joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4051f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0xc], 0
je 0x405206
cmp dword [ebp + 8], 0
jne 0x40520b
jmp 0x40531a
mov dword [ebp - 0x2c], 0x14
mov dword [ebp - 0x28], 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 1
push 0x413b10
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.OLEAUT32.dll_OleCreateFontIndirect]
lea edx, [ebp - 0x10]
push edx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp - 4]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [eax + 0x3c]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 4]
push edx
call fcn.004098d3
add esp, 4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0
xor ecx, ecx
mov dword [ebp - 0x34], ecx
push 0
push 0
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
push eax
call dword [edx + 0x14]
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
call dword [ecx + 8]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x30], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.0040961e
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4060e7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x47c], 0
je 0x40610e
call fcn.00401b0b
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x47c], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x60], eax
mov edx, dword [ebp - 0x20]
xor eax, eax
cmp dword [edx + 0x60], 0
setne al
mov ecx, dword [ebp - 0x20]
mov byte [ecx + 0x64], al
mov edx, dword [ebp - 0x20]
xor eax, eax
mov al, byte [edx + 0x64]
test eax, eax
jne 0x4061a6
mov ecx, dword [ebp + 0x10]
and ecx, 1
test ecx, ecx
je 0x4061a6
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0x415378
push 0x4151a4
push str.CONOUT_
call fcn.00409bce
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x474], eax
push 0x415358
push 0x4151b0
push str.CONIN_
call fcn.00409bce
add esp, 0xc
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x478], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x60], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x60], 0
je 0x4061b9
push 1
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 8], 0xffffffff
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dl, byte [ecx + 0x64]
test edx, edx
je 0x40620d
mov eax, dword [ebp + 0x10]
and eax, 1
test eax, eax
jne 0x40620d
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp - 0x1c], 0
jge 0x4061f4
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x18], 0
jge 0x406201
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x1c]
shl ecx, 0x10
or ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x4067cb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x418158
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x47c]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x480], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.004029dd
push 0x418158
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call fcn.0040254f
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x47c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4062a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x47c], 0
jne 0x4062ba
jmp 0x4063b3
mov ecx, dword [0x418170]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x47c]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx + 0x64]
test edx, edx
jne 0x406310
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x60], 0
je 0x406310
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x474]
push edx
call fcn.00409cbb
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x478]
push ecx
call fcn.00409cbb
add esp, 4
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x60], 0
je 0x40633e
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x60]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x40633e
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x47c]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x47c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x47c]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x47c], 0
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x60], 0
je 0x4063b3
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4063b3
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x60]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x408d38
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00408d0d
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x408d72
xor al, al
jmp 0x408ddd
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x408de3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.00408d0d
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 2
jne 0x408e08
mov dword [ebp - 8], 0xe
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x408e2f
xor al, al
jmp 0x408f03
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
cmp dword [ebp + 8], 2
jne 0x408e73
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00409d80
add esp, 0xc
cmp dword [ebp + 8], 2
jne 0x408ef4
mov eax, dword [ebp - 4]
mov byte [eax], 0x42
mov ecx, dword [ebp - 4]
mov byte [ecx + 1], 0x4d
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
mov dword [edx + 2], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 6], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xe]
add ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xa], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x407775
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov ecx, edx
mov edx, dword [esp + 4]
test edx, edx
jbe 0x4077a2
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x41c4c0]
xor eax, esi
inc ecx
dec edx
jne 0x407783
pop edi
pop esi
ret 4

Function at 0x40d80b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x415e1b
call fcn.00414bc0
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x4175a0
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x4175c8
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.0040f4f9
push dword [esi + 8]
mov ecx, ebx
call fcn.0040f4f9
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040f4f9
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040f4f9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x405e08
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4bf050], 0
je 0x405e69
cmp word [0x4bf32c], 0xd7b2
jne 0x405e31
cmp dword [0x4bf334], 0
jbe 0x405e31
mov eax, 0x4bf328
call dword [0x4bf344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405e94
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x4bc030], 0
jne 0x405e85
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405ff4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4bc034], 0
je 0x40601a
mov edx, esi
mov eax, ebx
call dword [0x4bc034]
jmp 0x406029
mov eax, 8
call fcn.004041d4
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4bf051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405fbc
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x40868c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4087f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004068e8
cmp si, word [0x4bc7d0]
jb 0x408726
cmp si, word [0x4bc9d0]
ja 0x408726
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408726
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4bc7d0]
jae 0x408700
mov edi, ebx
dec edi
jmp 0x408721
cmp si, word [ebx*8 + 0x4bc7d0]
jbe 0x408710
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408721
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4bc7d4]
call fcn.0040859c
jmp 0x408726
cmp edi, dword [ebp - 0xc]
