joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f785
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x44fd00]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42f7c8
cmp word [esi], dx
jne 0x42f7c8
or byte [edi + eax + 0x28], 4
jmp 0x42f7cd
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x42f920
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x42f900
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x42f80f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x42f845
cmp eax, edx
jae 0x42f851
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x42f7e7
jmp 0x42f920
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42f8fc
cmp dword [ebp - 0x14], 0
je 0x42f8fc
mov eax, dword [ebx*4 + 0x44fd00]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x42f8d4
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x42f89d
mov word [esi], cx
jmp 0x42f8d0
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x44fd00]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x44fd00]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x44fd00]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x42f920
pop ebx
cmp word [ebp - 4], bx
jne 0x42f8e5
cmp esi, dword [ebp + 0xc]
jne 0x42f8e5
mov word [esi], bx
jmp 0x42f91d
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004301b9
add esp, 0x10
cmp word [ebp - 4], bx
je 0x42f920
push 0xd
jmp 0x42f919
mov ecx, dword [ebx*4 + 0x44fd00]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42f917
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42f920
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4359b3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x435a50
push ebx
push esi
call fcn.0043597c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00434601
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4359fd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x435a4f
push edi
push eax
call fcn.00430e26
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x435a1d
call fcn.0042d180
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x435a4e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00434601
add esp, 0x20
test eax, eax
jne 0x435a3c
push edi
call fcn.0042d180
jmp 0x435a44
push ebx
call fcn.0042d180
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x43cf30
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0043ceac
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x43d0a8
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x43d0a8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x43d057
jg 0x43cf89
test eax, eax
je 0x43d04d
push 1
push 0x1000
call fcn.0042d1ba
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x43cfaf
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x43d044
push 0x8000
push ebx
call fcn.0042a531
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x43cfdb
jg 0x43cfd6
cmp ecx, 0x1000
jb 0x43cfdb
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0042ea1b
add esp, 0x10
cmp eax, 0xffffffff
je 0x43d020
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x43cfd6
jl 0x43d007
test ecx, ecx
jne 0x43cfc8
push dword [ebp - 0xc]
push ebx
call fcn.0042a531
push esi
call fcn.0042d180
add esp, 0xc
xor edi, edi
jmp 0x43d0b9
cmp byte [edi + 0x24], 0
je 0x43d037
cmp dword [edi + 0x20], 5
jne 0x43d037
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x43d042
mov edi, dword [edi + 0x18]
jmp 0x43d044
xor edi, edi
push esi
call fcn.0042d180
pop ecx
jmp 0x43d0b9
test ecx, ecx
jg 0x43d019
jl 0x43d057
test eax, eax
jae 0x43d019
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004301b9
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x43d07a
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x43d019
jmp 0x43d0b1
push ebx
call fcn.004361a5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x43d019
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x43d0b9
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x43d0b6
mov edi, dword [edi + 0x18]
jmp 0x43d0b9
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004301b9
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4032d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403331
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403314
cmp edi, 2
jb 0x403314
cmp byte [esi], cl
jne 0x403314
cmp byte [esi + 1], cl
jne 0x403314
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x440510]
jmp 0x4032e5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x440510]
test edi, edi
jne 0x4032e5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403360
cmp cl, 0x23
jne 0x403347
cmp byte [esi], cl
jne 0x403347
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x440510]
test cl, cl
jne 0x403338
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x403454
mov dword [ebx], 0
mov edx, 0x444780
call fcn.00403370
mov esi, eax
test esi, esi
je 0x403542
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403538
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403538
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x403538
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403538
mov eax, dword [0x448434]
test eax, eax
je 0x4034cc
inc dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x403538
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40351d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x448434]
add esp, 4
test eax, eax
je 0x40350a
dec dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x40352f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410a00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x448040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x448434]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x440510]
sub esi, 1
jne 0x410a40
mov eax, dword [0x448434]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x410a7a
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00421810
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.00421a10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e48b
mov esp, ebp
pop ebp
ret
Function at 0x4165b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x416632
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x4165ec
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00422480
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00403880
mov edx, dword [esi]
mov ecx, 0x448430
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00403880
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416a10
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x416a58
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x416a3f
cmp byte [esi], bl
jne 0x416a3f
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x440510]
test bl, bl
jne 0x416a30
mov ebx, dword [0x448434]
not eax
mov edi, dword [ebx + 0x5390]
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 4]
and esi, ecx
je 0x416a92
cmp dword [esi], eax
je 0x416aa1
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5388]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x416a73
mov ecx, dword [ebp - 4]
call fcn.00416930
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x416a92
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416ab0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x448434]
test bl, bl
je 0x416af6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x416ad7
cmp byte [esi], bl
jne 0x416ad7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x440510]
test bl, bl
jne 0x416ac8
mov edi, dword [0x448434]
mov esi, dword [edi + 0x537c]
xor ecx, ecx
not eax
test esi, esi
jle 0x416b1c
mov edi, dword [edi + 0x5384]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x416b22
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x416b10
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x42a730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42a76a
mov eax, dword [0x448434]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x42a75d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42a79b
mov eax, dword [0x448434]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x42a78e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42a7cc
mov eax, dword [0x448434]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x42a7bf
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x42a819
mov eax, dword [0x448434]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x42a80c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x42a84a
mov eax, dword [0x448434]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x42a83d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x42a87b
mov eax, dword [0x448434]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x42a86e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0042d050
Function at 0x43f19f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43f1de
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43f1de
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43f1de
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43f1de
cmp dword [ecx + 0x74], 0xe
jbe 0x43f1de
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x404564
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406bf0
test esi, esi
jne 0x40459c
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406d2c
jmp 0x4045ba
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404448
mov edi, eax
test esi, esi
je 0x4045ba
cmp dword [ebx], 0
je 0x4045ba
dec esi
jmp 0x4045a3
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x406190
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x44704c], 0
je 0x4061f1
cmp word [0x447328], 0xd7b2
jne 0x4061b9
cmp dword [0x447330], 0
jbe 0x4061b9
mov eax, 0x447324
call dword [0x447340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push 0x445794
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40621c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x445030], 0
jne 0x40620d
push 0
push 0x44578c
push 0x445794
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x408908
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408a6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406bf0
cmp si, word [0x4457d4]
jb 0x4089a2
cmp si, word [0x4459d4]
ja 0x4089a2
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x4089a2
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4457d4]
jae 0x40897c
mov edi, ebx
dec edi
jmp 0x40899d
cmp si, word [ebx*8 + 0x4457d4]
jbe 0x40898c
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x40899d
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4457d8]
call fcn.00408818
jmp 0x4089a2
cmp edi, dword [ebp - 0xc]
jae 0x408966
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408a51
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408a51
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406dd8
push dword [ebp - 0x164]
push 0x408a8c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406dd8
push dword [ebp - 0x168]
push 0x408a9c
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406dd8
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00407184
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408a76
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406be8
ret
Function at 0x408c28
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408d2d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x449b54
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x449b6c]
jne 0x408c74
mov eax, esi
mov edx, 0x449b70
mov ecx, 0x55
call fcn.00406dd8
push 0x449b54
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408d17
push 0x449b54
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406bf0
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408ce5
cmp byte [0x449b50], 0
je 0x408caa
mov edx, esi
mov eax, ebx
call fcn.00408b08
jmp 0x408ce5
mov edx, esi
mov eax, ebx
call fcn.00408908
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408ce5
cmp dword [esi], 0
je 0x408cce
mov eax, esi
mov edx, 0x408d48
call fcn.00406fe0
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408908
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406fe0
push 0x449b54
call sub.kernel32.dll_EnterCriticalSection
mov word [0x449b6c], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406c7c
push eax
push 0x449b70
call sub.kernel32.dll_lstrcpynW
push 0x449b54
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d34
lea eax, [ebp - 4]
call fcn.00406be0
ret
Function at 0x408f6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406bd8
xor eax, eax
push ebp
push 0x409151
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408fac
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x408fc6
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406c7c
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40913b
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409160
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409055
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409160
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409055
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409194
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409055
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4091c8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40913b
xor eax, eax
push ebp
push 0x409134
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408d70
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4090c4
mov eax, dword [ebp - 0x10]
call fcn.004041b0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406d9c
jmp 0x40910f
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x409208
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40910f
mov eax, dword [ebp - 0x10]
call fcn.004041b0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x409208
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40913b
cmp dword [ebp - 8], 0
je 0x40912a
mov eax, dword [ebp - 8]
call fcn.004041cc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409158
lea eax, [ebp - 4]
call fcn.00406be0
ret