joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63d7e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x63d80c
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x63d815
call fcn.0063c4cc
mov eax, 0xa
call fcn.005a4e80
call fcn.0063c4cc
call fcn.0063d7ac
test al, al
jne 0x63d7ea
pop ebx
ret

Function at 0x63dd38
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x653224]
cmp dword [eax], 0
je 0x63dde3
mov eax, dword [0x653224]
mov eax, dword [eax]
call fcn.004f9368
test al, al
je 0x63dde3
mov eax, dword [0x653224]
mov eax, dword [eax]
cmp byte [eax + 0x215], 0
je 0x63dd8d
cmp byte [ebx + 0x3e1], 0
jne 0x63dd8d
mov eax, dword [0x653758]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x63dd91
xor eax, eax
jmp 0x63dd93
mov al, 1
mov ebx, eax
mov eax, dword [0x653224]
mov eax, dword [eax]
call fcn.004f8f94
push 0xfffffffffffffff0
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x63dde3
test bl, bl
je 0x63ddcf
push 5
mov eax, dword [0x653224]
mov eax, dword [eax]
call fcn.004f8f94
push eax
call sub.user32.dll_ShowWindow
jmp 0x63dde3
push 0
mov eax, dword [0x653224]
mov eax, dword [eax]
call fcn.004f8f94
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x63de94
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd4
mov byte [0x65b0b6], 0
push 0x63e020
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
push 0x63e03c
push ebx
call fcn.00412174
mov esi, eax
test esi, esi
je 0x63df3c
lea eax, [esp + 2]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x63df3c
cmp word [esp], 0
je 0x63df3c
mov byte [0x65b0b6], 1
movzx eax, word [esp + 2]
sub ax, 0x14c
je 0x63df00
sub ax, 0xb4
je 0x63df0c
sub ax, 0x8464
je 0x63df18
sub ax, 0x2400
je 0x63df24
jmp 0x63df30
mov byte [0x653071], 1
jmp 0x63dfd8
mov byte [0x653071], 3
jmp 0x63dfd8
mov byte [0x653071], 2
jmp 0x63dfd8
mov byte [0x653071], 4
jmp 0x63dfd8
mov byte [0x653071], 0
jmp 0x63dfd8
push 0x63e05c
push ebx
call fcn.00412174
test eax, eax
je 0x63df84
lea edx, [esp + 8]
push edx
call eax
push 0x63e084
push ebx
call fcn.00412174
mov esi, eax
test esi, esi
je 0x63df8e
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x63df8e
cmp dword [esp + 4], 0
je 0x63df8e
mov byte [0x65b0b6], 1
jmp 0x63df8e
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [esp + 8]
sub ax, 1
jb 0x63dfad
sub ax, 5
je 0x63dfb6
sub ax, 3
je 0x63dfbf
sub ax, 3
je 0x63dfc8
jmp 0x63dfd1
mov byte [0x653071], 1
jmp 0x63dfd8
mov byte [0x653071], 3
jmp 0x63dfd8
mov byte [0x653071], 2
jmp 0x63dfd8
mov byte [0x653071], 4
jmp 0x63dfd8
mov byte [0x653071], 0
cmp byte [0x65b0b6], 0
je 0x63e019
call fcn.005e97e0
test al, al
je 0x63e012
push 0x63e0a4
push ebx
call fcn.00412174
test eax, eax
je 0x63e012
push 0x63e0d8
push 0x63e0f8
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00412174
test eax, eax
jne 0x63e019
mov byte [0x65b0b6], 0
add esp, 0x2c
pop esi
pop ebx
ret

Function at 0x63e114
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x63e184
mov edx, 0x80000002
xor eax, eax
call fcn.005a3f04
test eax, eax
jne 0x63e17d
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x63e1d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x63e174
cmp dword [ebp - 0xc], 4
jne 0x63e174
cmp dword [ebp - 8], 4
jne 0x63e174
movzx eax, word [ebp - 0x10]
mov word [0x65b0cc], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
Function at 0x63e380
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x63e42f
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x65b0c8], eax
cmp byte [0x65b0b5], 0
je 0x63e42f
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x63e420
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x63e42f
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x65b0cc], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x65b0ce], al
movzx eax, word [esp + 0x22c]
mov word [0x65b0d0], ax
jmp 0x63e42f
cmp eax, 4
jne 0x63e42f
call fcn.0063e114
call fcn.0063e1f0
add esp, 0x230
ret

Function at 0x63f3b0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63f458
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x63f474
push ebx
push 0x63f484
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00409a9c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405ce4
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x63f436
mov eax, dword [0x65376c]
mov eax, dword [eax + 0x1c0]
call fcn.0063f308
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63f45f
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x63fdcc
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x63ffba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005a3ad4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.005eac14
test al, al
jne 0x63fe39
xor eax, eax
push ebp
push 0x63fe2f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.005eb10c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x63fe39
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
mov eax, dword [0x65b1a8]
call fcn.004097c0
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x63fe68
mov eax, dword [0x65376c]
mov eax, dword [eax + 0x1bc]
call fcn.0063f308
push 0x80
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x657634]
push eax
push 0
mov ecx, 0x63ffc8
mov edx, 0x63ffcc
xor eax, eax
call fcn.00412e84
mov dword [ebp - 8], eax
push 0x63f4c8
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x65b1d4], eax
xor eax, eax
push ebp
push 0x63ff83
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x653758]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.005a34a0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x63ffe8
call fcn.00421ba4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.005a3380
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.004099bc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0063f3b0
mov dword [ebp - 0xc], eax
call fcn.0063f48c
test al, al
jne 0x63ff63
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x63ff41
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63ff8a
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x64132c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6415e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x653758]
mov eax, dword [eax]
mov edx, 0x6415fc
call fcn.00595d5c
push 5
mov eax, dword [0x653758]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x6415a7
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00638410
lea eax, [ebp - 0x10]
call fcn.005a394c
mov eax, dword [ebp - 0x10]
call fcn.004216cc
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.005a34a0
mov edx, dword [ebp - 0x14]
mov eax, 0x65b1a8
call fcn.00408aec
call fcn.0063f698
lea ecx, [ebp - 0x18]
mov edx, 0x64161c
mov eax, dword [0x65b1a8]
call fcn.005a2560
mov edx, dword [ebp - 0x18]
mov eax, 0x65b1ac
call fcn.00408aec
lea ecx, [ebp - 0x1c]
mov edx, 0x641634
mov eax, dword [0x65b1a8]
call fcn.005a2560
mov edx, dword [ebp - 0x1c]
mov eax, 0x65b1b0
call fcn.00408aec
push 2
push 0
push 1
mov ecx, dword [0x65b1a8]
mov dl, 1
mov eax, dword [0x5a90a0]
call fcn.005a99fc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x641484
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.005a99bc
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.005a9994
cmp dword [ebp - 0xc], 0x67734d49
je 0x64145f
mov cl, 1
xor edx, edx
mov eax, dword [0x65b1b0]
call fcn.005ab0f8
jmp 0x64146e
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x65b1a8]
call fcn.005ab0f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64148b
mov eax, dword [ebp - 4]
call fcn.004069c8
ret
Function at 0x641778
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6418b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x6418d0
mov edx, ebx
call fcn.00409a14
mov eax, dword [ebp - 0x25c]
call fcn.004097c0
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x64188f
xor eax, eax
push ebp
push 0x641888
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6418ec
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0042184c
test eax, eax
jne 0x641859
test byte [ebp - 0x258], 0x10
jne 0x641859
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00409864
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409a14
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x641851
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004210cc
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x6417e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64188f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6418bc
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.0040876c
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x6418f8
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6419f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.0040870c
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005a29f8
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x641a10
call fcn.00421ba4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00409a14
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x641996
test esi, 0x10
jne 0x6419c6
test esi, 1
je 0x641996
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
mov eax, dword [ebp - 0xc]
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x6419c0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00408aec
jmp 0x6419d3
inc edi
cmp edi, 0xa
je 0x6419d3
inc ebx
cmp ebx, 0x3e8
jne 0x641937
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6419fd
lea eax, [ebp - 0x14]
call fcn.0040870c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040876c
ret
Function at 0x404874
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407458
test esi, esi
jne 0x4048aa
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004075b0
jmp 0x4048c8
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004047b8
mov edi, eax
test esi, esi
je 0x4048c8
cmp dword [ebx], 0
je 0x4048c8
dec esi
jmp 0x4048b1
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x40618c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040664c
mov byte [esp], al
cmp byte [esp], 0
jne 0x406315
test edi, edi
je 0x406315
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406255
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x406230
cmp edi, 0xffffffff
je 0x4061f1
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4061f1
mov byte [esp], 0
jmp 0x406315
cmp dword [esi], 1
jg 0x406230
cmp dword [esi], 0
jne 0x406222
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x406222
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x406315
lea eax, [esp + 0xc]
call fcn.00405e48
dec ebp
test ebp, ebp
jg 0x4061d6
cmp edi, 0xffffffff
je 0x406255
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x406253
mov byte [esp], 0
jmp 0x406315
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40619a
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406255
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00406390
mov edx, eax
mov ebx, dword [0x4228f4]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4062b9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4062b7
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4062b9
xor edi, edi
cmp byte [esp], 0
je 0x4062df
mov ebx, dword [esi]
test bl, 1
jne 0x4062f5
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4062bf
mov byte [esp + 1], 1
jmp 0x4062f5
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4062df
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x40626c
cmp byte [esp], 0
je 0x406315
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4071d4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x422054], 0
je 0x40723b
cmp word [0x422340], 0xd7b2
jne 0x4071fd
cmp dword [0x422348], 0
jbe 0x4071fd
mov eax, 0x42233c
call dword [0x422358]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x407268
call fcn.00407a14
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x420022], 0
jne 0x407257
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x409388
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4094ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00407458
cmp si, word [0x4209f0]
jb 0x409420
cmp si, word [0x420bf0]
ja 0x409420
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x409420
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4209f0]
jae 0x4093fa
mov edi, ebx
dec edi
jmp 0x40941b
cmp si, word [ebx*8 + 0x4209f0]
jbe 0x40940a
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40941b
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4209f4]
call fcn.004092a8
jmp 0x409420
cmp edi, dword [ebp - 8]
jae 0x4093e4
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4094cf
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4094cf
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407ba4
push dword [ebp - 0x160]
push 0x409508
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00407ba4
push dword [ebp - 0x164]
push 0x409518
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00407ba4
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00407d5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094f4
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004074b8
ret
Function at 0x4096a0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4097a4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x424c0c
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x424c24]
jne 0x4096ec
mov eax, esi
mov edx, 0x424c26
mov ecx, 0x55
call fcn.00407ba4
push 0x424c0c
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40978e
push 0x424c0c
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00407458
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40975b
cmp byte [0x424c08], 0
je 0x409720
mov edx, esi
mov eax, ebx
call fcn.00409584
jmp 0x40975b
mov edx, esi
mov eax, ebx
call fcn.00409388
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40975b
cmp dword [esi], 0
je 0x409744
mov eax, esi
mov edx, 0x4097bc
call fcn.00407c7c
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00409388
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00407c7c
push 0x424c0c
call sub.kernel32.dll_EnterCriticalSection
mov word [0x424c24], bx
mov eax, dword [esi]
call fcn.00407b14
mov ecx, eax
mov eax, 0x424c26
mov edx, 0xaa
call fcn.00409208
push 0x424c0c
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4097ab
lea eax, [ebp - 4]
call fcn.00407458
ret
Function at 0x4099d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040753c
xor eax, eax
push ebp
push 0x409bf9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x409a14
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x409a2e
mov eax, dword [ebp - 4]
call fcn.00407b14
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00409208
cmp word [ebp - 0x21a], 0
je 0x409be3
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409c08
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409afd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409c08
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409afd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409c44
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409afd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409c44
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409afd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409c78
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409afd
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409cac
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x409be3
xor eax, eax
push ebp
push 0x409bdc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.004097e4
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409b6c
mov eax, dword [ebp - 0x10]
call fcn.00404514
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407b68
jmp 0x409bb7
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x409cec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409bb7
mov eax, dword [ebp - 0x10]
call fcn.00404514
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x409cec
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407b68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409be3
cmp dword [ebp - 8], 0
je 0x409bd2
mov eax, dword [ebp - 8]
call fcn.00404530
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409c00
lea eax, [ebp - 4]
call fcn.00407458
ret