joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c660
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dba4b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x5133d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa4]
push eax
mov dword [edi + 0x10], esi
call fcn.0046bd50
mov esi, dword [esi + 0x6f0]
mov ecx, dword [edi + 0x10]
or esi, 0x40000080
call fcn.004253d0
test al, 1
je 0x46c6be
or esi, 1
jmp 0x46c6c5
test al, 2
je 0x46c6c5
or esi, 2
movups xmm0, xmmword [ebp - 0xa4]
mov ecx, dword [edi + 0x10]
push 0
sub esp, 0x10
mov eax, esp
push 0
movups xmmword [eax], xmm0
mov eax, esi
or eax, 0x20
cmp byte [ecx + 0x6e1], 0
cmove eax, esi
push eax
mov eax, dword [ecx]
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.004288c0
push eax
mov ecx, edi
call fcn.00438d10
mov ecx, dword [edi + 0x10]
call fcn.00425240
cmp eax, 0xffffffff
je 0x46c722
mov ecx, dword [edi + 0x10]
push eax
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00428240
test eax, eax
jne 0x46c733
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00428170
mov eax, dword [eax]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [edi + 4]
call esi
mov eax, dword [edi + 0x10]
push 0
push dword [eax + 0x6dc]
push 0xc5
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
mov al, byte [ecx + 0x6e1]
test al, al
je 0x46c779
movzx eax, word [ecx + 0x6e4]
push 0
push eax
push 0xcc
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00422bd0
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.00422340
push 0
push 0
push 0xb9
push dword [edi + 4]
call esi
push 0
push 3
push 0xd3
mov ecx, edi
call fcn.00439310
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0xe8]
call eax
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [edi + 0x10]
xor ecx, ecx
push 0
cmp byte [eax + 0x6e0], 1
sete cl
push ecx
push 0xcf
push dword [edi + 4]
call esi
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x10]
push dword [edi + 4]
cmp byte [eax + 0x6e2], 0
je 0x46c842
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
mov ecx, 1
cmove eax, ecx
push eax
push 0
jmp 0x46c84a
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
push eax
push 0xb1
push dword [edi + 4]
call esi
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 4
Function at 0x46c880
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5133d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042e770
mov ecx, dword [esi + 0x6d8]
test ecx, ecx
je 0x46c911
lea eax, [ebp - 0x14]
push eax
call fcn.0046bd50
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x46c8e7
mov ecx, dword [esi + 0x6d8]
push 0
call fcn.00462680
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x6d8]
push 0
call fcn.00462680
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46c930
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5133d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x46c9bb
cmp dword [esi + 0x10], 0
je 0x46c9bb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00490560
mov ebx, esp
test ebx, ebx
je 0x46c9bb
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1e4
call fcn.004223f0
mov ecx, dword [esi + 0x10]
push 1
push 0
push 0
mov eax, dword [ecx]
push 0
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.0042c490
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00428b90
test al, al
je 0x46c9bb
mov ecx, dword [esi + 0x10]
call fcn.0042e640
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46d4d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5133d4]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.00430970
mov ecx, dword [esi + 0x6d8]
test ecx, ecx
je 0x46d567
lea eax, [ebp - 0x14]
push eax
call fcn.0046bd50
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x46d53d
mov ecx, dword [esi + 0x6d8]
push 0
call fcn.00462680
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x6d8]
push 0
call fcn.00462680
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 0x14

Function at 0x46e910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dbb8b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x5133d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [eax + 0x6e8], 0
cmp dword [edi + 4], 0
jne 0x46e9bb
lea eax, [ebp - 0xa4]
push eax
call fcn.0046e460
mov ecx, dword [edi + 0x10]
movups xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov eax, esp
push 0
movups xmmword [eax], xmm0
mov eax, dword [ecx]
push 0x40000000
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.004288c0
push eax
mov ecx, edi
call fcn.00438d10
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00425240
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.004283e0
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00422e30
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00422340
test bl, bl
je 0x46e9f8
mov eax, dword [edi + 0x10]
add eax, 0x6d8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, 0x6d8
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 4
Function at 0x46ea50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5133d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042e770
mov ecx, dword [esi + 0x6f0]
test ecx, ecx
je 0x46eae1
lea eax, [ebp - 0x14]
push eax
call fcn.0046e460
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x46eab7
mov ecx, dword [esi + 0x6f0]
push 0
call fcn.00462680
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x6f0]
push 0
call fcn.00462680
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46ebf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5133d4]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.00430970
mov ecx, dword [esi + 0x6f0]
test ecx, ecx
je 0x46ec87
lea eax, [ebp - 0x14]
push eax
call fcn.0046e460
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x46ec5d
mov ecx, dword [esi + 0x6f0]
push 0
call fcn.00462680
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x6f0]
push 0
call fcn.00462680
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048fcf2
mov esp, ebp
pop ebp
ret 0x14
Function at 0x473f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x473fb0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x473fe2
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x473fdf
inc esi
cmp esi, edx
jb 0x473fd0
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x47410c
cmp ecx, 3
jbe 0x474022
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x474060
cmp cl, 0xff
je 0x474060
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x473fc4
dec ecx
shl eax, cl
and eax, 7
je 0x473ffa
movzx ecx, byte [eax + 0x4e9a2c]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x4e9a24], 0
mov cl, byte [edx + 4]
je 0x47404a
test cl, cl
je 0x47404a
cmp cl, 0xff
jne 0x473ffa
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x473fc4
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x47408e
lea edx, [edi + ebx]
add edx, esi
jmp 0x474094
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x4740d2
