + 0x2c]
jmp fcn.004206e4

Function at 0x425e2e
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 0x24], 0x1f01ff
lea eax, [edx - 0xee8833]
setnp ah
lea eax, [esp + 0x5c]
jmp 0x4217e6
pushfd
mov dword [esp + 0x28], eax
pushfd
pop eax
lahf
jmp 0x41fe09
push 0x4527486c
mov dword [esp + 0x24], eax
lahf
movsx eax, bl
not ah
movsx ax, dl
lea eax, [esp + 0x58]
mov word [esp + 8], 0xe239
pushfd
jmp 0x424512

Function at 0x426251
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x2c]
call sub.ntdll.dll_NtCreateFile
call fcn.00423ff6
jmp 0x41ef04
pushal
call fcn.0041fb8a
pushal
lea esp, [esp + 0x20]
call fcn.004080b8
pushal
jmp 0x426edf
mov dword [esp + 0x1c], eax
pushfd
mov dword [esp + 0x1c], ebx
pushal
call fcn.00425b58
mov dword [esp + 0x28], eax
pushfd
jmp 0x4256bc
Function at 0x42631d
Capabilities:
Print debug messages

Disassembly:
test di, 0xe7ff
add esp, 0xc
pushfd
lea esp, [esp + 0x3c]
call sub.ntdll.dll_DbgPrint
jmp 0x42609d

Function at 0x42651e
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 4]
je 0x41014e
test cl, 0xbd
test cl, bl
bt cx, 3
call fcn.0041fd98

Function at 0x426537
Capabilities:
Print debug messages

Disassembly:
cwde
push ebx
lea edx, [eax*8 - 0x2d7b7700]
pushfd
mov edx, edi
lahf
movsx eax, cl
mov eax, esi
pushfd
pushal
lea esp, [esp + 0x2c]
call fcn.0040cb10
pushfd
mov byte [esp], al
pushfd
lea esp, [esp + 8]
jmp 0x4260a5
pushfd
lea esp, [esp + 4]
call fcn.0040cb10
push 0x723bfe20
lea esp, [esp + 4]
jmp 0x4260a5
bt ebx, 7
call fcn.004276b5
test ebp, ebp
mov byte [esp + 8], 0xf0
jmp 0x426674
mov byte [esp], bh
lea esp, [esp + 0x28]
je 0x4276c8
das
clc
stc
bsf ax, bp
mov eax, dword [esp + 0x10]
mov dh, ch
test si, 0xf49b
bsr dx, cx
cmp al, ch
add dword [ebx + 0xc], eax
lea edx, [eax*2 - 0x6ecd4a6e]
xchg edx, eax
movzx eax, al
je 0x41d714
mov edx, edi
setge al
movzx ax, al
mov eax, esi
jmp 0x427006
push dword [esp]
mov dword [esp + 0x20], eax
pushfd
push dword [esp + 4]
lea esp, [esp + 0x28]
call sub.ntdll.dll_NtClose
jmp loc.00411376
jmp 0x421d9a
movsx ax, cl
mov eax, esi
pushal
pushal
lea esp, [esp + 0x40]
call fcn.00408b30
pushal
mov eax, dword [esp + 0x2c]
jmp 0x426ebb

Function at 0x426958
Capabilities:
Print debug messages

Disassembly:
mov dword [esp + 4], eax
pushal
call fcn.00411354

Function at 0x426b8c
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x2c]
je 0x421f39
push 0xad503205
push 0x47f68b77
pushal
mov dword [esp + 0x24], 0x411684
pushfd
push 0xa81943e6
call fcn.00424b6e

Function at 0x426ccf
Capabilities:
Print debug messages

Disassembly:
call fcn.0040c228
bt ax, sp
clc
cmc
test eax, 0x3d53e81f
mov byte [ebp - 0xd], al
test eax, esi
bt bp, 3
pushfd
cmp byte [ebp - 0xd], 0
call fcn.0041d89f
push edi
xchg edx, eax
mov byte [esp], bl
lea esp, [esp + 0x48]
call fcn.004087e0
cwde
mov dh, ah
xchg dx, ax
lea eax, [ebp - 0x36]
movsx dx, al
mov edx, dword [ebp - 4]
jmp 0x4223b7

