joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41673c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00411100
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4167d7
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x423fcc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4167d7
cmp eax, 1
je 0x4167f8
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4167d7
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4167a4
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4167d3
xor eax, eax
inc eax
jmp 0x416817
cmp edi, eax
jae 0x4167db
xor eax, eax
jmp 0x416817
cmp eax, esi
jae 0x4167e2
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x423fcc]
jmp 0x4167fb
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4128ea
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41298c
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x412942
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 1
push 0x580d
push dword [ebp - 0xc]
push 0xcc4
push 0x61fc
call fcn.004129a8
add esp, 0x14
jmp 0x41298a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41296c
push 0x39d
push 0x25a8
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x41298a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41298a
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4129a4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
push 0x1030
push 0
push dword [ebp - 0x28]
call fcn.0040c5cc
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x412e13
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x412e6c
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x48]
push 1
push 0x7fe2
push 0x3cdf
push 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x18]
push 0x4a2d
call fcn.0041795a
add esp, 0x24
jmp 0x412fa9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x412eb9
push 0
push 0x1add
call fcn.0040f7c2
pop ecx
pop ecx
jmp 0x412fa9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x412f0d
push 0x24f9
push 0
push 0xea6
push 0xee4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x412fa9
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
cmp dword [eax], 0xdd2e91c8
jbe 0x412f82
mov dword [ebp - 0x5c], 0xfff9
push dword [ebp - 4]
push 0xeaa
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.00419e2e
add esp, 0x10
jmp 0x412fa9
mov dword [ebp - 0x74], 0
push dword [ebp - 0x64]
push dword [ebp - 0x6c]
push dword [ebp - 4]
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x84]
push 0
call fcn.0041a7ac
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x41345f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4135ab
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x413531
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x413518
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4134f9
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x413516
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.00431cde
mov dword [eax], 0x143e95aa
jmp 0x4134ee
jmp 0x41352f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x4135a9
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x41358c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x41358a
push 0x9ea
push 0x1285
push 0x21c8
push 0x1717
push 0xd82
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x4135a9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4135a9
push 0
push 0x19b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x4135cb
push 0x3e0a
push 0
push 0x683c
push 1
push 0x6b9d
push 0x23c2
call fcn.0040a330
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x413c2e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x413cfa
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x413cd5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x413caf
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x413cad
push 0
push 0
push 0
push 0
push 0
push 0
push 0x837
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x413cd3
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x413cf8
push 0
push 0x4635
push 0x19f7
push 0x7651
push 0x37f0
push 0x1b5
call fcn.004148b1
add esp, 0x18
jmp 0x413d1d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
push 0x8d9
push 1
push 1
push dword [ebp - 0x34]
call fcn.00412c48
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x414bb5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x414be7
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x1ece
push 1
push 0
push 0x672b
call fcn.00417788
add esp, 0x14
jmp 0x414c73
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x414c45
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x414c26
push 0
push 1
push 0x237f
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
jmp 0x414c43
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x414c43
push 0
push 0x19b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x414c73
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 0x589a
push 0
push 0x23d4
push 0x6957
push 0x21b7
push 1
push dword [ebp - 0x1c]
push 0x2559
call fcn.0040bb07
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x419c86
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x419d51
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x419ceb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x1c6d
push dword [ebp - 0x10]
push 1
push 0x58c4
call fcn.00419e2e
add esp, 0x10
jmp 0x419d4c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
push 0
push 0x1bf3
push 0x2622
push 0x55bb
push 0x6e3
mov eax, dword [ebp - 0x28]
push dword [eax]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
push dword [eax]
push 0
mov eax, dword [ebp - 0x38]
push dword [eax]
push 0x5bac
push 0x2f3e
push 1
push 1
call fcn.0041491d
add esp, 0x3c
jmp 0x419e2a
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x419df2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x419de8
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x419dc9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x419de6
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x60]
call fcn.00431cde
mov dword [eax], 1
jmp 0x419dbe
jmp 0x419df0
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x419e2a
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
push 1
push 0x190e
push 1
push 0
push dword [ebp - 0x6c]
push 0
push dword [ebp - 0x70]
push 0x5a77
push 1
push 0x31ce
push 0x2b62
call fcn.0041eff5
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x423a5a
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x423aa0
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push dword [ebp - 8]
push 0x6ee3
push dword [ebp - 0xc]
push 1
push 0x7982
call fcn.00423b37
add esp, 0x18
jmp 0x423b33
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x423ad2
push 1
call fcn.00416b33
pop ecx
jmp 0x423b33
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x423afc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x423b33
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42531b
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4253f5
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4253b1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x425377
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x425375
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x4253af
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4253af
push 0x1fa
push 0x79ee
push 1
push 0x2642
push 0x6f26
push 0
push 0
call fcn.004299d9
add esp, 0x1c
jmp 0x4253f3
push 0x750c
push 0x269
push 0x6345
push 0xe7
push 1
push 1
push 0x24e0
push 0x2259
push 0
push 0x3bff
push 1
push 0x36be
push 0x392b
push 0x85
call fcn.00417c95
add esp, 0x38
jmp 0x42545c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x603e
push 0x5fdc
push dword [ebp - 0x2c]
push 0x2495
push 0x470
push 0x2caf
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x7d80
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0
call fcn.00410295
add esp, 0x38
mov esp, ebp
pop ebp
ret
Function at 0x42641f
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
movzx eax, byte [ebp + 0x34]
test eax, eax
je 0x4265c2
lea eax, [ebp + 0x14]
mov dword [ebp - 0x60], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x426596
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x42648f
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x426594
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 1
jmp 0x4264c9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x426594
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0x35d56974
mov dword [ebp - 0x74], 4
mov dword [ebp - 0x70], 4
mov dword [ebp - 0x6c], 4
mov dword [ebp - 0x68], 4
lea ecx, [ebp - 5]
call fcn.00431ced
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x88]
call fcn.00431cf0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x80]
call fcn.00431c9c
push 0x349
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x40b1
push dword [ebp - 0x10]
push 0x58b
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 4]
push 0
push dword [ebp - 0x24]
push 0x5f54
push 0x6bd7
push 1
push 0
call fcn.00410cba
add esp, 0x38
push 1
lea eax, [ebp - 0x80]
push eax
push 0x1457
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 0x10]
push 1
push dword [ebp - 4]
push 1
call fcn.00415517
add esp, 0x24
lea ecx, [ebp - 0x80]
call fcn.00431cc2
jmp 0x4264be
jmp 0x4265c0
push 1
push 0x2d4b
push 0x5d99
push 0x4d4f
push 0x6dba
push 0
push 0x5149
push 0x167c
call fcn.00415942
add esp, 0x20
jmp 0x426621
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
push 0x1d88
push dword [ebp - 0x2c]
push 0x342f
push dword [ebp - 0x34]
push dword [ebp - 0x3c]
push 0xc3a
push dword [ebp - 0x44]
push 1
push 0x3f8a
push dword [ebp - 0x4c]
push 0x3d2
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
push eax
push 1
call fcn.0040afaa
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x42bc37
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x42bcea
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42bcd0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42bcae
mov byte [ebp - 1], 0
push 1
push 1
lea eax, [ebp - 1]
push eax
push 0x6726
push 0xdf6
push 1
push 0x6456
push 1
push 0x3f3e
push 0xf16
call fcn.00428e65
add esp, 0x28
jmp 0x42bcce
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x42bcce
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x42bce8
push 1
push 1
push 0x1ac4
push 0xc2
push 0
call fcn.00415743
add esp, 0x14
jmp 0x42bd09
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push 0x76d8
push dword [ebp - 0x24]
push 0
push 1
push 0x607f
call fcn.00429d90
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43bf01
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x43bf4c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push 0xbba
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
call fcn.0043bfe5
add esp, 0x18
jmp 0x43bfe0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43bf88
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 0
call fcn.00452beb
pop ecx
pop ecx
jmp 0x43bfe0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43bfac
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x43bfe0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
call fcn.00480d22
mov esi, eax
mov ecx, dword [ebp - 0x40]
call fcn.004040ac
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x44]
mov dword [eax], edx
pop esi
mov esp, ebp
pop ebp
ret