joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ec7a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x464]
test eax, eax
je 0x46ec92
cmp eax, 0x10000
jne 0x46ecb6
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x45c]
push eax
push 0x10000
push 1
push ecx
call fcn.00451967
add esp, 0x10
mov dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov edx, dword [esi + 0x45c]
mov al, byte [ecx + edx]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
pop ebp
ret 4

Function at 0x46ed07
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x460]
mov eax, dword [esi + 0x458]
mov byte [eax + ecx], dl
inc dword [esi + 0x460]
cmp dword [esi + 0x460], 0x10000
jne 0x46ed56
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x458]
push eax
push 0x10000
push 1
push ecx
call fcn.00450f19
add esp, 0x10
mov dword [esi + 0x460], 0
pop esi
pop ebp
ret 8

Function at 0x46eee4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x4a7540], eax
mov edx, 1
mov eax, 0x4a7540
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a7efc
jl 0x46eefa
mov dword [0x49205c], 1
mov dword [0x4a7f10], 1
pop edi
pop ebp
ret

Function at 0x47f03d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x34]
push edi
push 0x488154
push eax
mov dword [ebp - 4], fcn.00414a46
call fcn.00451625
mov edi, eax
add esp, 8
mov dword [ebp - 8], edi
test edi, edi
jne 0x47f091
push eax
push 0xdeadbeef
push 0x1f
push esi
call fcn.0047ef2e
mov bl, al
lea eax, [ebp - 8]
push eax
call fcn.0046e4ab
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp + 8], 1
jmp 0x47f09d
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push 0x400
lea edx, [ebp - 0x408]
push edx
push eax
call dword [0x482748]
test eax, eax
je 0x47f10f
mov eax, dword [ebp + 8]
test eax, eax
je 0x47f0e3
push edi
push 1
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.00450f19
mov eax, dword [ebp + 8]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x47f09d
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x47f134
push eax
push 0xdeadbeef
push 0x21
push esi
call fcn.0047ef2e
lea ecx, [ebp - 8]
push ecx
mov bl, al
call fcn.0046e4ab
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push 0xdeadbeef
push 0x20
push esi
call fcn.0047ef2e
lea edx, [ebp - 8]
push edx
mov bl, al
call fcn.0046e4ab
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push 0
Function at 0x47faae
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
mov dh, 0xc0
mov dh, 0xc0
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x47faa4
mov edx, 0x18c
lea esp, [esp]
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x47fadf
mov ecx, dword [0x4a7540]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001ba93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1001baa2
pop dword [ebp - 0x50]
mov eax, 0xa3712a53
sub eax, 0x936f6fb1
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x532465d2
sub dword [ebp - 0x60], 0x4d22087
mov dword [ebp - 0x5c], 0xd2151a1d
add dword [ebp - 0x5c], 0x601e3228
mov dword [ebp - 0x58], 0xd5d71b37
add dword [ebp - 0x58], 0x767528f7
mov dword [ebp - 0x54], 0x65d18d65
sub dword [ebp - 0x54], 0x65d18d65
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xeaed0475
add dword [ebp - 0x60], 0x898564e1
mov dword [ebp - 0x5c], 0x8e1453fe
sub dword [ebp - 0x5c], 0x4ca7f289
mov dword [ebp - 0x58], 0xff304a5
add dword [ebp - 0x58], 0x537c67c7
mov dword [ebp - 0x54], 0x3f769eaf
sub dword [ebp - 0x54], 0x3f769eaf
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x4d172ca7
add eax, 0xc2eab3dd
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3eab3
push 0
call eax
mov ecx, 0x94b2dd65
add ecx, 0x6b4d7005
mov ebx, eax
mov esi, 0xd9cdfdc2
sub esi, 0xc9caa5c2
add esi, dword [ebp - 0x50]
mov edi, 0x737070fb
sub edi, 0x71250b24
xor dword [ebp - 8], 0xe86aa5b1
mov edx, dword [esi]
mov dword [ebp - 0x28], 0xb276bd0a
sub edx, edi
xor dword [ebp - 4], eax
mov dword [ebx], edx
xor dword [ebp - 0x1c], ecx
add ebx, 4
add esi, 0x905c3327
add esi, 0x6fa3ccdd
loop 0x1001bbbf
add eax, 0xbe2e097e
add eax, 0x41d31efd
mov ebx, eax
add eax, 0xdc5def62
add eax, 0x23a210a3
mov ecx, 0x5696f9d9
sub ecx, 0x4696f9d9
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x405a12
pop dword [ebp - 0x34]
mov eax, 0x405a12
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x5895f14b
add dword [ebp - 0x44], 0xf5bc5400
mov dword [ebp - 0x40], 0x77beb5fa
sub dword [ebp - 0x40], 0x458b69b5
mov dword [ebp - 0x3c], 0xb4b24b18
add dword [ebp - 0x3c], 0x9799f916
mov dword [ebp - 0x38], 0xe5beac40
sub dword [ebp - 0x38], 0xe5beac40
lea eax, [ebp - 0x44]
push eax
mov eax, 0x85074fa9
