joyce8/EMBER2024-capa huggingface dataset:
Function at 0x80a74a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x855f44]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.007fc1ec
and dword [ebp - 0x14], 0
cmp dword [0x8722d8], 0
mov dword [ebp - 0x18], eax
jne 0x80a7fd
push 0x85d338
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x80a8a5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x859798
push ebx
call edi
test eax, eax
je 0x80a8a5
mov esi, dword [0x857390]
push eax
call esi
push 0x85d328
push ebx
mov dword [0x8722d8], eax
call edi
push eax
call esi
push 0x85d314
push ebx
mov dword [0x8722dc], eax
call edi
push eax
call esi
push 0x85d2f8
push ebx
mov dword [0x8722e0], eax
call edi
push eax
call esi
mov dword [0x8722e8], eax
test eax, eax
je 0x80a7fd
push 0x85d2e0
push ebx
call edi
push eax
call esi
mov dword [0x8722e4], eax
mov eax, dword [0x8722e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x857394]
cmp eax, ecx
je 0x80a856
cmp dword [0x8722e8], ecx
je 0x80a856
push eax
call esi
push dword [0x8722e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x80a856
test ebx, ebx
je 0x80a856
call edi
test eax, eax
je 0x80a84d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x80a84d
test byte [ebp - 8], 1
jne 0x80a856
or dword [ebp + 0x10], 0x200000
jmp 0x80a889
mov eax, dword [0x8722dc]
cmp eax, dword [ebp - 0x18]
je 0x80a889
push eax
call esi
test eax, eax
je 0x80a889
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x80a889
mov eax, dword [0x8722e0]
cmp eax, dword [ebp - 0x18]
je 0x80a889
push eax
call esi
test eax, eax
je 0x80a889
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x8722d8]
call esi
test eax, eax
je 0x80a8a5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x80a8a7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007f243e
leave
ret
Function at 0x817c98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x817d1d
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.007f2850
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x817ce0
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x817d02
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x817d78
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.008179e8
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x817d64
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x817d78
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x817ca1
pop esi
pop ebx
leave
ret
Function at 0x47808b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0
mov ecx, dword [esp + 0x18]
je 0x47809e
lea edx, [esp + 0xf4]
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov ebx, dword [ebp + 0x18]
mov edx, eax
or edx, ebx
shr edx, 4
and edx, 1
mov dword [esp + 0x44], edx
movzx edx, word [ecx + 0xc]
shr eax, 0x12
shr edx, 3
and eax, 1
and edx, 1
mov dword [esp + 0x3c], eax
movzx eax, word [ecx + 0x1a]
mov dword [esp + 0x34], edx
movzx edx, word [ecx + 0x1c]
imul edx, eax
movzx eax, word [ecx + 0x18]
add edx, edi
add eax, edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xb4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xb8], eax
add eax, dword [ebp + 0x10]
mov dword [esp + 0xd8], edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 8]
shr eax, 5
and eax, 1
mov dword [esp + 0xa0], eax
mov edx, dword [ecx + 8]
shr edx, 0x19
and edx, 1
mov dword [esp + 0x9c], edx
mov eax, ebx
shr eax, 7
and eax, 1
mov edx, ebx
shr edx, 8
and edx, 1
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], edx
mov eax, ebx
mov edx, ebx
shr eax, 0xa
shr edx, 0x1c

Function at 0x47814e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and eax, 1
and edx, 1
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], edx
test ebx, 0x8000000
je 0x478171
mov eax, 2
jmp 0x478179
mov eax, ebx
shr eax, 0xf
and eax, 1
mov edi, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x88], eax
add eax, 0x340
xor edx, edx
mov dword [esp + 0x8c], eax
mov eax, ebx

Function at 0x478196
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and eax, 0x1800000
mov dword [esp + 0xcc], edi
add byte [ecx + 0xac2494], cl
add byte [eax], al
mov dword [esp + 0xec], edx
mov dword [esp + 0xe4], edx
Function at 0x478594
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [esp + 0xb8]
mov ecx, dword [esp + 0xc]
push edx
lea edx, [esp + 0x78]
call fcn.00478d40
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
add esp, 4
test eax, eax
jne 0x4785f6
jmp 0x4785ed

Function at 0x4786b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx ecx, byte [eax]
mov dh, 8
inc eax
cmp ecx, edx
je 0x4786e3
cmp ecx, dword [esp + 0x50]
je 0x4786e3
cmp eax, edi
jb 0x4786b0
xor edi, edi
jmp 0x478845
dec eax
cmp eax, edi
jae 0x4786c2
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0xf0]
mov ecx, dword [esp + 0xb4]
push 0
push 0
push 0
push edx
lea eax, [esp + 0x68]
push eax
push 2
push 0
push esi
push ecx
push esi
mov dword [esp + 0xe8], esi
mov dword [esp + 0xf0], esi
mov dword [esp + 0x80], 0
call fcn.00474190
add esp, 0x28
cmp dword [esp + 0xac], 0
mov edi, eax
je 0x47874c
cmp dword [esp + 0x28], 0
jne 0x47874c
mov edx, dword [esp + 0xc8]
mov dword [esp + 0x28], edx
test edi, edi
jg 0x478838
je 0x478779
lea eax, [edi + 0x3e6]
cmp eax, 4
ja 0x478838
jmp dword [eax*4 + 0x475574]
lea ebx, [esi + 1]
mov eax, dword [esp + 0x70]
xor edi, edi
cmp dword [esp + 0x3c], edi
je 0x4787e3
cmp edi, 1
je 0x4788aa
cmp edi, 0xfffffc19
je 0x4788aa
cmp dword [esp + 0x30], 0
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 0x1c]
je 0x4788f6
mov ebx, dword [esp + 0x64]
cmp esi, 4
jl 0x4788d8
lea ecx, [esi*4 - 8]
push ecx
lea edx, [ebx + 8]
push edx
lea eax, [edi + 8]
push eax
call fcn.0047e860
add esp, 0xc
cmp dword [esp + 0xd0], esi
jle 0x4788ec
mov dword [esp + 0x90], 1
push ebx
call dword [0x49d2d4]
add esp, 4
cmp dword [esp + 0x90], 0
je 0x478904
xor eax, eax
jmp 0x478910
mov eax, dword [esp + 0xd0]
cdq
sub eax, edx
sar eax, 1
cmp esi, 2
jge 0x478919
xor eax, eax
jmp 0x478937
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xc0]
sub edx, ecx
mov dword [edi], edx
mov edx, dword [esp + 0xc4]
sub edx, ecx
mov dword [edi + 4], edx
Function at 0x478e74
Capabilities:
Read file on windows

Disassembly:
jle 0x478e81
movsx ebx, byte [edx + edi]
add dword [ecx], ebx
inc edx
cmp edx, eax
jl 0x478e76
push 2
push 0xfffffffffffffff8
push dword [esi]
call fcn.0047e6b8
push dword [esi]
lea edi, [esi + 4]
push 1
pop ebx
push ebx
push 4
push edi
call fcn.0047e611
push dword [esi]
call fcn.0047e362
push dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push ebx
push 4
push eax
call fcn.0047e611
push 0
push 0
push dword [esi]
call fcn.0047e6b8
and dword [ebp + 0xc], 0
add esp, 0x3c
cmp dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
jle 0x478f00
mov ecx, dword [esi]
test byte [ecx + 0xc], 0x10
jne 0x478f00
push ecx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0047e611
add esp, 0x10
lea ecx, [ebp - 0x540]
push dword [ebp - 0x14]
call fcn.004794bd
inc dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
jl 0x478ed0
xor eax, 0xaaaaaaaa
cmp dword [ebp - 0x10], eax
jne 0x478f41
push 0
push dword [edi]
push dword [esi]
call fcn.0047e6b8
push dword [esi]
lea eax, [ebp - 0x34]
push ebx
push 0x10
push eax
call fcn.0047e611
add esp, 0x1c
test eax, eax
je 0x478f41
xor eax, eax
mov cl, byte [ebp + eax - 0x34]
cmp cl, byte [ebp + eax - 0x24]
jne 0x478f3c
inc eax
cmp eax, 0x10
jl 0x478f2c
cmp eax, 0x10
je 0x478f45
push 3
jmp 0x478f5d
push dword [esi]
lea eax, [ebp - 1]
push ebx
push ebx
push eax
call fcn.0047e611
add esp, 0x10
cmp byte [ebp - 1], 3
je 0x478f6a
push 4
pop edi
push dword [esi]
call fcn.0047da0b
pop ecx
mov eax, edi
jmp 0x478fcd
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0047e611
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xfac1
lea ebx, [esi + 0xc]
push edi
push 1
push ebx
call fcn.0047e611
add esp, 0x20
lea eax, [edi + 0xc3d2]
mov ecx, esi
push eax
push edi
push ebx
call fcn.00478fe2
and byte [edi + esi + 0xc], 0
lea eax, [esi + 0x110]
xor ecx, ecx
cmp edi, ecx
mov dword [eax], ecx
jle 0x478fc0
movsx edx, byte [ebx + ecx]
add dword [eax], edx
inc ecx
cmp ecx, edi
jl 0x478fb5
push dword [esi]
call fcn.0047e362
mov dword [esi + 8], eax
pop ecx
xor eax, eax
Function at 0x4792f2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
mov byte [ebp - 1], bl
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push ebx
push eax
call fcn.0047e611
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push 0x16fa
push 4
push eax
call fcn.00478fe2
and byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push 0x49c018
push eax
call fcn.0047e7d0
pop ecx
test eax, eax
pop ecx
jne 0x479423
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0047e611
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29bc
lea eax, [ebp - 0x11c]
push edi
push ebx
push eax
call fcn.0047e611
add esp, 0x20
lea eax, [edi + 0xa25e]
mov ecx, esi
push eax
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.00478fe2
push dword [esi]
and byte [ebp + edi - 0x11c], 0
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0047e611
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29ac
push edi
push ebx
push dword [ebp + 0xc]
call fcn.0047e611
add esp, 0x20
lea eax, [edi + 0xf25e]
mov ecx, esi
push eax
push edi
push dword [ebp + 0xc]
call fcn.00478fe2
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
and byte [edi + eax], 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0047e7d0
pop ecx
test eax, eax
pop ecx
je 0x47943a
push ebx
push ebx
push dword [esi]
call fcn.0047e6b8
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.0047e611
xor dword [ebp - 8], 0x45aa
push ebx
push 4
push dword [esi]
call fcn.0047e6b8
push ebx
push 0x10
push dword [esi]
call fcn.0047e6b8
push ebx
push dword [ebp - 8]
push dword [esi]
call fcn.0047e6b8
add esp, 0x40
jmp 0x479427
and byte [ebp - 1], 0
cmp byte [ebp - 1], bl
je 0x479306
push 6
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x479433

Function at 0x47947e
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x4794a7
add edx, edx
xor edx, 0x4c11db7
jmp 0x4794a9
shl edx, 1
dec ecx
jne 0x479495
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x47948d
pop edi
pop esi
ret

Function at 0x479631
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x479656
mov eax, dword [esi + 0xc]
push 8
add eax, dword [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0047e860
add esp, 0xc
jmp 0x479669
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.0047e611
add esp, 0x10
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
add dword [esi + 0xc], 8
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
and byte [ebp - 4], 0
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 8]
push 0x49c020
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call fcn.0047e7d0
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop esi
leave
ret 4
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x408940
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edi
push eax
mov eax, dword [esp]
add esp, 4
call fcn.00408964
and eax, ecx
add eax, eax
xor dword [esi], edi
inc esi
and ecx, ecx
dec ecx
cmp esi, edx
jne fcn.00408940
ret
Function at 0x40457c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.004069d0
test esi, esi
jne 0x4045b4
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406b0c
jmp 0x4045d2
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044c0
mov edi, eax
test esi, esi
je 0x4045d2
cmp dword [ebx], 0
je 0x4045d2
dec esi
jmp 0x4045bb
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404604
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x49c008], 0x8088405
inc edx
mov dword [ebx + 0x49c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x405f94
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49f054], 0
je 0x405ff5
cmp word [0x49f330], 0xd7b2
jne 0x405fbd
cmp dword [0x49f338], 0
jbe 0x405fbd
mov eax, 0x49f32c
call dword [0x49f348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406020
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x49c030], 0
jne 0x406011
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x49c034], 0
je 0x4061a6
mov edx, esi
mov eax, ebx
call dword [0x49c034]
jmp 0x4061b5
mov eax, 8
call fcn.00404208
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x49f055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x406148
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x408848
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4089af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004069d0
cmp si, word [0x49c7dc]
jb 0x4088e2
cmp si, word [0x49c9dc]
ja 0x4088e2
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x4088e2
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x49c7dc]
jae 0x4088bc
mov edi, ebx
dec edi
jmp 0x4088dd
cmp si, word [ebx*8 + 0x49c7dc]
jbe 0x4088cc
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x4088dd
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x49c7e0]
call fcn.00408758
jmp 0x4088e2
cmp edi, dword [ebp - 0xc]
jae 0x4088a6
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408991
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408991
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406bb8
push dword [ebp - 0x164]
push 0x4089cc
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406bb8
push dword [ebp - 0x168]
push 0x4089dc
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406bb8
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4089b6
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004069c8
ret
Function at 0x408b68
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408c6d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a1b5c
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4a1b74]
jne 0x408bb4
mov eax, esi
mov edx, 0x4a1b78
mov ecx, 0x55
call fcn.00406bb8
push 0x4a1b5c
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408c57
push 0x4a1b5c
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.004069d0
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408c25
cmp byte [0x4a1b58], 0
je 0x408bea
mov edx, esi
mov eax, ebx
call fcn.00408a48
jmp 0x408c25
mov edx, esi
mov eax, ebx
call fcn.00408848
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408c25
cmp dword [esi], 0
je 0x408c0e
mov eax, esi
mov edx, 0x408c88
call fcn.00406dcc
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408848
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406dcc
push 0x4a1b5c
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4a1b74], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406a5c
push eax
push 0x4a1b78
call sub.kernel32.dll_lstrcpynW
push 0x4a1b5c
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408c74
lea eax, [ebp - 4]
call fcn.004069c0
ret
Function at 0x408eac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069b8
xor eax, eax
push ebp
push 0x409091
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408eec
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x408f06
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406a5c
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40907b
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4090a0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408f95
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4090a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408f95
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4090d4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408f95
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409108
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40907b
xor eax, eax
push ebp
push 0x409074
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408cb0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409004
mov eax, dword [ebp - 0x10]
call fcn.00404208
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406b7c
jmp 0x40904f
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x409148
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40904f
mov eax, dword [ebp - 0x10]
call fcn.00404208
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x409148
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406b7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40907b
cmp dword [ebp - 8], 0
je 0x40906a
mov eax, dword [ebp - 8]
call fcn.00404224
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409098
lea eax, [ebp - 4]
call fcn.004069c0
ret