joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x42c304]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x48]
push ecx
push 0x20019
mov dword [ebp - 0x50], eax
xor eax, eax
push eax
push str.SOFTWAREJavaSoftJava_Runtime_Environment
push 0x80000002
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
mov byte [ebp - 0x44], al
mov dword [ebp - 0x43], eax
mov dword [ebp - 0x3f], eax
mov dword [ebp - 0x3b], eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov byte [ebp - 0x27], al
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401754
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c2f6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x48]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x4c]
push edx
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x401744
push esi
xor esi, esi
push edi
cmp dword [ebp - 0x4c], esi
jbe 0x4017c8
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea esp, [esp]
mov edx, dword [ebp - 0x48]
push 0x1e
lea ecx, [ebp - 0x44]
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x4017fb
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jns 0x4017c2
xor eax, eax
mov cl, byte [ebp + eax - 0x44]
mov byte [ebp + eax - 0x24], cl
inc eax
test cl, cl
jne 0x4017b5
inc esi
cmp esi, dword [ebp - 0x4c]
jb 0x401790
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x24]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4017d2
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c2f6
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0040c2f6
mov esp, ebp
pop ebp
ret
Function at 0x401b90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x44
lea eax, [ebp - 0x58]
push 0
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040f480
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x58]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push str.__x_4A03706F_666A_4037_7777_5F2748764D10__qn
push eax
mov dword [ebp - 0x58], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401c02
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
Function at 0x402cc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424531
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push edi
mov eax, dword [0x42c304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
lea eax, [esi + 0x5d]
push eax
push 0x104
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 1
jl 0x402d2e
cmp eax, 0x104
jle 0x402d3f
lea eax, [esi + 0x5d]
push 0x4281c4
push eax
call fcn.0040cd62
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0x58], ebx
call fcn.00402ef0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00401da0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 6
call fcn.00401da0
mov edi, 0x10
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], edi
jb 0x402d95
mov edx, dword [ebp - 0x28]
push edx
call fcn.0040c923
add esp, 4
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00401da0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [esi + 4]
mov byte [ebp - 4], 7
call fcn.00401da0
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], edi
jb 0x402dd9
mov edx, dword [ebp - 0x28]
push edx
call fcn.0040c923
add esp, 4
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00401da0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 8
call fcn.00401da0
cmp dword [ebp - 0x14], edi
jb 0x402e19
mov edx, dword [ebp - 0x28]
push edx
call fcn.0040c923
add esp, 4
cmp dword [ebp + 0x20], edi
jb 0x402e2a
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040c923
add esp, 4
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
cmp dword [ebp + 0x3c], edi
jb 0x402e48
mov ecx, dword [ebp + 0x28]
push ecx
call fcn.0040c923
add esp, 4
mov dword [ebp + 0x3c], 0xf
mov dword [ebp + 0x38], ebx
mov byte [ebp + 0x28], bl
cmp dword [ebp + 0x58], edi
jb 0x402e66
mov edx, dword [ebp + 0x44]
push edx
call fcn.0040c923
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x58
Function at 0x406550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423f68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42c304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x406671
cmp byte [edi + 0x49], bl
je 0x406671
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x406665
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x4065c5
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x4065dd
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x406606
dec eax
je 0x40660a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x406660
jmp 0x40666c
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x40661a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x406643
cmp ebx, 0x10
jae 0x406629
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0040dbdd
add esp, 0x10
cmp esi, eax
jne 0x40665d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x406669
test esi, esi
jne 0x4065d1
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00405ab0
jmp 0x4065cb
lea ecx, [ebp - 0x2c]
call fcn.00401d70
xor al, al
jmp 0x406673
lea ecx, [ebp - 0x2c]
call fcn.00401d70
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c2f6
mov esp, ebp
pop ebp
ret
Function at 0x407760
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423ccb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x42c304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0041e8e0
push 4
mov dword [ebp - 4], 0
call fcn.0040cce2
mov edi, eax
add esp, 4
test edi, edi
je 0x4077e0
call fcn.0041e371
mov dword [edi], eax
call fcn.0041e130
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0041e065
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4077d6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0041e08d
jmp 0x4077e2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aef0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424867
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42c304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x428b4c
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov dword [ebx + edx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx]
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.00402ba0
lea esi, [ebx + 0x10]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.00408310
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x40af87
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.00402a60
mov dword [ebp - 4], 2
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov ecx, esi
mov dword [ebx + edx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00407760
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x42eb10]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b120
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424597
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42c304]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x428728
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.00402ba0
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.00408310
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x40b1b1
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.00402a60
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.00407760
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x42eb10]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c2f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c304]
jne 0x40c300
repz ret
jmp fcn.0040e9ce
Function at 0x4189fd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c304]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f899
and dword [ebp - 0x14], 0
cmp dword [0x42e824], 0
mov dword [ebp - 0x18], eax
jne 0x418ab0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x418b58
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x418b58
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42e824], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42e828], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42e82c], eax
call edi
push eax
call esi
mov dword [0x42e834], eax
test eax, eax
je 0x418ab0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42e830], eax
mov eax, dword [0x42e830]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418b09
cmp dword [0x42e834], ecx
je 0x418b09
push eax
call esi
push dword [0x42e834]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418b09
test ebx, ebx
je 0x418b09
call edi
test eax, eax
je 0x418b00
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x418b00
test byte [ebp - 8], 1
jne 0x418b09
or dword [ebp + 0x10], 0x200000
jmp 0x418b3c
mov eax, dword [0x42e828]
cmp eax, dword [ebp - 0x18]
je 0x418b3c
push eax
call esi
test eax, eax
je 0x418b3c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x418b3c
mov eax, dword [0x42e82c]
cmp eax, dword [ebp - 0x18]
je 0x418b3c
push eax
call esi
test eax, eax
je 0x418b3c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42e824]
call esi
test eax, eax
je 0x418b58
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x418b5a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c2f6
leave
ret
Function at 0x4047a3
Capabilities:
Identify system language via api

Disassembly:
push ebp
push ebx
call fcn.0048f160
call fcn.004053b0
push 0x5a
call fcn.0048773d
push eax
mov eax, 0x54903e
push eax
push 0
push 0x59
call fcn.0046f370
push 0x17
call fcn.0048773d
push eax
mov eax, 0x54903e
push eax
push 1
push 0x59
call fcn.0046f370
push 8
call fcn.0048773d
push eax
mov eax, 0x54903e
push eax
push 2
push 0x59
call fcn.0046f370
call sub.KERNEL32.dll_GetUserDefaultLangID
mov ebx, eax
and ebx, 0x3ff
push ebx
mov ebx, 4
cmp ebx, dword [esp]
je 0x40483b
mov ebx, 4
cmp ebx, dword [esp]
je 0x40483b
mov ebx, 0x7c04
cmp ebx, dword [esp]
jne 0x40487d
mov ebp, dword [0x636ba8]
mov edx, 0x55deae
lea ecx, [ebp]
call fcn.00445008
mov eax, 0x55deae
push eax
call fcn.0040d28c
push 2
push 0x59
call fcn.0046f3d5
mov eax, 0x55deae
push eax
push 0x59
call fcn.0046f40d
jmp 0x404903
mov ebx, 9
cmp ebx, dword [esp]
jne 0x4048c6
mov ebp, dword [0x636ba8]
mov edx, str.English
lea ecx, [ebp]
call fcn.00445008
mov eax, str.English
push eax
call fcn.0040d28c
push 1
push 0x59
call fcn.0046f3d5
mov eax, str.English
push eax
push 0x59
call fcn.0046f40d
jmp 0x404903
mov ebp, dword [0x636ba8]
mov edx, 0x54a6f8
lea ecx, [ebp]
call fcn.00445008
mov eax, 0x54a6f8
push eax
call fcn.0040d28c
push 0
push 0x59
call fcn.0046f3d5
mov eax, 0x54a6f8
push eax
push 0x59
call fcn.0046f40d
pop eax
call fcn.00404915
call fcn.0042d688
jmp 0x404909
Function at 0x40590c