Function at 0x42714d
Capabilities:
Print debug messages
Read file on windows

Disassembly:
push dword [esp]
lea esp, [esp + 0x48]
call sub.ntdll.dll_NtReadFile
pushfd
pushfd
cmp eax, 0x103
mov byte [esp + 4], 0x61
lea esp, [esp + 8]
jne 0x40808c
bswap ax
movsx eax, bl
seta al
not ah
push 0
movsx eax, cl
push 0x673864bc
mov dword [esp], 0
lea eax, [eax*8 + 0x52011292]
mov eax, dword [esp + 0x20]
pushal
jmp loc.0041aa76

Function at 0x42719c
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x40]
call sub.ntdll.dll_DbgPrint
add ch, cl
aas
add esp, 0xc
not cx
cwde
movzx cx, al
mov dword [ebp - 8], 1
not al
xchg dx, ax
bswap cx
lahf
lea ecx, [ebp - 8]
movsx dx, al
call fcn.004266e9
pushfd
mov dword [esp + 0x10], ebx
pushal
push 0xd2484460
push ebp
push dword [esp]
mov dword [esp + 0x38], 0x4117a0
mov word [esp], cx
push dword [esp]
push ebx
jmp 0x41e3ca
Function at 0x42736e
Capabilities:
Print debug messages

Disassembly:
bt sp, 1
pushal
test byte [ebp - 3], 0x80
mov word [esp], sp
lea esp, [esp + 0x28]
je 0x421f39
pushal
lea esp, [esp + 0x20]
je 0x41a4ed
pushfd
push 0xd593f45f
mov dword [esp + 4], 0x411684
push 0xcc9c952a
lea esp, [esp + 8]
call sub.ntdll.dll_DbgPrint
neg ch
mov cx, bx
push 0xfa002be3
or cl, cl
mov ecx, dword [esp + 4]
test cl, 0xfc
and dword [ebp - 4], 0xffff7fff
push 0xf852a861
test ch, 0xf
stc
call fcn.00426927

Function at 0x4274df
Capabilities:
Print debug messages

Disassembly:
pushal
test byte [ebp - 3], 0x10
push esp
lea esp, [esp + 0x24]
je 0x42353b
pushfd
mov byte [esp], 0x6e
mov dword [esp], 0x4116e4
pushfd
push edi
mov word [esp + 4], bx
lea esp, [esp + 8]
call sub.ntdll.dll_DbgPrint
pushfd
lea esp, [esp + 4]
jmp fcn.0041ea1b
lea esp, [esp + 0xc]
jne 0x42353b
bt dx, si
cmp byte [ebp - 0x11], 0
pushal
lea esp, [esp + 0x20]
je 0x42353b
test dl, 0x37
stc
jmp 0x423a7e

Function at 0x427633
Capabilities:
Execute anti-debugging instructions

Disassembly:
jp 0x41e83b
add esp, 8
bswap dx
push 0xbc022965
xchg dh, ah
mov edx, 0x10
not ax
push dword [esp]
jmp 0x421137
rdtsc
rdtsc
lahf
btr dx, ax
add esp, 8
cdq
jmp 0x41fc74
movzx dx, al
mov edx, 0x10
lahf
mov al, 6
movsx eax, bl
seta al
mov eax, esi
call fcn.00424f0d
mov byte [esp + 4], al
lea esp, [esp + 0x28]
call sub.ntdll.dll_wcscat
jmp 0x41dce3
jmp 0x4209c3

Function at 0x42767b
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 0x38]
call fcn.0040bf9c
jmp fcn.0040c9ab

Function at 0x4276b5
Capabilities:
Check http status code
Execute anti-debugging instructions
Print debug messages
Write file on windows

Disassembly:
jmp 0x4224c5
mov ecx, 0x4000
jmp 0x4250a3
setle ah
movzx ax, al
mov edx, edi
cwde
pushfd
push dword [esp]
mov eax, esi
pushal
call fcn.0041f888
jmp 0x4278dd
stc
test ebp, ebp
lea esp, [esp + 4]
jno 0x42523b
jg 0x42015f
jg 0x42015f
call fcn.00425121

Function at 0x4277b6
Capabilities:
Print debug messages

Disassembly:
lea esp, [esp + 8]
call sub.ntdll.dll_DbgPrint
lea ecx, [ebp + 0x2d70e26b]
movzx ecx, al
movzx ecx, dl
pop ecx
push ebp
pushal
lea esp, [esp + 0x24]
jmp fcn.004114e6

Function at 0x427860
Capabilities:
Print debug messages

Disassembly:
call fcn.00426958
lea esp, [esp + 0xc]
call fcn.00408094
push edx
jmp 0x4210e3
Function at 0x4024e9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push 0x41fc08
call fcn.0040f95d
mov dword [esp], 0x41fc40
call fcn.0040f95d
mov eax, dword [ebp + 0x14]
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
pop ecx
mov dword [0x41fc6c], eax
jne 0x402520
xor eax, eax
jmp 0x4026a8
push esi
lea ecx, [ebp - 0x3c]
call fcn.00416445
lea ecx, [ebp - 0x3c]
call fcn.004164a6
mov esi, eax
cmp esi, ebx
je 0x40269d
push edi
lea ecx, [ebp - 0x30]
call fcn.004155e1
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x24], esi
call fcn.00401f28
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
call fcn.00415fe8
lea ecx, [ebp - 0x18]
call fcn.0041602a
test eax, eax
je 0x402681
lea ecx, [ebp - 0x18]
call fcn.004160e3
test eax, eax
je 0x402681
push ebx
push ebx
push ebx
mov ecx, 0x421e60
call fcn.004152b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x14], esi
je 0x402681
lea eax, [ebp - 0xfc]
lea ecx, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.004160e3
push eax
lea ecx, [ebp - 0x5c]
call fcn.004154a8
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 4]
lea ecx, [ebp - 0x18]
stosd dword es:[edi], eax
call fcn.004160e7
test eax, eax
je 0x40266b
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.MSVCRT.dll__beginthreadex]
push eax
lea eax, [ebp - 0x5c]
push ebx
push eax
push 0x40291f
push ebx
push ebx
call esi
add esp, 0x18
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push ebx
push eax
push 0x4028ae
push ebx
push ebx
call esi
add esp, 0x18
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 0xffffffffffffffff
push 1
push eax
push 2
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 8]
push dword [esi]
call edi
add esi, 4
dec ebx
jne 0x402640
lea ecx, [ebp - 0x18]
call fcn.00416176
push dword [ebp + 0x14]
call edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x50]
push 1
mov dword [ebp - 0x5c], 0x4178e0
mov dword [ecx], eax
pop ebx
jmp 0x402681
lea ecx, [ebp - 0x18]
call fcn.00416176
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5c], 0x4178e0
lea ecx, [ebp - 0x18]
call fcn.00416025
lea ecx, [ebp - 0xfc]
call fcn.00401f8c
lea ecx, [ebp - 0x30]
call fcn.00415617
pop edi
lea ecx, [ebp - 0x3c]
call fcn.00416472
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x4026c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push 0x41fc08
call fcn.0040f95d
mov dword [esp], 0x41fc40
call fcn.0040f95d
xor ebx, ebx
pop ecx
cmp dword [ebp + 0x10], ebx
jne 0x4026f7
xor eax, eax
jmp 0x402889
push esi
lea ecx, [ebp - 0x3c]
call fcn.00416445
lea ecx, [ebp - 0x3c]
call fcn.004164a6
mov esi, eax
cmp esi, ebx
je 0x40287e
push edi
lea ecx, [ebp - 0x30]
call fcn.004155e1
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x24], esi
call fcn.0040be44
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
call fcn.00415fe8
lea ecx, [ebp - 0x18]
call fcn.0041602a
test eax, eax
je 0x402858
lea ecx, [ebp - 0x18]
call fcn.004160e3
test eax, eax
je 0x402858
push ebx
push ebx
push ebx
mov ecx, 0x421e60
call fcn.004152b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 8], esi
je 0x402858
