joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425e0d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x42f3f8
call fcn.00412a58
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ebx, dword [esi + 0x5c]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call fcn.0042b14e
cmp dword [esi + 0x54], 0
mov edi, dword [eax + 0xc]
je 0x425e5b
call fcn.0042b14e
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x425e6c
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x425e78
or eax, 0xffffffff
jmp 0x425f7b
mov ecx, esi
call fcn.0042594d
mov dword [ebp - 0x14], eax
call fcn.00421694
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0
je 0x425ebb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x425ebb
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x425ebb
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
and dword [ebp - 4], 0
push esi
call fcn.004228df
push dword [ebp - 0x14]
call fcn.004215ec
push edi
push eax
push ebx
mov ecx, esi
call fcn.00425c00
xor ebx, ebx
cmp eax, ebx
je 0x425f2f
test byte [esi + 0x38], 0x10
je 0x425efd
push 4
pop edi
mov ecx, esi
call fcn.004236ab
test ah, 1
je 0x425ef5
push 5
pop edi
push edi
mov ecx, esi
call fcn.00421090
cmp dword [esi + 0x1c], ebx
je 0x425f2f
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.004238cf
jmp 0x425f2f
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], ebx
je 0x425f43
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], ebx
je 0x425f5c
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x425f5c
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00425987
cmp dword [esi + 0x54], ebx
je 0x425f78
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x42699f
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.00412a80
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x432bd0]
je 0x426aa6
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x426a0f
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x426a16
cmp ebx, ebx
jne 0x426a16
xor eax, eax
jmp 0x426aa9
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x426a23
mov byte [esi + 0x20], bl
jmp 0x426a37
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00408826
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.00408826
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.00408826
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x426a92
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x426aa6
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x427eb3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x43e370]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x427f02
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x427f02
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x427f0e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.00411557
leave
ret 8
Function at 0x428a35
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43e370]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x428a82
push dword [ebp + 8]
call fcn.0042c01f
mov esi, eax
test esi, esi
je 0x428aaa
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x428aaa
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x430898
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.00411557
leave
ret 0xc
Function at 0x4295d1
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov edx, dword [ebp + 0xc]
mov eax, dword [0x43e370]
push ebx
xor ecx, ecx
cmp edx, ecx
push esi
mov dword [ebp - 4], eax
push edi
je 0x4296f2
cmp dword [ebp + 8], ecx
je 0x4296f2
mov eax, dword [ebp + 0x18]
mov esi, eax
mov edi, eax
and esi, 0x2e000000
and edi, 0x40000000
test eax, 0x90000000
mov dword [ebp - 0x830], 0x824
mov dword [ebp - 0x82c], ecx
mov dword [ebp + 0x18], ecx
je 0x429643
cmp dword [edx + 0x30], ecx
je 0x429643
test eax, 0x2000000
je 0x42963d
mov dword [ebp + 0x18], 1
jmp 0x429643
or edi, 0x80000000
mov ebx, dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
push esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x828]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x4296aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4296f2
push dword [ebp - 0x830]
call fcn.004234ba
test eax, eax
pop ecx
mov dword [ebp - 0x834], eax
je 0x4296f2
push esi
lea ecx, [ebp - 0x830]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x82c], 1
call ebx
test eax, eax
jne 0x4296b2
push dword [ebp - 0x834]
jmp 0x4296ec
lea ebx, [ebp - 0x828]
jmp 0x4296b8
mov ebx, dword [ebp - 0x834]
mov esi, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push edi
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp dword [ebp + 0x18], edi
mov dword [ebp + 8], eax
je 0x42970f
push 0x2100000
push edi
push edi
push dword [esi + 0x2c]
call dword [sym.imp.SHLWAPI.dll_UrlUnescapeA]
test eax, eax
jge 0x429703
cmp dword [ebp - 0x82c], edi
je 0x4296f2
push ebx
call fcn.004234e5
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00411557
leave
ret 0x14
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esi + 0x30], eax
cmp dword [ebp - 0x82c], edi
je 0x42971e
push ebx
call fcn.004234e5
pop ecx
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x429730
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0x1000
jmp 0x4296f4
mov cx, word [esi + 0x18]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov esi, dword [esi + 0xc]
dec esi
mov ecx, dword [ebp + 0x10]
je 0x42978e
dec esi
je 0x429783
dec esi
je 0x429778
dec esi
je 0x42976d
dec esi
je 0x429765
dec esi
je 0x42975d
dec esi
jne 0x429728
mov dword [ecx], 0x1002
jmp 0x4296f4
mov dword [ecx], 0x1006
jmp 0x4296f4
mov dword [ecx], 0x1001
jmp 0x4296f4
mov dword [ecx], 0x100b
jmp 0x4296f4
mov dword [ecx], 3
jmp 0x4296f4
mov dword [ecx], 2
jmp 0x4296f4
mov dword [ecx], 1
jmp 0x4296f4
Function at 0x429bf5
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x429c1e
call fcn.0042b14e
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x429c41
push eax
push dword [esi + 4]
call fcn.00429b82
push esi
push eax
mov ecx, 0x4410f0
call fcn.00429a32
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x429dd6
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
je 0x429eff
mov eax, dword [esi + 0x14]
test eax, eax
je 0x429eff
mov ecx, dword [esi + 0x3c]
test ecx, ecx
jne 0x429e1d
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x429e15
push 0
jmp 0x429f01
mov eax, dword [ebp - 4]
jmp 0x429ee0
mov eax, dword [esi + 0x38]
push ebx
push edi
mov edi, dword [ebp + 0xc]
cmp edi, dword [esi + 0x34]
jb 0x429e71
mov ebx, dword [esi + 0x40]
sub ebx, eax
jns 0x429e35
xor ebx, ebx
jmp 0x429e3d
cmp ebx, edi
ja 0x429ee5
push ebx
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00412ae0
mov eax, dword [esi + 0x34]
add esp, 0xc
mov dword [esi + 0x38], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
sub edi, ebx
push edi
add eax, ebx
push eax
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x429e0e
mov eax, dword [ebp - 4]
jmp 0x429edc
mov edx, dword [esi + 0x40]
lea ebx, [eax + edi]
cmp ebx, edx
jb 0x429ee9
sub edx, eax
jns 0x429e83
xor ebx, ebx
jmp 0x429e89
mov ebx, edx
cmp ebx, edi
ja 0x429ee5
push ebx
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00412ae0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x429e0e
mov eax, dword [ebp + 0xc]
sub edi, ebx
cmp edi, eax
mov dword [esi + 0x40], eax
jae 0x429ec2
mov dword [ebp + 0xc], edi
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [esi + 0x3c]
add eax, ebx
push eax
call fcn.00412ae0
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [esi + 0x38], eax
add eax, ebx
pop edi
pop ebx
pop esi
leave
ret 8
xor eax, eax
jmp 0x429ede
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00412ae0
add esp, 0xc
add dword [esi + 0x38], edi
mov eax, edi
jmp 0x429ede
push 6
push dword [esi + 0x1c]
call fcn.00429b82
int3
Function at 0x429f0a
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x18], 1
push edi
je 0x429fb3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x429fb3
mov ecx, dword [esi + 0x30]
test ecx, ecx
mov edi, dword [ebp + 0xc]
jne 0x429f4e
lea ecx, [ebp + 0xc]
push ecx
push edi
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x429f47
push 0
jmp 0x429fb5
cmp dword [ebp + 0xc], edi
je 0x429f8c
jmp 0x429f43
mov eax, dword [esi + 0x2c]
lea edx, [eax + edi]
cmp edx, dword [esi + 0x28]
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetWriteFile]
jb 0x429f73
lea edx, [ebp + 0xc]
push edx
push eax
push ecx
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x429f43
and dword [esi + 0x2c], 0
mov ecx, dword [esi + 0x28]
cmp edi, ecx
jb 0x429f92
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x429f43
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0x2c]
lea edx, [eax + edi]
cmp edx, ecx
ja 0x429f8b
mov ecx, dword [esi + 0x30]
push edi
push dword [ebp + 8]
add ecx, eax
push ecx
call fcn.00412ae0
add esp, 0xc
add dword [esi + 0x2c], edi
jmp 0x429f8b
push 6
push dword [esi + 0x1c]
call fcn.00429b82
int3

Function at 0x429fed
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
jne 0x42a02a
push 0x1000
call fcn.004297ec
test eax, eax
je 0x42a085
lea eax, [ebp - 4]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x42a08b
mov eax, dword [ebp - 4]
mov dword [esi + 0x40], eax
mov dword [esi + 0x38], ebx
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x3c]
push edi
mov edi, dword [ebp + 8]
jmp 0x42a07a
mov ecx, dword [esi + 0x38]
cmp ecx, dword [esi + 0x40]
jb 0x42a065
lea eax, [ebp - 4]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x42a08b
mov eax, dword [ebp - 4]
cmp eax, ebx
mov dword [esi + 0x40], eax
je 0x42a094
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x38], ebx
mov cl, byte [eax]
cmp cl, 0xd
je 0x42a06f
mov byte [edi], cl
inc edi
inc dword [esi + 0x38]
mov cl, byte [eax]
inc eax
cmp cl, 0xa
je 0x42a07f
dec dword [ebp + 0xc]
jne 0x42a036
mov eax, dword [ebp + 8]
mov byte [edi], bl
pop edi
pop esi
pop ebx
leave
ret 8
push ebx
push dword [esi + 0x1c]
call fcn.00429b82
mov eax, edi
sub eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
jmp 0x42a082
Function at 0x42a28a
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x42f27c
call fcn.00412a58
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00426422
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [esi], vtable.CInternetFile.0
mov dword [esi + 0x1c], eax
call fcn.00401ca0
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.004016d0
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.004016d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x42b5e9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x43e370]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x42b647
push 0x432cf4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004135c0
add esp, 0x10
cmp eax, 0xffffffff
je 0x42b65b
cmp eax, esi
jae 0x42b65b
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x42b65d
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42b612
jmp 0x42b65e
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.00411557
leave
ret
Function at 0x42b67e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x43e370]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x42b720
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x42b822
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x42b7d0
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42b823
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42b7c5
cmp dword [ebp - 0x24], 1
jne 0x42b7c5
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x430f5c
push eax
call fcn.00413617
add esp, 0xc
cmp eax, 1
jne 0x42b7c5
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42b823
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x42b823
lea ecx, [ebp - 0x18]
push ecx
push 0x42b668
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x42b823
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x42b849
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.0042b5e9
cmp eax, ebx
pop ecx
pop ecx
jne 0x42b84b
inc edi
cmp edi, esi
jl 0x42b832
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00411557
leave
ret 4
Function at 0x42b85a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x43db18
je 0x42b916
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42b8fe
mov esi, dword [ebx + 4]
jmp 0x42b8f8
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42b8e8
cmp dword [ebp - 0xc], 4
jne 0x42b8e8
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x42b8e0
or dword [eax + 0x9c], ecx
jmp 0x42b8e8
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x42b8ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x42b88f
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x42bcd0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x42f385
call fcn.00412a58
sub esp, 0x11c
mov eax, dword [0x43e370]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x42bdc9
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x42bd9d
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00401750
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0042bcd0
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004012b0
test bl, bl
jne 0x42bd9d
or dword [ebp - 4], 0xffffffff
jmp 0x42bd0e
cmp esi, 0x103
je 0x42bdad
cmp esi, 0x3f2
jne 0x42bdbd
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00411557
pop edi
pop esi
pop ebx
leave
ret 8