joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4127f8
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
mov eax, ebx
cdq
and edx, 3
push esi
push edi
lea edi, [edx + eax]
mov edx, dword [ebp + 8]
sar edi, 2
lea esi, [ecx + edi*4]
neg edi
je 0x412839
imul eax, dword [esi + edi*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, edx
rol eax, 0xd
imul edx, eax, 5
sub edx, 0x19ab949c
add edi, 1
jne 0x412816
mov eax, ebx
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x41285f
sub eax, 1
je 0x412856
sub eax, 1
jne 0x412875
movzx ecx, byte [esi + 2]
shl ecx, 0x10
movzx eax, byte [esi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [esi]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, ebx
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
pop ebp
ret

Function at 0x412ad8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, edx
mov edi, ecx
call fcn.00401d33
xor esi, esi
mov dword [ebp - 4], eax
pop ecx
test ebx, ebx
jle 0x412b09
mov ecx, dword [ebp + 8]
mov eax, esi
cdq
idiv dword [ebp - 4]
mov al, byte [edx + ecx]
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x412af8
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401b6b
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x401b78
xor eax, eax
pop edi
ret
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.004037c1
test esi, esi
pop ecx
jle 0x401ba4
mov ecx, eax
sub edi, eax
mov edx, esi
push ebx
mov bl, byte [edi + ecx]
xor bl, 0x5b
mov byte [ecx], bl
inc ecx
dec edx
jne 0x401b97
pop ebx
mov byte [eax + esi], 0
pop esi
pop edi
ret

Function at 0x401bab
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x401bcc
mov eax, dword [esp + 4]
add eax, ecx
mov edx, dword [eax]
xor edx, dword [esp + 0xc]
add edx, ecx
add ecx, 4
cmp ecx, dword [esp + 8]
mov dword [eax], edx
jb 0x401bb3
ret

Function at 0x401bcd
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x401bee
mov eax, dword [esp + 4]
add eax, ecx
mov edx, dword [eax]
sub edx, ecx
xor edx, dword [esp + 0xc]
add ecx, 4
cmp ecx, dword [esp + 8]
mov dword [eax], edx
jb 0x401bd5
ret

Function at 0x40218b
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call fcn.00402148
pop ecx
pop ecx
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x402222
cmp eax, 0xffffffff
je 0x402222
push ebx
push esi
push edi
push edi
push edi
push edi
push edi
push dword [ebp + 8]
mov esi, 0xf01ff
push 1
push 1
push 1
push esi
lea ecx, [ebp - 0x44]
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, eax
cmp ebx, edi
je 0x4021e8
cmp ebx, 0xffffffff
jne 0x4021fe
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x40220e
xor edi, edi
inc edi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 4]
call esi
pop esi
mov eax, edi
pop ebx
jmp 0x402224
xor eax, eax
pop edi
leave
ret

Function at 0x402227
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push edi
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 8]
call fcn.00402148
pop ecx
pop ecx
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, edi
je 0x4022a0
cmp ebx, 0xffffffff
je 0x4022a0
push esi
push 0xf01ff
lea eax, [ebp - 0x5c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, edi
je 0x402294
cmp esi, 0xffffffff
je 0x402294
lea eax, [ebp - 0x1c]
push eax
inc edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40228d
xor edi, edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop esi
jmp 0x4022a2
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x4023b5
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
push 0x7d0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
call esi
sub eax, edi
cmp eax, 0x5dc
pop edi
pop esi
ja 0x4023e1
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
xor eax, eax
ret

Function at 0x4026cc
Capabilities:
Delete registry value
Initialize winsock library
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.00403d14
pop ecx
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0xa365
push 0x232
push 0x10
push 0
push str.__srvmgr32
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, str.ZwQueryService
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00402530
test eax, eax
je 0x402750
call fcn.00403182
test eax, eax
jne 0x402757
xor eax, eax
jmp 0x4027fe
call fcn.004032ad
push dword [0x406060]
call fcn.0040218b
mov dword [esp], 0x40103d
push 0xbb8
push 0x161
push dword [0x40606c]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0040345c
test eax, eax
jne 0x402792
call fcn.004034e2
call fcn.00401b50
call fcn.00401b36
push 0x5c
push dword [0x406060]
call fcn.004037e9
push eax
call fcn.00402337
push 0x5c
push dword [0x406064]
call fcn.004037e9
push eax
call fcn.00402337
push 0x5c
push dword [0x406068]
call fcn.004037e9
push eax
call fcn.00402337
call fcn.00402329
push esi
call fcn.00402352
push 0x5c
push dword [0x406064]
call fcn.004037e9
push eax
call fcn.00402352
add esp, 0x34
call fcn.004026ac
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x4032ad
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0x80000000
push dword [0x406064]
call fcn.0040379b
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x4032d4
xor eax, eax
jmp 0x4033b5
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
push edi
mov dword [ebp - 4], edi
call fcn.004037c1
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push ebx
call dword [0x40603c]
push ebx
call dword [0x40604c]
push edi
push esi
call fcn.00403277
test eax, eax
pop ecx
pop ecx
je 0x403394
mov edx, dword [eax + esi + 4]
lea edi, [eax + esi]
mov ecx, dword [edi]
push ecx
push edx
lea eax, [eax + esi + 8]
push eax
call fcn.0040324a
add esp, 0xc
mov dword [edi], eax
push dword [0x406064]
call dword [0x406040]
mov edi, 0x40000000
push edi
push dword [0x406064]
call fcn.0040379b
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x403398
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
push dword [0x406064]
call fcn.0040379b
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x403398
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
push dword [0x406064]
call fcn.0040379b
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
jne 0x403398
xor eax, eax
jmp 0x4033b3
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push esi
push ebx
call dword [0x406050]
push ebx
call dword [0x40604c]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4033b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str.qmopt.dll
lea eax, [ebp - 0x100]
push eax
push str._s_system32_s
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
leave
ret

Function at 0x40352f
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40353e
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
ret

Function at 0x403db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
lea ecx, [ebp - 8]
call fcn.00401ec3
lea eax, [ebp - 0xc]
push eax
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403e3c
push 0x7f
pop ecx
mov byte [ebp - 0x214], al
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x405420
push dword [ebp - 0xc]
mov dword [ebp - 0x14], 0x200
mov dword [ebp - 0x10], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
push ecx
lea eax, [ebp - 0x214]
mov ecx, esp
push eax
call fcn.00401f14
lea ecx, [ebp - 8]
call fcn.00402064
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.00401ee4
lea ecx, [ebp - 8]
call fcn.00401f45
mov eax, dword [ebp + 8]
pop edi
leave
ret
Function at 0x403fdf
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ebp, str.System32_
push ebp
call edi
mov esi, dword [esp + 0x1c]
push esi
mov dword [esp + 0x14], eax
call fcn.004037c1
pop ecx
mov ebx, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push ebx
call edi
sub esi, dword [esp + 0x10]
cmp eax, esi
jg 0x40402c
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push ebx
call fcn.004037d5
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3eed309b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2b97c7a
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x409030
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004094f0
mov byte [esp], al
cmp byte [esp], 0
jne 0x4091b9
test edi, edi
je 0x4091b9
mov byte [esp + 1], 0
test ebp, ebp
jle 0x4090f9
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4090d4
cmp edi, 0xffffffff
je 0x409095
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409095
mov byte [esp], 0
jmp 0x4091b9
cmp dword [esi], 1
jg 0x4090d4
cmp dword [esi], 0
jne 0x4090c6
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4090c6
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4091b9
lea eax, [esp + 0xc]
call fcn.00408cec
dec ebp
test ebp, ebp
jg 0x40907a
cmp edi, 0xffffffff
je 0x4090f9
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4090f7
mov byte [esp], 0
jmp 0x4091b9
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40903e
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4090f9
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409234
mov edx, eax
mov ebx, dword [0x5598fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40915d
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x40915b
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40915d
xor edi, edi
cmp byte [esp], 0
je 0x409183
mov ebx, dword [esi]
test bl, 1
jne 0x409199
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409163
mov byte [esp + 1], 1
jmp 0x409199
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409183
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409110
cmp byte [esp], 0
je 0x4091b9
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40a078
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x55905c], 0
je 0x40a0df
cmp word [0x559348], 0xd7b2
jne 0x40a0a1
cmp dword [0x559350], 0
jbe 0x40a0a1
mov eax, 0x559344
call dword [0x559360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40a10c
call fcn.0040ad50
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x552032], 0
jne 0x40a0fb
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40a2dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x552034], 0
je 0x40a307
mov edx, edi
mov eax, esi
call dword [0x552034]
mov ebx, eax
jmp 0x40a318
mov eax, 8
call fcn.00406eac
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x55905d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a2a4
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
jne 0x40a348
mov eax, ebx
call fcn.00406ec8
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40d0d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40d239
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a41c
cmp si, word [0x552a10]
jb 0x40d16c
cmp si, word [0x552c10]
ja 0x40d16c
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40d16c
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x552a10]
jae 0x40d146
mov edi, ebx
dec edi
jmp 0x40d167
cmp si, word [ebx*8 + 0x552a10]
jbe 0x40d156
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40d167
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x552a14]
call fcn.0040cff4
jmp 0x40d16c
cmp edi, dword [ebp - 8]
jae 0x40d130
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40d21b
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x40d21b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b114
push dword [ebp - 0x160]
push 0x40d254
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040b114
push dword [ebp - 0x164]
push 0x40d264
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040b114
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040b34c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d240
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040a47c
ret
Function at 0x40d3ec
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d4f0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x55bc14
call sub.KERNEL32.DLL_EnterCriticalSection
cmp bx, word [0x55bc2c]
jne 0x40d438
mov eax, esi
mov edx, 0x55bc2e
mov ecx, 0x55
call fcn.0040b114
push 0x55bc14
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x40d4da
push 0x55bc14
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
call fcn.0040a41c
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x40d4a7
cmp byte [0x55bc10], 0
je 0x40d46c
mov edx, esi
mov eax, ebx
call fcn.0040d2d0
jmp 0x40d4a7
mov edx, esi
mov eax, ebx
call fcn.0040d0d4
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40d4a7
cmp dword [esi], 0
je 0x40d490
mov eax, esi
mov edx, 0x40d508
call fcn.0040b26c
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040d0d4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040b26c
push 0x55bc14
call sub.KERNEL32.DLL_EnterCriticalSection
mov word [0x55bc2c], bx
mov eax, dword [esi]
call fcn.0040b05c
mov ecx, eax
mov eax, 0x55bc2e
mov edx, 0xaa
call fcn.0040cf54
push 0x55bc14
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d4f7
lea eax, [ebp - 4]
call fcn.0040a41c
ret
Function at 0x40d720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a500
xor eax, eax
push ebp
push 0x40d945
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40d760
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
jmp 0x40d77a
mov eax, dword [ebp - 4]
call fcn.0040b05c
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040cf54
cmp word [ebp - 0x21a], 0
je 0x40d92f
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d954
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d849
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d954
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d849
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d990
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d849
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d990
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d849
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d9c4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40d849
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d9f8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40d92f
xor eax, eax
push ebp
push 0x40d928
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040d530
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40d8b8
mov eax, dword [ebp - 0x10]
call fcn.00406eac
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040b0c0
jmp 0x40d903
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40da38
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40d903
mov eax, dword [ebp - 0x10]
call fcn.00406eac
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40da38
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040b0c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d92f
cmp dword [ebp - 8], 0
je 0x40d91e
mov eax, dword [ebp - 8]
call fcn.00406ec8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d94c
lea eax, [ebp - 4]
call fcn.0040a41c
ret
Function at 0x40dc4c
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a500
xor eax, eax
push ebp
push 0x40dd0c
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040b114
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040b2c4
mov eax, dword [ebx]
call fcn.0040dafc
test al, al
jne 0x40dce9
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040b114
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040b2c4
mov eax, dword [ebx]
call fcn.0040dafc
test al, al
jne 0x40dce9
mov eax, ebx
call fcn.0040a41c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dd13
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a47c
lea eax, [ebp - 4]
call fcn.0040a41c
ret

Function at 0x40f9e8
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret