joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fca0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x48], edx
mov ebx, ecx
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x28]
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], 0
sub esp, 0xc
mov al, byte [ebp - 0x40]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.0044fdb0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
cmp eax, ecx
jae 0x42fe31
lea edx, [eax + 1]
mov dword [ebp - 0x18], edx
cmp ecx, 8
jb 0x42fd0c
mov ecx, dword [ebp - 0x28]
jmp 0x42fd0f
lea ecx, [ebp - 0x28]
mov word [ecx + eax*2], 0x5c
mov word [ecx + eax*2 + 2], 0
lea esi, [ebp - 0x40]
mov ecx, ebx
mov edx, esi
push dword [ebp + 8]
call fcn.0042f490
add esp, 4
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x42fd3a
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ebx, edx
sub ebx, ecx
cmp ebx, eax
jb 0x42fe3e
lea ebx, [ecx + eax]
mov dword [ebp - 0x18], ebx
cmp edx, 8
jb 0x42fd5a
mov edi, dword [ebp - 0x28]
lea ecx, [edi + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [edi + ebx*2], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
mov edi, dword [ebp - 0x48]
jb 0x42fdb0
mov ecx, dword [ebp - 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42fda6
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42fe60
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.004484f5
add esp, 8
cmp dword [ebp - 0x14], 8
jb 0x42fdbb
mov eax, dword [ebp - 0x28]
jmp 0x42fdbe
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ecx, eax
and ecx, 0xfffffffd
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test ecx, ecx
cmove edx, ecx
mov dword [edi], edx
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42fe1d
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42fe13
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42fe60
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.004484f5
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
mov eax, edi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.00452430
jmp 0x42fd1c
sub esp, 0x10
mov cl, byte [ebp - 0x44]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.0044fec0
jmp 0x42fd70
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x43cf30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov al, 1
cmp byte [ecx + 4], 0
jne 0x43d000
mov esi, ecx
mov edi, dword [ecx]
test edi, edi
jne 0x43cf75
xor eax, eax
push str.MozillaFirefoxDefaultBrowserAgentRegistryMutex
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x43cf6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], edi
test edi, edi
je 0x43d004
push 0xbb8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x43cfb9
cmp eax, 0x80
je 0x43cfd8
test eax, eax
je 0x43cff5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xbb
push str.Acquire
push str.Failed_to_wait_on_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042eaa0
add esp, 0x14
jmp 0x43cff9
push 0xae
push str.Acquire
push str.Timed_out_waiting_for_registry_mutex
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042eaa0
add esp, 0x10
jmp 0x43cff9
push 0xb5
push str.Acquire
push str.Found_abandoned_registry_mutex._Continuing...
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042eaa0
add esp, 0x10
mov byte [esi + 4], 1
cmp byte [esi + 4], 0
setne al
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xa4
push str.Acquire
push str.Couldnt_open_registry_mutex:__X
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
call fcn.0042eaa0
add esp, 0x14
xor eax, eax
jmp 0x43d000
Function at 0x43daf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0x14]
mov dword [ebx], edi
push ebx
push 0x20019
push edi
push str.SOFTWAREPoliciesMozillaFirefox
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [ebx]
test ebx, ebx
je 0x43dbab
lea eax, [ebp - 0x18]
mov dword [eax], edi
lea ecx, [ebp - 0x1c]
mov dword [ecx], edi
sub esp, 0x30
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, 2
test eax, eax
jne 0x43dba2
lea ecx, [ebp - 0x20]
mov dword [ecx], 0xffffffff
lea eax, [ebp - 0x24]
mov dword [eax], 4
xor edi, edi
push eax
push ecx
push edi
push 0x10
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor ecx, ecx
lea edx, [ebp - 0x20]
cmp dword [edx], edi
sete cl
test eax, eax
mov edi, 2
cmove edi, ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43dbb0
mov edi, 2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44d4c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x44d53a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x44d575
cmp dword [esp + 4], 0
je 0x44d55c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x44d598
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x4a126c]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x4a126c], edi
jne 0x44d520
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x44d56c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x44d5df
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x44d560
mov esi, dword [esp]
jmp 0x44d56c
mov esi, dword [edi]
jmp 0x44d56b
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x462c80
push 0x462cb4
push eax
call fcn.0044e1a0
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 8], 0x462cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x4613d0
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x462ce0
push eax
call fcn.0044dc10
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x462cd8
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x4613d0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0044e200
ud2
Function at 0x44ddf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x44de41
cmp eax, 1
jne 0x44deb8
mov dword [esp], 0x460023
jmp 0x44de48
mov dword [esp], 0x460025
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x44ded4
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x460088
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x4136e0
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x413660
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x413660
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
jmp 0x44df5a
mov edx, 7
mov dword [esp], str.matches_assertion_failed:___left__right___n__left:_____n_right:___:
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x44de5d
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 8]
mov dword [esp + 0x38], 0x460064
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], 0x4136e0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x413660
lea esi, [esp + 0x50]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x413660
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], fcn.0040f510
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0044dc10
add esp, 8
ud2
Function at 0x44ec50
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x270
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push 0x20a
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x44eca2
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
add eax, 0xffffff07
cmp eax, 0xfffffefc
jae 0x44ecbb
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
mov eax, ebx
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret
push str.control.exe
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ebx, ebx
test eax, eax
je 0x44eca4
lea esi, [ebp - 0x220]
mov dword [esi], ebx
mov ecx, esi
call fcn.0044eaa0
mov eax, dword [esi]
mov dword [ebp - 0x278], eax
mov ecx, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push ecx
call fcn.0044eb90
add esp, 8
lea ecx, [eax + 1]
mov dword [ebp - 0x27c], ecx
lea ecx, [eax + eax]
add ecx, 2
xor esi, esi
dec esi
cmp eax, 0xffffffff
cmovge esi, ecx
push esi
call fcn.004484b7
add esp, 4
push esi
push ebx
mov esi, eax
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp - 0x278]
mov eax, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgrampageAdvancedSettings_pszAppName_s
push eax
push 0xffffffffffffffff
push dword [ebp - 0x27c]
push esi
call fcn.0044ebf0
add esp, 0x14
xorps xmm0, xmm0
lea eax, [ebp - 0x264]
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
mov dword [eax + 0x2c], 1
mov word [eax + 0x30], 0xa
lea ecx, [ebp - 0x274]
movups xmmword [ecx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
je 0x44edb5
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call edi
push dword [ebp - 0x270]
call edi
push esi
call fcn.004484c0
add esp, 4
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x44eca4
push eax
call fcn.004484c0
add esp, 4
jmp 0x44eca4
Function at 0x4519d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x451a72
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x451a72
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x451a70
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call edi
cmp eax, 3
je 0x451a86
cmp eax, 1
je 0x451a4c
test eax, eax
jne 0x451a70
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
sub edi, ebx
je 0x451a67
push dword [esi + 0x4c]
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x451a70
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x451a72
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x451a72
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5d8ac8
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x5d87dc
add ebx, eax
call fcn.005d8b08
add ebx, 0xff061fe2
inc ebx
xor dword [ecx], esi
sub eax, 1
add eax, 0x8b71a546
add ecx, 2
and ebx, eax
sub ebx, eax
dec ebx
cmp ecx, edx
jl fcn.005d8ac8
add ebx, eax
ret
Function at 0x4067d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00406c90
mov byte [esp], al
cmp byte [esp], 0
jne 0x406959
test edi, edi
je 0x406959
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406899
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x406874
cmp edi, 0xffffffff
je 0x406835
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x406835
mov byte [esp], 0
jmp 0x406959
cmp dword [esi], 1
jg 0x406874
cmp dword [esi], 0
jne 0x406866
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x406866
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x406959
lea eax, [esp + 0xc]
call fcn.00406480
dec ebp
test ebp, ebp
jg 0x40681a
cmp edi, 0xffffffff
je 0x406899
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x406897
mov byte [esp], 0
jmp 0x406959
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4067de
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406899
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004069d4
mov edx, eax
mov ebx, dword [0x4248f4]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4068fd
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4068fb