jae 0x4086ea
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4087d5
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x4087d5
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406ad0
push dword [ebp - 0x164]
push 0x408810
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406ad0
push dword [ebp - 0x168]
push 0x408820
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406ad0
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406e88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4087fa
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004068e0
ret
Function at 0x408824
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 6], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x408a0a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4c1b58
call sub.KERNEL32.DLL_EnterCriticalSection
movzx eax, word [0x4c1b70]
cmp ax, word [ebp - 2]
jne 0x40887c
mov eax, dword [ebp - 6]
mov edx, 0x4c1b74
mov ecx, 0x55
call fcn.00406ad0
push 0x4c1b58
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x4089f4
push 0x4c1b58
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, dword [ebp - 6]
xor edx, edx
call fcn.004068e8
push 2
movzx eax, word [ebp - 2]
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x4089bc
cmp byte [0x4c1b54], 0
je 0x408972
call dword [0x4c1b4c]
mov word [ebp - 0x16], ax
movzx eax, word [ebp - 2]
push eax
call dword [0x4c1b50]
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x40896b
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x4c1b48]
test al, al
je 0x408944
mov eax, dword [ebp - 0xc]
add eax, eax
call fcn.004041d4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x38
call dword [0x4c1b48]
mov edx, dword [ebp - 0xc]
sub edx, 2
test edx, edx
jb 0x408939
inc edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
jne 0x408935
mov ecx, dword [ebp - 0x10]
mov word [ecx + eax*2], 0x2c
inc eax
dec edx
jne 0x408922
mov eax, dword [ebp - 6]
mov edx, dword [ebp - 0x10]
call fcn.00406a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4089bc
movzx eax, word [ebp - 0x16]
push eax
call dword [0x4c1b50]
cmp dword [ebp - 0x10], 0
je 0x40896a
mov eax, dword [ebp - 0x10]
call fcn.004041f0
ret
mov edx, dword [ebp - 6]
movzx eax, word [ebp - 2]
call fcn.0040868c
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp ax, word [ebp - 2]
je 0x4089bc
mov eax, dword [ebp - 6]
cmp dword [eax], 0
je 0x4089a1
mov eax, dword [ebp - 6]
mov edx, 0x408a24
call fcn.00406ce4
mov eax, dword [ebp - 6]
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 0x1c]
call fcn.0040868c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 6]
call fcn.00406ce4
mov eax, dword [ebp - 6]
push 0x4c1b58
call sub.KERNEL32.DLL_EnterCriticalSection
movzx eax, word [ebp - 2]
mov word [0x4c1b70], ax
push 0xaa
mov eax, dword [ebp - 6]
mov eax, dword [eax]
call fcn.00406974
push eax
push 0x4c1b74
call sub.KERNEL32.DLL_lstrcpynW
push 0x4c1b58
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408a11
lea eax, [ebp - 0x1c]
call fcn.004068d8
ret
Function at 0x408c48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004068d0
xor eax, eax
push ebp
push 0x408e2d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408c88
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
jmp 0x408ca2
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406974
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.KERNEL32.DLL_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x408e17
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408e3c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408d31
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408e3c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408d31
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408e70
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408d31
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408ea4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x408e17
xor eax, eax
push ebp
push 0x408e10
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408a4c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408da0
mov eax, dword [ebp - 0x10]
call fcn.004041d4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406a94
jmp 0x408deb
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x408ee4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408deb
mov eax, dword [ebp - 0x10]
call fcn.004041d4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x408ee4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408e17
cmp dword [ebp - 8], 0
je 0x408e06
mov eax, dword [ebp - 8]
call fcn.004041f0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408e34
lea eax, [ebp - 4]
call fcn.004068d8
ret
Function at 0x4090f8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov esi, ecx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
call fcn.004068d0
mov eax, dword [ebp - 0x21c]
call fcn.004068d0
lea edi, [ebp - 0x210]
xor eax, eax
push ebp
push 0x409297
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.004068e8
xor ebx, ebx
push 0x105
mov eax, dword [ebp - 0x21c]
call fcn.00406974
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.KERNEL32.DLL_lstrcpynW
lea eax, [ebp - 0x20a]
push eax
call sub.KERNEL32.DLL_lstrlenW
add eax, eax
lea edx, [ebp - 0x20a]
add eax, edx
sub eax, 2
mov dword [edi], eax
jmp 0x409198
sub dword [edi], 2
mov eax, dword [edi]
cmp word [eax], 0x2e
je 0x4091aa
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
jne 0x409195
lea eax, [ebp - 0x20a]
cmp eax, dword [edi]
je 0x409263
add dword [edi], 2
mov eax, dword [edi]
mov word [eax], 0
lea eax, [ebp - 0x20a]
mov edx, dword [edi]
sub edx, eax
sar edx, 1
jns 0x4091d3
adc edx, 0
mov eax, 0x105
sub eax, edx
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x218]
call fcn.00408c48
cmp dword [ebp - 0x220], 0
je 0x40920b
push ebp
mov eax, dword [ebp - 0x220]
call fcn.00408fec
pop ecx
mov ebx, eax
jmp 0x409263
push ebp
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
lea edx, [ebp - 0x224]
call fcn.00408824
mov eax, dword [ebp - 0x224]
call fcn.00408fec
pop ecx
mov ebx, eax
test bl, bl
jne 0x409256
cmp byte [0x4c1b54], 0
jne 0x409256
push ebp
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 0x228]
call fcn.00408824
mov eax, dword [ebp - 0x228]
call fcn.00408fec
pop ecx
mov ebx, eax
test bl, bl
jne 0x409263
push ebp
call fcn.0040909c
pop ecx
mov ebx, eax
test bl, bl
je 0x409279
mov eax, esi
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406ad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40929e
lea eax, [ebp - 0x228]
mov edx, 5
call fcn.004068e0
ret

Function at 0x40ca00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x4c1c4c
push 0xa
push 0x40ca94
mov eax, dword [0x4c1c3c]
push eax
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40ca24
call fcn.00418968
push ebx
mov eax, dword [0x4c1c3c]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40ca3b
call fcn.00418968
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40ca4d
call fcn.00418968
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x4c1c50], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x4c1c54], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x4c1c58], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x4c1c5c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x4c1c60], ecx
add edx, dword [eax + 0x14]
mov dword [0x4c1c64], edx
pop esi
pop ebx
ret