joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4687b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x468816
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x468816
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4687f7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x468860
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 1
call sub.WS2_32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x468a80
Capabilities:
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
push edi
call fcn.004688a0
mov esi, eax
call fcn.00469440
push 6
push 1
push 2
mov dword [esi + 8], eax
call sub.WS2_32.dll_socket
mov ecx, dword [esp + 0x1c]
mov edi, eax
xor eax, eax
mov dword [esi], edi
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
call sub.WS2_32.dll_htons
lea edx, [esp + 8]
push 0x10
push edx
push edi
mov word [esp + 0x16], ax
call sub.WS2_32.dll_bind
test eax, eax
jge 0x468ae8
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
push 1
push edi
call sub.WS2_32.dll_listen
xor ecx, ecx
pop edi
test eax, eax
setl cl
dec ecx
and ecx, esi
pop esi
mov eax, ecx
add esp, 0x10
ret

Function at 0x468b40
Capabilities:
Get socket status

Disassembly:
sub esp, 0x120
mov ecx, dword [esp + 0x128]
push esi
push edi
mov edi, dword [esp + 0x12c]
test ecx, ecx
mov esi, dword [edi]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], esi
jne 0x468b72
push ecx
push ecx
lea eax, [esp + 0x2c]
push ecx
push eax
jmp 0x468bc6
cmp ecx, 0xffffffff
jne 0x468b89
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
jmp 0x468bb8
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 8], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 0xc], edx
lea eax, [esp + 8]
lea ecx, [esp + 0x24]
push eax
push 0
push 0
push ecx
inc esi
push esi
call sub.WS2_32.dll_select
test eax, eax
jge 0x468bdd
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x120
ret
mov eax, dword [edi]
lea edx, [esp + 0x24]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x468c32
push 8
mov dword [esp + 0x14], 0x10
call fcn.0046d57e
mov esi, eax
add esp, 4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
mov dword [esi + 4], 0
mov eax, dword [edi]
push ecx
push edx
push eax
call sub.WS2_32.dll_accept
push esi
push edi
mov dword [esi], eax
call fcn.004688e0
add esp, 8
mov eax, esi
pop edi
pop esi
add esp, 0x120
ret
pop edi
xor eax, eax
pop esi
add esp, 0x120
ret
Function at 0x468c40
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x468c73
push ecx
push ecx
push ecx
lea eax, [esp + 0x18]
lea ecx, [esi + 1]
push eax
push ecx
jmp 0x468ccb
cmp ecx, 0xffffffff
jne 0x468c8a
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x468cb9
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push 0
lea edx, [esi + 1]
push ecx
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x468cdf
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x468d17
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x120]
push 0
push ecx
push edx
push esi
call sub.WS2_32.dll_recv
test eax, eax
jg 0x468d1c
mov eax, 0xfffffffc
pop esi
add esp, 0x10c
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret

Function at 0x468d30
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x468d63
push ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
lea ecx, [esi + 1]
push ecx
jmp 0x468dbb
cmp ecx, 0xffffffff
jne 0x468d7a
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x468da9
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x468dcf
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x468dfe
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x120]
push 0
push ecx
push edx
push esi
call sub.WS2_32.dll_send
pop esi
add esp, 0x10c
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret

Function at 0x469000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
call fcn.00469440
push 6
push 1
push 2
mov dword [0x4ec39c], eax
call sub.WS2_32.dll_socket
mov ecx, dword [esp + 0x18]
mov esi, eax
xor eax, eax
push ecx
mov dword [esp + 8], eax
mov word [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_inet_addr
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], eax
push edx
call sub.WS2_32.dll_htons
mov word [esp + 6], ax
lea eax, [esp + 4]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
xor ecx, ecx
test eax, eax
setl cl
dec ecx
and ecx, esi
pop esi
mov eax, ecx
add esp, 0x10
ret
Function at 0x4692d0
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x10
push esi
call fcn.00469440
push 0
push 2
push 2
mov dword [0x4ec3a0], eax
call sub.WS2_32.dll_socket
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov word [esp + 4], 2
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_htonl
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], eax
push ecx
call sub.WS2_32.dll_htons
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call sub.WS2_32.dll_bind
xor ecx, ecx
test eax, eax
setl cl
dec ecx
and ecx, esi
pop esi
mov eax, ecx
add esp, 0x10
ret

Function at 0x469340
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
mov ecx, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x118]
mov dword [esp + 0xc], 0x10
test ecx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 1
jne 0x46937b
push ecx
push ecx
push ecx
lea eax, [esp + 0x1c]
lea ecx, [esi + 1]
push eax
push ecx
jmp 0x4693d3
cmp ecx, 0xffffffff
jne 0x469392
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x4693c1
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0x10]
push eax
push 0
push 0
lea edx, [esi + 1]
push ecx
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x4693e7
or eax, 0xffffffff
pop esi
add esp, 0x110
ret
lea eax, [esp + 0x10]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x46942c
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x128]
push edx
push 0
push eax
push ecx
push esi
call sub.WS2_32.dll_recvfrom
test eax, eax
jg 0x469431
mov eax, 0xfffffffc
pop esi
add esp, 0x110
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x110
ret
Function at 0x469460
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x469493
push ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
lea ecx, [esi + 1]
push ecx
jmp 0x4694eb
cmp ecx, 0xffffffff
jne 0x4694aa
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x4694d9
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x4694ff
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x469538
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x120]
push 0x10
push ecx
push 0
push edx
push eax
push esi
call sub.WS2_32.dll_sendto
pop esi
add esp, 0x10c
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret

Function at 0x4695c0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
lea eax, [esp + 4]
push esi
push 0x100
push eax
call sub.WS2_32.dll_gethostname
test eax, eax
jge 0x4695e4
xor eax, eax
pop esi
add esp, 0x104
ret
lea ecx, [esp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
jne 0x469600
pop esi
add esp, 0x104
ret
push ebx
push ebp
mov ebp, dword [esp + 0x114]
push edi
xor ebx, ebx
jmp 0x469612
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0xc]
cmp dword [edx + ebx*4], 0
je 0x469661
push 0x100
call fcn.0046d57e
mov dword [ebp + ebx*4], eax
mov eax, dword [esi + 0xc]
add esp, 4
mov ecx, dword [eax + ebx*4]
mov edx, dword [ecx]
push edx
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + ebx*4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0xa
rep movsb byte es:[edi], byte [esi]
jl 0x46960e
pop edi
mov eax, ebx
pop ebp
pop ebx
pop esi
add esp, 0x104
ret

Function at 0x4696f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push edx
mov dword [esp + 0xc], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x469726
mov eax, dword [esp + 6]
push eax
call sub.WS2_32.dll_ntohs
and eax, 0xffff
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret

Function at 0x477474
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bd984]
jne 0x47747e
repz ret
jmp fcn.0047e423
Function at 0x47d575
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bd984]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047286b
and dword [ebp - 0x14], 0
cmp dword [0x4eee1c], 0
mov dword [ebp - 0x18], eax
jne 0x47d628
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x47d6d0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x47d6d0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4a5750
push ebx
mov dword [0x4eee1c], eax
call edi
push eax
call esi
push 0x4a573c
push ebx
mov dword [0x4eee20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4eee24], eax
call edi
push eax
call esi
mov dword [0x4eee2c], eax
test eax, eax
je 0x47d628
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4eee28], eax
mov eax, dword [0x4eee28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x47d681
cmp dword [0x4eee2c], ecx
je 0x47d681
push eax
call esi
push dword [0x4eee2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x47d681
test ebx, ebx
je 0x47d681
call edi
test eax, eax
je 0x47d678
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x47d678
test byte [ebp - 8], 1
jne 0x47d681
or dword [ebp + 0x10], 0x200000
jmp 0x47d6b4
mov eax, dword [0x4eee20]
cmp eax, dword [ebp - 0x18]
je 0x47d6b4
push eax
call esi
test eax, eax
je 0x47d6b4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x47d6b4
mov eax, dword [0x4eee24]
cmp eax, dword [ebp - 0x18]
je 0x47d6b4
push eax
call esi
test eax, eax
je 0x47d6b4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4eee1c]
call esi
test eax, eax
je 0x47d6d0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x47d6d2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00477474
leave
ret

Function at 0x485d2c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x485d64
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00483de0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00483db8
jmp 0x485d70
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x48741e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x487460
call fcn.0048d0de
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x487460
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x487457
xor eax, eax
jmp 0x487468
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048746e
pop edi
pop esi
pop ebx
ret 4
Function at 0x404548
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406880
test esi, esi
jne 0x404580
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004069bc
jmp 0x40459e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040448c
mov edi, eax
test esi, esi
je 0x40459e
cmp dword [ebx], 0
je 0x40459e
dec esi
jmp 0x404587
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405dc8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50f050], 0
je 0x405e29
cmp word [0x50f32c], 0xd7b2
jne 0x405df1
cmp dword [0x50f334], 0
jbe 0x405df1
mov eax, 0x50f328
call dword [0x50f344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405e54
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x508030], 0
jne 0x405e45
push 0
push 0x508794
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405fd4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x508034], 0
je 0x405ffa
mov edx, esi
mov eax, ebx
call dword [0x508034]
jmp 0x406009
mov eax, 8
call fcn.004041d4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x50f051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405f9c
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4086b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40881b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406880
cmp si, word [0x5087dc]
jb 0x40874e
cmp si, word [0x5089dc]
ja 0x40874e
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x40874e
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x5087dc]
jae 0x408728
mov edi, ebx
dec edi
jmp 0x408749
cmp si, word [ebx*8 + 0x5087dc]
jbe 0x408738
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408749
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x5087e0]
call fcn.004085c4
jmp 0x40874e
cmp edi, dword [ebp - 0xc]
jae 0x408712
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4087fd
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4087fd
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a68
push dword [ebp - 0x164]
push 0x408838
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406a68
push dword [ebp - 0x168]
push 0x408848
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a68
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406e20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408822
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406878
ret
Function at 0x4089d4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408ad9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x511b58
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x511b70]
jne 0x408a20
mov eax, esi
mov edx, 0x511b74
mov ecx, 0x55
call fcn.00406a68
push 0x511b58
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408ac3
push 0x511b58
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406880
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408a91
cmp byte [0x511b54], 0
je 0x408a56
mov edx, esi
mov eax, ebx
call fcn.004088b4
jmp 0x408a91
mov edx, esi
mov eax, ebx
call fcn.004086b4
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408a91
cmp dword [esi], 0
je 0x408a7a
mov eax, esi
mov edx, 0x408af4
call fcn.00406c7c
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004086b4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406c7c
push 0x511b58
call sub.kernel32.dll_EnterCriticalSection
mov word [0x511b70], bx
push 0xaa
mov eax, dword [esi]
call fcn.0040690c
push eax
push 0x511b74
call sub.kernel32.dll_lstrcpynW
push 0x511b58
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ae0
lea eax, [ebp - 4]
call fcn.00406870
ret
Function at 0x408d18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406868
xor eax, eax
push ebp
push 0x408efd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408d58
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x408d72
push 0x105
mov eax, dword [ebp - 4]
call fcn.0040690c
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x408ee7
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408f0c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408e01
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408f0c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408e01
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408f40
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408e01
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408f74
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x408ee7
xor eax, eax
push ebp
push 0x408ee0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408b1c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408e70
mov eax, dword [ebp - 0x10]
call fcn.004041d4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406a2c
jmp 0x408ebb
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x408fb4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408ebb
mov eax, dword [ebp - 0x10]
call fcn.004041d4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x408fb4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ee7
cmp dword [ebp - 8], 0
je 0x408ed6
mov eax, dword [ebp - 8]
call fcn.004041f0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f04
lea eax, [ebp - 4]
call fcn.00406870
ret