Capabilities:
Delete registry value

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0048f160
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.00445000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.00445000
mov dword [esp + 0xc], 0x20006
cmp dword [esp + 0x2c], 0
je 0x405950
mov ebx, dword [esp + 0xc]
or ebx, 0x100
mov dword [esp + 0xc], ebx
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048c8a0
call fcn.0048f1c0
mov edx, 0x54bb9e
call fcn.00445330
mov ecx, eax
call fcn.00445340
je 0x4059b6
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048c910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048c940
lea eax, [esp + 4]
push eax
call fcn.0048f090
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048c940
call fcn.0048f1c0
mov edx, 0x54bb9e
call fcn.00445330
mov ecx, eax
call fcn.00445340
je 0x405a1c
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048c910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048c8a0
lea eax, [esp + 4]
push eax
call fcn.0048f090
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x405a37
push 0x56387c
push 0x24
push dword [esp + 0x38]
call fcn.0048deb0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 0
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x405aa2
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x405a8e
push dword [esp + 8]
mov ebp, dword [esp + 0x34]
pop dword [ebp + 8]
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406cce
mov ebp, dword [esp + 0x34]
lea eax, [ebp + 0xc]
push eax
call fcn.0048f090
cmp dword [esp + 0x10], 0
je 0x405a9e
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
jmp 0x405b01
push dword [esp + 4]
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegDeleteValueW
mov dword [esp + 8], eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x405af8
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x405af4
push dword [esp + 8]
mov ebp, dword [esp + 0x34]
pop dword [ebp + 8]
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406cce
mov ebp, dword [esp + 0x34]
lea eax, [ebp + 0xc]
push eax
call fcn.0048f090
xor eax, eax
jmp 0x405b01
mov eax, 1
jmp 0x405b01
push dword [esp]
call fcn.0048f1f0
push dword [esp + 4]
call fcn.0048f1f0
add esp, 0x14
pop ebx
pop ebp
ret 0x14
Function at 0x40c81e
Capabilities:
Identify system language via api

Disassembly:
push ebp
push ebx
call fcn.0048f160
call fcn.004098be
push 0x34
push 0
call fcn.0041e491
push 0xffffffec
push 0x32
call fcn.004722ad
push eax
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
or ebx, 0x20
push ebx
push 0xffffffec
push 0x32
call fcn.004722ad
push eax
call sub.USER32.dll_SetWindowLongW
push 0x5a
call fcn.0048773d
push eax
mov eax, 0x54903e
push eax
push 0
push 5
call fcn.0046f370
push 0x17
call fcn.0048773d
push eax
mov eax, 0x54903e
push eax
push 1
push 5
call fcn.0046f370
push 8
call fcn.0048773d
push eax
mov eax, 0x54903e
push eax
push 2
push 5
call fcn.0046f370
mov ebp, dword [0x636bc8]
mov ebx, dword [ebp + 0x1c]
cmp ebx, 1
jne 0x40c980
call sub.KERNEL32.dll_GetUserDefaultLangID
mov ebx, eax
and ebx, 0x3ff
push ebx
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40c91f
mov eax, 0x55deae
push eax
call fcn.0040d28c
push 2
push 5
call fcn.0046f3d5
mov eax, 0x55deae
push eax
push 5
call fcn.0046f40d
jmp 0x40c97f
mov ebx, 9
cmp ebx, dword [esp]
jne 0x40c955
mov eax, str.English
push eax
call fcn.0040d28c
push 1
push 5
call fcn.0046f3d5
mov eax, str.English
push eax
push 5
call fcn.0046f40d
jmp 0x40c97f
mov eax, 0x54a6f8
push eax
call fcn.0040d28c
push 0
push 5
call fcn.0046f3d5
mov eax, 0x54a6f8
push eax
push 5
call fcn.0046f40d
pop eax
mov ebp, dword [0x636bc8]
mov ebx, dword [ebp + 0x1c]
xor ebx, 1
and ebx, ebx
je 0x40ca3e
mov ebp, dword [0x636ba8]
push dword [ebp]
mov edx, 0x55deae
mov ecx, dword [esp]
call fcn.00445340
je 0x40c9d8
mov eax, 0x55deae
push eax
call fcn.0040d28c
push 2
push 5
call fcn.0046f3d5
mov eax, 0x55deae
push eax
push 5
call fcn.0046f40d
jmp 0x40ca3d
mov edx, str.English
mov ecx, dword [esp]
call fcn.00445340
je 0x40ca13
mov eax, str.English
push eax
call fcn.0040d28c
push 1
push 5
call fcn.0046f3d5
mov eax, str.English
push eax
push 5
call fcn.0046f40d
jmp 0x40ca3d
mov eax, 0x54a6f8
push eax
call fcn.0040d28c
push 0
push 5
call fcn.0046f3d5
mov eax, 0x54a6f8
push eax
push 5
call fcn.0046f40d
pop eax
call fcn.0040abf7
call fcn.00407407
call fcn.0043f794
mov ebp, dword [0x636bc8]
mov ebx, dword [ebp + 0x1c]
cmp ebx, 1
jne 0x40ca62
call fcn.0042d688
jmp 0x40ca5b
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x41e762
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
push eax
call fcn.0048f160
push dword [esp + 0x14]
call fcn.00445320
lea eax, [esp]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call sub.SHELL32.dll_SHGetKnownFolderPath
cmp dword [esp], 0
je 0x41e7bb
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048e140
lea eax, [esp + 8]
push eax
call fcn.0048f090
push dword [esp]
call sub.ole32.dll_CoTaskMemFree
mov edx, dword [esp + 4]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
pop eax
push eax
call fcn.004452f0
pop edx
add eax, edx
jmp 0x41e7e3
push dword [esp + 4]
call fcn.0048f1f0
add esp, 8
ret 8