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.004160e3
push eax
lea ecx, [ebp - 0x5c]
call fcn.004154a8
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 4]
lea ecx, [ebp - 0x18]
stosd dword es:[edi], eax
call fcn.004160e7
test eax, eax
je 0x402842
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.MSVCRT.dll__beginthreadex]
push eax
lea eax, [ebp - 0x5c]
push ebx
push eax
push 0x40291f
push ebx
push ebx
call esi
add esp, 0x18
mov dword [ebp - 4], eax
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push ebx
push eax
push 0x40bb6a
push ebx
push ebx
call esi
add esp, 0x18
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 0xffffffffffffffff
push 1
push eax
push 2
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 8]
push dword [esi]
call edi
add esi, 4
dec ebx
jne 0x402817
lea ecx, [ebp - 0x18]
call fcn.00416176
push dword [ebp + 8]
call edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x50]
push 1
mov dword [ebp - 0x5c], 0x4178e0
mov dword [ecx], eax
pop ebx
jmp 0x402858
lea ecx, [ebp - 0x18]
call fcn.00416176
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5c], 0x4178e0
lea ecx, [ebp - 0x18]
call fcn.00416025
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x4178e4
call fcn.004156a9
lea ecx, [ebp - 0x30]
call fcn.00415617
pop edi
lea ecx, [ebp - 0x3c]
call fcn.00416472
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x4036d5
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
cmp byte [0x41fd58], 0
jne 0x4038cf
push ebx
push esi
mov ebx, 0x81
push edi
xor edx, edx
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x436]
mov word [ebp - 0x438], dx
mov word [ebp - 0x230], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x22e]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov byte [0x41fd58], 1
push eax
push 1
push edx
push str.SOFTWAREFeiTianInterPass3000_HXB
push 0x80000002
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4037a2
lea eax, [ebp - 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push str.InstallLanguageId
push dword [ebp - 8]
call edi
test eax, eax
jne 0x403780
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.MSVCRT.dll__wtol]
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x438]
push eax
push 0
push 0
push str.Path
push dword [ebp - 8]
call edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov edx, 0x404
cmp ecx, edx
je 0x4037da
mov eax, 0x804
cmp ecx, eax
je 0x4037dc
cmp ecx, 0xc04
je 0x4037da
cmp ecx, 0x1004
je 0x4037da
cmp ecx, 0x1404
mov eax, 0x409
jne 0x4037dc
mov eax, edx
push eax
call fcn.00412377
pop ecx
lea eax, [ebp - 1]
push eax
push str.langescertd
lea ecx, [ebp - 0x18]
call fcn.00401abd
lea eax, [ebp - 0x18]
push eax
call fcn.004123a8
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00403592
lea eax, [ebp - 1]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.00401abd
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x24]
je 0x403830
lea eax, [ebp - 0x28]
push eax
call fcn.00412366
pop ecx
jmp 0x4038bd
and word [ebp - 0x230], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x22e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x230]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x403886
lea ecx, [ebp + eax*2 - 0x230]
cmp word [ecx], 0x5c
je 0x40387d
dec eax
dec ecx
dec ecx
test eax, eax
jg 0x40386e
jmp 0x403886
and word [ebp + eax*2 - 0x230], 0
lea eax, [ebp - 0x230]
push str.lang
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 1]
lea ecx, [ebp - 0x18]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00401abd
lea eax, [ebp - 0x18]
push eax
call fcn.00412366
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00403592
cmp dword [ebp - 0x28], 0
pop edi
pop esi
pop ebx
je 0x4038cf
push dword [ebp - 0x28]
call sub.MFC42u.DLL_operatordelete
pop ecx
leave
ret