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4068fd
xor edi, edi
cmp byte [esp], 0
je 0x406923
mov ebx, dword [esi]
test bl, 1
jne 0x406939
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406903
mov byte [esp + 1], 1
jmp 0x406939
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406923
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4068b0
cmp byte [esp], 0
je 0x406959
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x407684
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x424054], 0
je 0x4076eb
cmp word [0x424340], 0xd7b2
jne 0x4076ad
cmp dword [0x424348], 0
jbe 0x4076ad
mov eax, 0x42433c
call dword [0x424358]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x407718
call fcn.00407ee8
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x422026], 0
jne 0x407707
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40a548
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a6af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00407908
cmp si, word [0x4229f8]
jb 0x40a5e0
cmp si, word [0x422bf8]
ja 0x40a5e0
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40a5e0
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4229f8]
jae 0x40a5ba
mov edi, ebx
dec edi
jmp 0x40a5db
cmp si, word [ebx*8 + 0x4229f8]
jbe 0x40a5ca
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40a5db
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4229fc]
call fcn.0040a464
jmp 0x40a5e0
cmp edi, dword [ebp - 8]
jae 0x40a5a4
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40a68f
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40a68f
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00408014
push dword [ebp - 0x160]
push 0x40a6cc
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00408014
push dword [ebp - 0x164]
push 0x40a6dc
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00408014
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004081cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a6b6
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00407968
pop eax
jmp eax
Function at 0x40a864
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40a96a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x426c0c
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x426c24]
jne 0x40a8b0
mov eax, esi
mov edx, 0x426c26
mov ecx, 0x55
call fcn.00408014
push 0x426c0c
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40a952
push 0x426c0c
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00407908
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40a91f
cmp byte [0x426c08], 0
je 0x40a8e4
mov edx, esi
mov eax, ebx
call fcn.0040a748
jmp 0x40a91f
mov edx, esi
mov eax, ebx
call fcn.0040a548
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40a91f
cmp dword [esi], 0
je 0x40a908
mov eax, esi
mov edx, 0x40a984
call fcn.004080ec
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040a548
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004080ec
push 0x426c0c
call sub.kernel32.dll_EnterCriticalSection
mov word [0x426c24], bx
mov eax, dword [esi]
call fcn.00407f88
mov ecx, eax
mov eax, 0x426c26
mov edx, 0xaa
call fcn.0040a3c4
push 0x426c0c
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a971
lea eax, [ebp - 4]
call fcn.00407908
pop eax
jmp eax
Function at 0x40abac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004079fc
xor eax, eax
push ebp
push 0x40add4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40abf2
push 0x105
lea eax, [ebp - 0x21e]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40ac0c
mov eax, dword [ebp - 4]
call fcn.00407f88
mov ecx, eax
lea eax, [ebp - 0x21e]
mov edx, 0x105
call fcn.0040a3c4
cmp word [ebp - 0x21e], 0
je 0x40adb7
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ade4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40acdb
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ade4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40acdb
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ae20
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40acdb
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ae20
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40acdb
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ae54
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40acdb
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40ae88
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40adb7
xor eax, eax
push ebp
push 0x40adb0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
lea eax, [ebp - 0x21e]
call fcn.0040a9ac
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40ad3e
mov eax, dword [ebp - 0x14]
call fcn.004044f0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00407fd8
jmp 0x40ad89
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0x40aec8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40ad89
mov eax, dword [ebp - 0x14]
call fcn.004044f0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x40aec8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00407fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40adb7
cmp dword [ebp - 0xc], 0
je 0x40ada4
mov eax, dword [ebp - 0xc]
call fcn.0040450c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40addb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407968
pop eax
jmp eax