sub eax, 0x84c6cea5
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x95114421
sub dword [ebp - 0x44], 0x209edacb
mov dword [ebp - 0x40], 0xa2874260
sub dword [ebp - 0x40], 0x611ae0eb
mov dword [ebp - 0x3c], 0xf1624a99
add dword [ebp - 0x3c], 0x720d21d3
mov dword [ebp - 0x38], 0x9f9ba260
sub dword [ebp - 0x38], 0x9f9ba260
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x55cb4eef
add eax, 0xaa753211
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x34c5c
push 0
call eax
mov ecx, 0xc8c1c62a
sub ecx, 0xc8c186ff
xor edx, edx
add edx, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x34]
mov esi, 0x3dd11bbb
sub esi, 0x764279f4
add dword [ebp - 0x10], 0x609b928
mov edi, dword [ebx]
mov dword [ebp - 0xc], 0x796e534d
xor edi, esi
add dword [ebp - 0x28], 0xb337b105
mov dword [edx], edi
sub dword [ebp - 4], ebx
add edx, 0xe209e9c0
add edx, 0x1df61644
add ebx, 4
loop 0x405b2b
add eax, 0x86a30a1c
sub eax, 0x86a21a9d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x53883ffb
sub ecx, 0x53483ffb
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x271a1a11
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x5a252884
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x406fec
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40702e
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x40704e
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040a7e0
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x4072a4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409cb4
test esi, esi
jne 0x4072da
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409e3c
jmp 0x4072f8
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407188
mov edi, eax
test esi, esi
je 0x4072f8
cmp dword [ebx], 0
je 0x4072f8
dec esi
jmp 0x4072e1
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x40894c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408dd8
mov byte [esp], al
cmp byte [esp], 0
jne 0x408ad5
test edi, edi
je 0x408ad5
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408a15
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4089f0
cmp edi, 0xffffffff
je 0x4089b1
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4089b1
mov byte [esp], 0
jmp 0x408ad5
cmp dword [esi], 1
jg 0x4089f0
cmp dword [esi], 0
jne 0x4089e2
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4089e2
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408ad5
lea eax, [esp + 0xc]
call fcn.00408608
dec ebp
test ebp, ebp
jg 0x408996
cmp edi, 0xffffffff
je 0x408a15
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408a13
mov byte [esp], 0
jmp 0x408ad5
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40895a
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a15
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408b44
mov edx, eax
mov ebx, dword [0x5008fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408a79
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408a77
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408a79
xor edi, edi
cmp byte [esp], 0
je 0x408a9f
mov ebx, dword [esi]
test bl, 1
jne 0x408ab5
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a7f
mov byte [esp + 1], 1
jmp 0x408ab5
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a9f
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408a2c
cmp byte [esp], 0
je 0x408ad5
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40994c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50005c], 0
je 0x4099b3
cmp word [0x500348], 0xd7b2
jne 0x409975
cmp dword [0x500350], 0
jbe 0x409975
mov eax, 0x500344
call dword [0x500360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4099e0
call fcn.0040a440
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4fc032], 0
jne 0x4099cf
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x409b74
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4fc034], 0
je 0x409b9f
mov edx, edi
mov eax, esi
call dword [0x4fc034]
mov ebx, eax
jmp 0x409bb0
mov eax, 8
call fcn.00406e68
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x50005d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409b3c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409be0
mov eax, ebx
call fcn.00406e84
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40c754
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40c8b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409cb4
cmp si, word [0x4fca00]
jb 0x40c7ec
cmp si, word [0x4fcc00]
ja 0x40c7ec
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40c7ec
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4fca00]
jae 0x40c7c6
mov edi, ebx
dec edi
jmp 0x40c7e7
cmp si, word [ebx*8 + 0x4fca00]
jbe 0x40c7d6
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40c7e7
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4fca04]
call fcn.0040c674
jmp 0x40c7ec
cmp edi, dword [ebp - 8]
jae 0x40c7b0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40c89b
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c89b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a7e0
push dword [ebp - 0x160]
push 0x40c8d4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a7e0
push dword [ebp - 0x164]
push 0x40c8e4
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a7e0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040aa18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c8c0
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409d14
ret
Function at 0x40ca6c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cb70
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x502c14
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x502c2c]
jne 0x40cab8
mov eax, esi
mov edx, 0x502c2e
mov ecx, 0x55
call fcn.0040a7e0
push 0x502c14
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40cb5a
push 0x502c14
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00409cb4
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40cb27
cmp byte [0x502c10], 0
je 0x40caec
mov edx, esi
mov eax, ebx
call fcn.0040c950
jmp 0x40cb27
mov edx, esi
mov eax, ebx
call fcn.0040c754
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40cb27
cmp dword [esi], 0
je 0x40cb10
mov eax, esi
mov edx, 0x40cb88
call fcn.0040a938
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040c754
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a938
push 0x502c14
call sub.kernel32.dll_EnterCriticalSection
mov word [0x502c2c], bx
mov eax, dword [esi]
call fcn.0040a73c
mov ecx, eax
mov eax, 0x502c2e
mov edx, 0xaa
call fcn.0040c5d4
push 0x502c14
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cb77
lea eax, [ebp - 4]
call fcn.00409cb4
ret
Function at 0x40cda0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409d98
xor eax, eax
push ebp
push 0x40cfc5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40cde0
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40cdfa
mov eax, dword [ebp - 4]
call fcn.0040a73c
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040c5d4
cmp word [ebp - 0x21a], 0
je 0x40cfaf
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40cfd4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cec9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40cfd4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cec9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d010
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cec9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d010
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cec9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d044
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40cec9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40d078
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40cfaf
xor eax, eax
push ebp
push 0x40cfa8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040cbb0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40cf38
mov eax, dword [ebp - 0x10]
call fcn.00406e68
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040a7a4
jmp 0x40cf83
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40d0b8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40cf83
mov eax, dword [ebp - 0x10]
call fcn.00406e68
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40d0b8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040a7a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cfaf
cmp dword [ebp - 8], 0
je 0x40cf9e
mov eax, dword [ebp - 8]
call fcn.00406e84
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cfcc
lea eax, [ebp - 4]
call fcn.00409cb4
ret
Function at 0x40d2b4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409d98
xor eax, eax
push ebp
push 0x40d374
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a7e0
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a990
mov eax, dword [ebx]
call fcn.0040d17c
test al, al
jne 0x40d351
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a7e0
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a990
mov eax, dword [ebx]
call fcn.0040d17c
test al, al
jne 0x40d351
mov eax, ebx
call fcn.00409cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d37b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409d14
lea eax, [ebp - 4]
call fcn.00409cb4
ret

Function at 0x40eec4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret