joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474b28
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa8
mov dword [esp + 4], edx
mov dword [esp], eax
lea edi, [esp + 0xc]
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetSystemInfo
mov esi, dword [esp + 0x1c]
call sub.kernel32.dll_GetCurrentProcessId
mov ebp, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov eax, dword [edi]
shr eax, 0x10
shl eax, 0x10
mov dword [edi], eax
mov eax, ebx
shl eax, 0x10
sub dword [edi], eax
mov eax, dword [edi]
xor edx, edx
div esi
imul esi
mov dword [edi], eax
push 4
push 0x3000
push esi
mov eax, dword [edi]
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x474bbc
mov eax, dword [edi]
cmp eax, dword [esp + 0x10]
je 0x474bbc
push 0x8000
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_VirtualFree_1
inc ebx
jmp 0x474c58
cmp dword [esp + 0x10], 0
jne 0x474c61
push 0x1c
lea eax, [esp + 0x40]
push eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_VirtualQuery_1
cmp dword [esp + 0x48], 0x118
jb 0x474c53
mov eax, dword [esp + 0x50]
and eax, 4
cmp eax, 4
jne 0x474c53
mov eax, ebp
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
push edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [esp + 4]
jne 0x474c0e
cmp eax, dword [esp]
pop edx
pop eax
jne 0x474c53
mov eax, ebp
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
push edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 0x114]
mov eax, dword [eax + 0x110]
cmp edx, dword [esp + 4]
jne 0x474c3b
cmp eax, dword [esp]
pop edx
pop eax
jne 0x474c53
mov eax, dword [edi]
add eax, 8
mov edx, dword [esp]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004030c0
je 0x474c61
inc ebx
xor eax, eax
mov dword [edi], eax
cmp ebx, 0x14
jle 0x474b61
xor eax, eax
mov dword [esp + 8], eax
cmp dword [esp + 0x10], 0
je 0x474cdf
mov eax, dword [edi]
cmp eax, dword [esp + 0x10]
jne 0x474d05
mov eax, ebp
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
mov ecx, dword [edi]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [edi]
add eax, 8
mov edx, dword [esp]
call fcn.00403014
mov eax, ebp
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
mov ecx, dword [edi]
mov dword [ecx + 0x110], eax
mov dword [ecx + 0x114], edx
mov eax, dword [edi]
mov dword [eax + 0x108], 1
mov eax, dword [edi]
add eax, 0x118
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov dword [eax], 1
jmp 0x474d05
cmp dword [edi], 0
je 0x474d05
mov eax, dword [edi]
inc dword [eax + 0x108]
mov eax, dword [edi]
add eax, 0x118
mov dword [esp + 8], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x108]
mov edx, dword [esp + 4]
mov dword [edx], eax
mov eax, dword [esp + 8]
add esp, 0x58
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47b090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x18], 0
je 0x47b0a4
mov eax, esi
call fcn.0047b140
mov eax, dword [esi + 4]
mov dword [esi + 0x18], eax
test bl, bl
je 0x47b0c6
mov eax, dword [esi + 4]
cmp word [eax], 0x25ff
jne 0x47b0c6
add dword [esi + 0x18], 2
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0x18]
sub eax, 5
mov byte [esi + 0xc], 0xe9
mov edx, eax
and dl, 0xff
mov byte [esi + 0xd], dl
mov edx, eax
shr edx, 8
and dl, 0xff
mov byte [esi + 0xe], dl
mov edx, eax
shr edx, 0x10
and dl, 0xff
mov byte [esi + 0xf], dl
shr eax, 0x18
and al, 0xff
mov byte [esi + 0x10], al
mov eax, dword [esi + 0x18]
mov al, byte [eax]
mov byte [esi + 0x11], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 1]
mov byte [esi + 0x12], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 2]
mov byte [esi + 0x13], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 3]
mov byte [esi + 0x14], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 4]
mov byte [esi + 0x15], al
push esp
push 0x40
push 5
mov eax, dword [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47b13c
call fcn.0040d788
pop edx
pop esi
pop ebx
ret

Function at 0x47bd54
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47bdfb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040498c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x47bde5
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404b18
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040498c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47bde5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x47be0c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47bde5
cmp dword [ebp - 8], 0x34
jne 0x47bde5
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47be02
lea eax, [ebp - 0x10]
call fcn.004044cc
ret
Function at 0x47c03c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c1a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403130
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x48a310], eax
mov eax, dword [ebp - 0xc]
mov dword [0x48a314], eax
mov eax, dword [ebp - 0x24]
mov dword [0x48a318], eax
mov eax, dword [0x48abf0]
cmp dword [eax], 2
sete byte [0x48a280]
push 0x47c1b0
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.0047bd24
cmp byte [0x48a280], 0
jne 0x47c0c8
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0047bd54
test al, al
je 0x47c0c8
mov eax, dword [ebp - 0x4c]
mov dword [0x48c3ac], eax
jmp 0x47c0cf
xor eax, eax
mov dword [0x48c3ac], eax
call fcn.0047bed8
and eax, 0x7f
cmp eax, 0xb
