joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x28]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [edx + 0x26]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lodsb al, byte [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp al, 0x61
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x406c04
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub al, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
ror edi, 0x6f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test ecx, ecx
nop
nop
nop
nop
nop
je 0x4072b2
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [edx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x406ada

Function at 0x406e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x406e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x406ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [ebx + ecx*4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x406ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x407030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jne fcn.00406e60
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [eax + 0x24]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x41b0f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.0041eed0
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41b12e
cmp dword [ebp + 8], 0
je 0x41b11c
lea eax, [ebp + 8]
push eax
call fcn.0041b2f0
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x41b12e
mov eax, 4
jmp 0x41b25e
call fcn.0041ed00
movzx edx, al
test edx, edx
jne 0x41b15c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41b14d
mov dword [ebp - 0xc], 4
jmp 0x41b154
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x41b25e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41b205
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x41b2a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.00417590
lea ecx, [ebp - 8]
call fcn.0041b330
movzx edx, al
test edx, edx
jne 0x41b1c7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.0041b310
mov eax, dword [ebp - 0x10]
jmp 0x41b25e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.0041f050
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x41b1f2
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.0041b310
mov eax, dword [ebp - 0x14]
jmp 0x41b25e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.0041b310
mov eax, dword [ebp - 0x18]
jmp 0x41b25e
call fcn.0041ee20
movzx ecx, al
test ecx, ecx
jne 0x41b23e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.0041b270
add esp, 0x10
jmp 0x41b25e
call fcn.0041ed30
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0041b270
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x407078
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4070ba
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x4070da
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040bbc0
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x4072d0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040ae30
test esi, esi
jne 0x407306
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040afb8
jmp 0x407324
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407214
mov edi, eax
test esi, esi
je 0x407324
cmp dword [ebx], 0
je 0x407324
dec esi
jmp 0x40730d
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x4099bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00409e7c
mov byte [esp], al
cmp byte [esp], 0
jne 0x409b45
test edi, edi
je 0x409b45
mov byte [esp + 1], 0
test ebp, ebp
jle 0x409a85
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x409a60
cmp edi, 0xffffffff
je 0x409a21
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409a21
mov byte [esp], 0
jmp 0x409b45
cmp dword [esi], 1
jg 0x409a60
cmp dword [esi], 0
jne 0x409a52
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x409a52
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x409b45
lea eax, [esp + 0xc]
call fcn.00409678
dec ebp
test ebp, ebp
jg 0x409a06
cmp edi, 0xffffffff
je 0x409a85
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409a83
mov byte [esp], 0
jmp 0x409b45
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4099ca
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409a85
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409bc0
mov edx, eax
mov ebx, dword [0x72f8fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409ae9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x409ae7
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409ae9
xor edi, edi
cmp byte [esp], 0
je 0x409b0f
mov ebx, dword [esi]
test bl, 1
jne 0x409b25
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409aef
mov byte [esp + 1], 1
jmp 0x409b25
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409b0f
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409a9c
cmp byte [esp], 0
je 0x409b45
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40aac8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x72f05c], 0
je 0x40ab2f
cmp word [0x72f348], 0xd7b2
jne 0x40aaf1
cmp dword [0x72f350], 0
jbe 0x40aaf1
mov eax, 0x72f344
call dword [0x72f360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40ab5c
call fcn.0040b7b0
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x71e032], 0
jne 0x40ab4b
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40acf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x71e034], 0
je 0x40ad1b
mov edx, edi
mov eax, esi
call dword [0x71e034]
mov ebx, eax
jmp 0x40ad2c
mov eax, 8
call fcn.00406ed4
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x72f05d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40acb8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40ad5c
mov eax, ebx
call fcn.00406ef0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40df74
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40e0d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040ae30
cmp si, word [0x71ea08]
jb 0x40e00c
cmp si, word [0x71ec08]
ja 0x40e00c
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40e00c
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x71ea08]
jae 0x40dfe6
mov edi, ebx
dec edi
jmp 0x40e007
cmp si, word [ebx*8 + 0x71ea08]
jbe 0x40dff6
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40e007
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x71ea0c]
call fcn.0040de94
jmp 0x40e00c
cmp edi, dword [ebp - 8]
jae 0x40dfd0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40e0bb
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40e0bb
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040bbc0
push dword [ebp - 0x160]
push 0x40e0f4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040bbc0
push dword [ebp - 0x164]
push 0x40e104
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040bbc0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040bdf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e0e0
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.0040ae90
ret
Function at 0x40e28c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e390
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x731c14
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x731c2c]
jne 0x40e2d8
mov eax, esi
mov edx, 0x731c2e
mov ecx, 0x55
call fcn.0040bbc0
push 0x731c14
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40e37a
push 0x731c14
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.0040ae30
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40e347
cmp byte [0x731c10], 0
je 0x40e30c
mov edx, esi
mov eax, ebx
call fcn.0040e170
jmp 0x40e347
mov edx, esi
mov eax, ebx
call fcn.0040df74
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40e347
cmp dword [esi], 0
je 0x40e330
mov eax, esi
mov edx, 0x40e3a8
call fcn.0040bd18
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040df74
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040bd18
push 0x731c14
call sub.kernel32.dll_EnterCriticalSection
mov word [0x731c2c], bx
mov eax, dword [esi]
call fcn.0040bb08
mov ecx, eax
mov eax, 0x731c2e
mov edx, 0xaa
call fcn.0040ddf4
push 0x731c14
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e397
lea eax, [ebp - 4]
call fcn.0040ae30
ret
Function at 0x40e5c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040af14
xor eax, eax
push ebp
push 0x40e7e5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40e600
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40e61a
mov eax, dword [ebp - 4]
call fcn.0040bb08
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040ddf4
cmp word [ebp - 0x21a], 0
je 0x40e7cf
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40e7f4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e6e9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40e7f4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e6e9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40e830
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e6e9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40e830
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e6e9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40e864
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e6e9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40e898
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40e7cf
xor eax, eax
push ebp
push 0x40e7c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040e3d0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40e758
mov eax, dword [ebp - 0x10]
call fcn.00406ed4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040bb6c
jmp 0x40e7a3
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40e8d8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40e7a3
mov eax, dword [ebp - 0x10]
call fcn.00406ed4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40e8d8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040bb6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e7cf
cmp dword [ebp - 8], 0
je 0x40e7be
mov eax, dword [ebp - 8]
call fcn.00406ef0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e7ec
lea eax, [ebp - 4]
call fcn.0040ae30
ret
Function at 0x40eaec
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040af14
xor eax, eax
push ebp
push 0x40ebac
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040bbc0
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040bd70
mov eax, dword [ebx]
call fcn.0040e99c
test al, al
jne 0x40eb89
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040bbc0
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040bd70
mov eax, dword [ebx]
call fcn.0040e99c
test al, al
jne 0x40eb89
mov eax, ebx
call fcn.0040ae30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ebb3
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040ae90
lea eax, [ebp - 4]
call fcn.0040ae30
ret

Function at 0x410928
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x425afc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x425c2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x218]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jle 0x425c04
lea ebx, [ebp - 0x218]
lea eax, [ebx + 4]
mov word [eax], 0
push 0x104
lea eax, [ebp - 0x424]
push eax
push ebx
call sub.kernel32.dll_QueryDosDeviceW
mov esi, eax
test esi, esi
jle 0x425bed
lea eax, [ebp - 4]
lea edx, [ebp - 0x424]
mov ecx, 0x106
call fcn.0040bbc0
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040c0f0
test eax, eax
jle 0x425bed
mov eax, dword [ebp - 4]
test eax, eax
je 0x425ba1
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov edi, dword [ebp - 8]
test edi, edi
je 0x425baf
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.0040bee0
mov eax, dword [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
mov edx, ebx
call fcn.0040bb6c
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.0040bd70
jmp 0x425c04
add ebx, 2
cmp word [ebx], 0
jne 0x425bea
add ebx, 4
test ebx, ebx
je 0x425bfe
cmp word [ebx], 0
jne 0x425b4e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425c31
lea eax, [ebp - 0x42c]
mov edx, 2
call fcn.0040ae90
lea eax, [ebp - 4]
call fcn.0040ae30
ret
Function at 0x425d24
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x425f61
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.0040ae30
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize
mov ebx, eax
test ebx, ebx
jne 0x425dfb
cmp dword [ebp - 0x14], 0
jne 0x425dfb
xor edx, edx
mov eax, 6
call fcn.0042f644
test al, al
je 0x425dfb
push 2
push 0x104
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFinalPathNameByHandleW
test eax, eax
jbe 0x425dfb
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.0040bbc0
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.00425afc
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 8]
call fcn.0040b210
mov byte [ebp - 9], 1
jmp 0x425f43
test ebx, ebx
jne 0x425e09
cmp dword [ebp - 0x14], 0
je 0x425ef7
push 0
push 1
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3ee
je 0x425ef7
xor eax, eax
push ebp
push 0x425ef0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x425ed9
xor eax, eax
push ebp
push 0x425ed2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
call sub.kernel32.dll_GetCurrentProcess
lea ecx, [ebp - 0x224]
mov edx, dword [ebp - 0x18]
call fcn.004181ec
test eax, eax
jbe 0x425ebb
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.0040bbc0
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.00425afc
mov edx, dword [ebp - 0x230]
mov eax, dword [ebp - 8]
call fcn.0040b210
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425ed9
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425ef7
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
cmp byte [ebp - 9], 0
jne 0x425f43
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 4]
call fcn.00425c38
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 8]
call fcn.0040b210
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x425f43
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00425afc
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 8]
call fcn.0040b210
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425f68
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.0040ae90
ret