movzx edi, byte [eax + 0x4e9a2c]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x4740be
cmp cl, 0xff
jne 0x4740d2
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x474081
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x473fc4
pop edi
pop esi
cmp ecx, 3
jbe 0x474121
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4941d6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4c00e2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bff61

Function at 0x4c6839
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c64f9
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x402c00
pop dword [ebp - 0x14]
mov eax, 0xf85f3a21
sub eax, 0xf81f0e21
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xbc4aa3ae
sub dword [ebp - 0x24], 0x6df85e63
mov dword [ebp - 0x20], 0xc7d1ce6e
sub dword [ebp - 0x20], 0x959e8229
mov dword [ebp - 0x1c], 0x7d561cb1
add dword [ebp - 0x1c], 0xcef6277d
mov dword [ebp - 0x18], 0xf67b685f
sub dword [ebp - 0x18], 0xf67b685f
lea eax, [ebp - 0x24]
push eax
mov eax, 0x604d1509
add eax, 0x9ff36b83
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x6e8c896d
sub dword [ebp - 0x24], 0xfa1a2017
mov dword [ebp - 0x20], 0x6a1493aa
add dword [ebp - 0x20], 0xd757cdcb
mov dword [ebp - 0x1c], 0x48a1de65
sub dword [ebp - 0x1c], 0xe53271f9
mov dword [ebp - 0x18], 0x3a356fb1
add dword [ebp - 0x18], 0xc5ca904f
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x373ce
push 0
call eax
mov ecx, 0x4a32
mov ebx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x14]
mov edx, 0x548543a3
add dword [ebp - 0x10], esi
mov edi, dword [esi]
xor dword [ebp - 0xc], ecx
add edi, edx
mov dword [ebx], edi
xor dword [ebp - 0xc], edi
add ebx, 0xedd18957
add ebx, 0x122e76ad
add esi, 0xc212867
add esi, 0xf3ded79d
loop 0x402d0b
add eax, 0x69ea870
add eax, 0xf962732b
xor ebx, ebx
add ebx, eax
add eax, 0x15518fce
add eax, 0xeaae7037
mov ecx, 0x45b42980
add ecx, 0xba8bd680
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x65cc8f30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x65cd30c0]
test eax, eax
je 0x65cc8fe8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x65cc8f70
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x65cc8f5c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x65cc901d
mov dword [esp + 4], 0x65cd0664
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x65cd30c0], eax
sub esp, 8
test eax, eax
jne 0x65cc8f4d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x65cc8f5e
Function at 0x404ff8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42503c], 0
je 0x405059
cmp word [0x425318], 0xd7b2
jne 0x405021
cmp dword [0x425320], 0
jbe 0x405021
mov eax, 0x425314
call dword [0x425330]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405084
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x423020], 0
jne 0x405075
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4071b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40731b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00405c4c
cmp si, word [0x4237c0]
jb 0x40724e
cmp si, word [0x4239c0]
ja 0x40724e
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x40724e
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4237c0]
jae 0x407228
mov edi, ebx
dec edi
jmp 0x407249
cmp si, word [ebx*8 + 0x4237c0]
jbe 0x407238
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x407249
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4237c4]
call fcn.004070c4
jmp 0x40724e
cmp edi, dword [ebp - 0xc]
jae 0x407212
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4072fd
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4072fd
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00405e4c
push dword [ebp - 0x164]
push 0x407338
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00405e4c
push dword [ebp - 0x168]
push 0x407348
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00405e4c
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407322
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00405c44
ret
Function at 0x4074d4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4075d9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x427b44
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x427b5c]
jne 0x407520
mov eax, esi
mov edx, 0x427b60
mov ecx, 0x55
call fcn.00405e4c
push 0x427b44
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4075c3
push 0x427b44
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00405c4c
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x407591
cmp byte [0x427b40], 0
je 0x407556
mov edx, esi
mov eax, ebx
call fcn.004073b4
jmp 0x407591
mov edx, esi
mov eax, ebx
call fcn.004071b4
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x407591
cmp dword [esi], 0
je 0x40757a
mov eax, esi
mov edx, 0x4075f4
call fcn.00405f80
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004071b4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00405f80
push 0x427b44
call sub.kernel32.dll_EnterCriticalSection
mov word [0x427b5c], bx
push 0xaa
mov eax, dword [esi]
call fcn.00405cd8
push eax
push 0x427b60
call sub.kernel32.dll_lstrcpynW
push 0x427b44
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4075e0
lea eax, [ebp - 4]
call fcn.00405c3c
ret
Function at 0x407818
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c34
xor eax, eax
push ebp
push 0x4079fd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x407858
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x407872
push 0x105
mov eax, dword [ebp - 4]
call fcn.00405cd8
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x4079e7
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x407a0c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407901
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x407a0c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407901
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x407a40
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x407901
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x407a74
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4079e7
xor eax, eax
push ebp
push 0x4079e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040761c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x407970
mov eax, dword [ebp - 0x10]
call fcn.004039b8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405df8
jmp 0x4079bb
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x407ab4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4079bb
mov eax, dword [ebp - 0x10]
call fcn.004039b8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x407ab4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405df8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4079e7
cmp dword [ebp - 8], 0
je 0x4079d6
mov eax, dword [ebp - 8]
call fcn.004039d4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407a04
lea eax, [ebp - 4]
call fcn.00405c3c
ret