ja case.0x47c0e0.0
jmp dword [eax*4 + 0x47c0e7]
mov byte [0x48a26c], 1
jmp case.0x47c0e0.0
mov byte [0x48a270], 1
jmp case.0x47c0e0.0
mov byte [0x48a274], 1
jmp case.0x47c0e0.0
mov byte [0x48a278], 1
jmp case.0x47c0e0.0
mov byte [0x48a27c], 1
jmp case.0x47c0e0.0
mov byte [0x48a284], 1
mov byte [0x48a288], 1
jmp case.0x47c0e0.0
mov byte [0x48a284], 1
mov byte [0x48a28c], 1
jmp case.0x47c0e0.0
mov byte [0x48a284], 1
mov byte [0x48a290], 1
jmp case.0x47c0e0.0
mov byte [0x48a294], 1
jmp case.0x47c0e0.0
mov byte [0x48a298], 1
jmp case.0x47c0e0.0
mov byte [0x48a29c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c1ac
lea eax, [ebp - 4]
call fcn.004044cc
ret

Function at 0x47c41c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
call fcn.0047c414
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47c501
lea eax, [ebp - 8]
push eax
push 0x40
push 6
mov eax, dword [0x48c3c0]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x47c497
xor eax, eax
push ebp
push 0x47c490
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x48c3c0
mov eax, 0x48c3cc
mov ecx, 5
call fcn.00402c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c497
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 6
mov eax, dword [0x48c3c0]
push eax
call sub.kernel32.dll_VirtualProtect
ret
lea eax, [ebp - 8]
push eax
push 0x40
push 6
mov eax, dword [0x48c3c4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x47c4fa
xor eax, eax
push ebp
push 0x47c4f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x48c3c4
mov eax, 0x48c3d4
mov ecx, 5
call fcn.00402c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c4fa
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 6
mov eax, dword [0x48c3c4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov byte [0x48c3c8], 0
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x480e4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x4202c8]
call fcn.0042606c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48101f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
cmp dword [eax + 8], 0
jle 0x480ffe
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00427498
mov eax, dword [ebp - 8]
call fcn.0042663c
mov eax, dword [eax + 0x14]
mov edx, esi
call fcn.00421a64
cmp byte [ebp + 8], 0
je 0x480ee6
xor edx, edx
mov eax, ebx
call fcn.0047fdd4
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.0047fdd4
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
mov eax, ebx
call fcn.0047fd04
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x480f22
xor edx, edx
mov eax, ebx
call fcn.0047fdd4
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, ebx
call fcn.0047fd04
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.0047fdd4
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004168f8
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.0042663c
pop edx
call fcn.00421e08
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.0047fd04
dec eax
test eax, eax
jl 0x480fd6
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0047fca8
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, esi
mov eax, ebx
call fcn.0047fe00
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x20]
imul esi
xor edx, edx
mov dl, byte [ebp + 8]
imul edx
push eax
mov edx, esi
mov eax, ebx
call fcn.0047fe00
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
imul esi
mov dl, byte [ebp + 8]
xor dl, 1
and edx, 0x7f
imul edx
xor ecx, ecx
pop edx
call fcn.004168d0
mov eax, dword [ebp - 8]
call fcn.0042663c
mov edx, eax
lea ecx, [ebp - 0x20]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
inc esi
dec dword [ebp - 0x10]
jne 0x480f6c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047fca8
cmp byte [ebp + 0xc], 0
je 0x480ffe
movzx eax, word [ebx + 0x58]
mov edx, 0x10
call fcn.0042861c
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0047f498
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481026
mov eax, dword [ebp - 8]
call fcn.00403720
ret
Function at 0x404578
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406ddc
test esi, esi
jne 0x4045b0
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406f18
jmp 0x4045ce
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044bc
mov edi, eax
test esi, esi
je 0x4045ce
cmp dword [ebx], 0
je 0x4045ce
dec esi
jmp 0x4045b7
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x406294
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4b3050], 0
je 0x4062f5
cmp word [0x4b332c], 0xd7b2
jne 0x4062bd
cmp dword [0x4b3334], 0
jbe 0x4062bd
mov eax, 0x4b3328
call dword [0x4b3344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406320
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b0030], 0
jne 0x406311
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4b0038], 0
je 0x4064a6
mov edx, esi
mov eax, ebx
call dword [0x4b0038]
jmp 0x4064b5
mov eax, 8
call fcn.00404204
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4b3051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x406448
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408bfc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408d63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406ddc
cmp si, word [0x4b07e0]
jb 0x408c96
cmp si, word [0x4b09e0]
ja 0x408c96
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408c96
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4b07e0]
jae 0x408c70
mov edi, ebx
dec edi
jmp 0x408c91
cmp si, word [ebx*8 + 0x4b07e0]
jbe 0x408c80
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408c91
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4b07e4]
call fcn.00408b0c
jmp 0x408c96
cmp edi, dword [ebp - 0xc]
jae 0x408c5a
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408d45
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408d45
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406fc4
push dword [ebp - 0x164]
push 0x408d80
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406fc4
push dword [ebp - 0x168]
push 0x408d90
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406fc4
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.0040737c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d6a
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406dd4
ret
Function at 0x408f1c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409021
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b5b58
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4b5b70]
jne 0x408f68
mov eax, esi
mov edx, 0x4b5b74
mov ecx, 0x55
call fcn.00406fc4
push 0x4b5b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40900b
push 0x4b5b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406ddc
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408fd9
cmp byte [0x4b5b54], 0
je 0x408f9e
mov edx, esi
mov eax, ebx
call fcn.00408dfc
jmp 0x408fd9
mov edx, esi
mov eax, ebx
call fcn.00408bfc
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408fd9
cmp dword [esi], 0
je 0x408fc2
mov eax, esi
mov edx, 0x40903c
call fcn.004071d8
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408bfc
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004071d8
push 0x4b5b58
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4b5b70], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406e68
push eax
push 0x4b5b74
call sub.kernel32.dll_lstrcpynW
push 0x4b5b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409028
lea eax, [ebp - 4]
call fcn.00406dcc
ret
Function at 0x409260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406dc4
xor eax, eax
push ebp
push 0x409445
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x4092a0
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x4092ba
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406e68
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40942f
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409454
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409349
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409454
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409349
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409488
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x409349
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4094bc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40942f
xor eax, eax
push ebp
push 0x409428
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00409064
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4093b8
mov eax, dword [ebp - 0x10]
call fcn.00404204
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406f88
jmp 0x409403
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x4094fc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409403
mov eax, dword [ebp - 0x10]
call fcn.00404204
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x4094fc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406f88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40942f
cmp dword [ebp - 8], 0
je 0x40941e
mov eax, dword [ebp - 8]
call fcn.00404220
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40944c
lea eax, [ebp - 4]
call fcn.00406dcc
ret
Function at 0x409710
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.00406dc4
mov eax, dword [ebp - 0x21c]
call fcn.00406dc4
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x4098af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406ddc
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.00406e68
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x4097b0
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x4097c2
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x4097ad
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x40987b
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x4097eb
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00409260
cmp dword [ebp - 0x220], 0
je 0x409823
push ebp
mov eax, dword [ebp - 0x220]
call fcn.00409604
pop ecx
mov ebx, eax
jmp 0x40987b
push ebp
call sub.kernel32.dll_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.00408f1c
mov eax, dword [ebp - 0x224]
call fcn.00409604
pop ecx
mov ebx, eax
test bl, bl
jne 0x40986e
cmp byte [0x4b5b54], 0
jne 0x40986e
push ebp
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.00408f1c
mov eax, dword [ebp - 0x228]
call fcn.00409604
pop ecx
mov ebx, eax
test bl, bl
jne 0x40987b
push ebp
call fcn.004096b4
pop ecx
mov ebx, eax
test bl, bl
je 0x409891
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406fc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4098b6
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.00406dd4
ret

Function at 0x40a028
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret