joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437304
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2dc
mov eax, dword [ebp + 8]
mov ecx, eax
lea edx, [ebp - 0x248]
lea esi, [ebp - 0x244]
xor edi, edi
mov ebx, pe_nt_image_headers32
mov dword [ebp - 0x290], eax
mov al, 1
test al, 1
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x29c], edx
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a8], eax
jne 0x437364
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0x2a0]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], pe_nt_image_headers32
mov dword [ebp - 0x2ac], eax
call fcn.00540e93
mov dword [ebp - 0x248], 0xff
mov eax, esp
lea ecx, [ebp - 0x248]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x2a0]
mov dword [eax], ecx
call sub.KERNEL32.DLL_GetComputerNameW
sub esp, 8
lea ecx, [ebp - 0x44]
lea edx, [0x550e90]
mov dword [ebp - 0x28], edx
mov edx, 0x558e04
mov dword [ebp - 0x24], edx
mov edx, ebp
mov dword [ebp - 0x20], edx
mov edx, esp
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0x43756a
mov dword [ebp - 0x2b0], eax
mov eax, ecx
call fcn.00551af9
mov eax, dword [ebp - 0x2b0]
cmp eax, 0
je 0x43751a
mov dword [ebp - 0x3c], 0xffffffff
mov eax, esp
lea ecx, [ebp - 0x244]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x264]
mov dword [eax], ecx
mov dword [ebp - 0x2b4], ecx
call fcn.0042d654
mov byte [ebp - 0x265], 0
mov eax, esp
mov ecx, dword [ebp - 0x2b4]
mov dword [eax + 4], ecx
lea edx, [ebp - 0x274]
mov dword [eax], edx
call fcn.004062f4
mov eax, esp
mov ecx, dword [ebp - 0x2b4]
mov dword [eax + 4], ecx
lea edx, [ebp - 0x280]
mov dword [eax], edx
call fcn.004063d8
mov eax, esp
lea ecx, [ebp - 0x284]
mov dword [eax], ecx
mov dword [ebp - 0x2b8], ecx
call fcn.004044b8
mov dword [ebp - 0x3c], 1
mov eax, dword [ebp - 0x278]
mov ecx, esp
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x280]
mov edx, dword [ebp - 0x27c]
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x26c]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x274]
mov edx, dword [ebp - 0x270]
mov dword [ecx + 8], edx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 0x2ac]
mov dword [ecx], edx
call fcn.00437878
jmp 0x4374bc
mov byte [ebp - 0x265], 1
test byte [ebp - 0x265], 1
jne 0x43750a
jmp 0x4374fc
mov eax, dword [ebp - 0x2ac]
mov dword [esp], eax
call fcn.00405890
lea eax, [ebp - 0x264]
mov dword [esp], eax
call fcn.0040380c
jmp 0x437539
lea eax, [0x558bca]
mov dword [ebp - 0x3c], 0xffffffff
mov ecx, dword [ebp - 0x2ac]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004043c0
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.00551b1a
mov eax, dword [ebp - 0x298]
add esp, 0x2dc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438014
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8ec
mov eax, dword [ebp + 8]
mov ecx, eax
mov dl, 1
test dl, 1
mov dword [ebp - 0x8a0], ecx
mov dword [ebp - 0x8a4], eax
jne 0x43803e
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x8a8], eax
call sub.USER32.DLL_GetForegroundWindow
lea ecx, [ebp - 0x44]
lea edx, [0x550e90]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], edx
mov edx, 0x558e90
mov dword [ebp - 0x24], edx
mov edx, ebp
mov dword [ebp - 0x20], edx
mov edx, esp
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0x4382f2
mov dword [ebp - 0x8ac], eax
mov eax, ecx
call fcn.00551af9
mov eax, dword [ebp - 0x8ac]
cmp eax, 0
je 0x438230
xor eax, eax
mov ecx, 0x800
lea edx, [ebp - 0x848]
mov esi, edx
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x800
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x8b4], ecx
mov dword [ebp - 0x8b8], edx
call fcn.00540e93
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x3c], 0xffffffff
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x800
call fcn.00540e93
mov ecx, 0x400
lea edx, [ebp - 0x848]
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x3c], 0xffffffff
mov edi, esp
mov dword [edi + 4], edx
mov dword [edi], esi
mov dword [edi + 8], 0x400
mov dword [ebp - 0x8bc], eax
mov dword [ebp - 0x8c0], ecx
call sub.USER32.DLL_GetWindowTextW
sub esp, 0xc
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 0
jle 0x43822e
mov dword [ebp - 0x3c], 0xffffffff
mov eax, esp
lea ecx, [ebp - 0x848]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x878]
mov dword [eax], ecx
mov dword [ebp - 0x8c4], ecx
call fcn.0042d654
mov dword [ebp - 0x3c], 1
mov eax, esp
mov ecx, dword [ebp - 0x8c4]
mov dword [eax + 4], ecx
lea edx, [ebp - 0x85c]
mov dword [eax], edx
call fcn.0042d950
jmp 0x438184
mov eax, esp
lea ecx, [ebp - 0x85c]
mov dword [eax], ecx
call fcn.004223d4
mov dword [ebp - 0x3c], 2
mov ecx, esp
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x8a8]
mov dword [ecx], eax
call fcn.004043c0
jmp 0x4381ae
lea eax, [ebp - 0x85c]
mov dword [esp], eax
call fcn.00422814
lea eax, [ebp - 0x878]
mov dword [esp], eax
call fcn.0040380c
jmp 0x4382c1
jmp 0x438230
mov dword [ebp - 0x3c], 0xffffffff
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x3c], 0xffffffff
mov ecx, esp
mov dword [ecx + 4], eax
lea eax, [ebp - 0x89c]
mov dword [ecx], eax
mov dword [ebp - 0x8d8], eax
call fcn.00413688
mov dword [ebp - 0x3c], 3
mov eax, esp
mov ecx, dword [ebp - 0x8d8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x8a8]
mov dword [eax], edx
mov dword [eax + 4], str.W_e:
call fcn.0040b748
jmp 0x438283
lea eax, [ebp - 0x89c]
mov dword [esp], eax
call fcn.00405890
jmp 0x4382c1
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.00551b1a
mov eax, dword [ebp - 0x8a0]
add esp, 0x8ec
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44de04
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x34
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, 0x100001
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esi, esp
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 0x100001
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
call sub.KERNEL32.DLL_OpenProcess
sub esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, esp
mov dword [edx], eax
mov dword [edx + 4], 0
mov dword [ebp - 0x18], ecx
call sub.KERNEL32.DLL_TerminateProcess
sub esp, 8
mov ecx, dword [ebp - 0xc]
mov edx, esp
mov dword [edx], ecx
mov dword [ebp - 0x1c], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov dword [ebp - 0x20], eax
add esp, 0x34
pop esi
pop ebp
ret
Function at 0x45f324
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0x270
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jne 0x45f34b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0045f3c8
jmp 0x45f364
mov eax, 0x4e0
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx]
ja 0x45f362
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0045f47c
jmp 0x45f364
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, ecx
add edx, 1
mov dword [eax], edx
mov ecx, dword [eax + ecx*4 + 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
shr ecx, 0xb
and ecx, dword [eax + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
shl ecx, 7
and ecx, 0x9d2c5680
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x18
pop ebp
ret

Function at 0x45f3c8
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], 0x270
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0xc], 0x4e0
jge 0x45f474
mov eax, 0x9908b0df
xor ecx, ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x270
mov esi, dword [ebp - 0x18]
mov edx, dword [esi + edx*4 + 4]
and edx, 0x80000000
mov edi, dword [ebp - 0xc]
sub edi, 0x270
mov edi, dword [esi + edi*4 + 8]
and edi, 0x7fffffff
or edx, edi
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
shr edx, 1
mov edi, dword [ebp - 0x10]
and edi, 1
cmp edi, 0
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
jne 0x45f445
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
xor ecx, eax
mov eax, dword [ebp - 0xc]
sub eax, 0x270
mov edx, dword [ebp - 0x18]
xor ecx, dword [edx + eax*4 + 0x638]
mov eax, dword [ebp - 0xc]
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x45f3e3
add esp, 0x1c
pop esi
pop edi
pop ebp
ret
Function at 0x45f47c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0xc], 0xe3
jge 0x45f516
mov eax, 0x9908b0df
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x20]
mov edx, dword [esi + edx*4 + 0x9c4]
and edx, 0x80000000
mov edi, dword [ebp - 0xc]
mov edi, dword [esi + edi*4 + 0x9c8]
and edi, 0x7fffffff
or edx, edi
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
shr edx, 1
mov edi, dword [ebp - 0x10]
and edi, 1
cmp edi, 0
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jne 0x45f4ef
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
xor ecx, eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
xor ecx, dword [edx + eax*4 + 0xff8]
mov eax, dword [ebp - 0xc]
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x45f497
jmp 0x45f518
cmp dword [ebp - 0xc], 0x26f
jge 0x45f59f
mov eax, 0x9908b0df
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x20]
mov edx, dword [esi + edx*4 + 0x9c4]
and edx, 0x80000000
mov edi, dword [ebp - 0xc]
mov edi, dword [esi + edi*4 + 0x9c8]
and edi, 0x7fffffff
or edx, edi
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x14]
shr edx, 1
mov edi, dword [ebp - 0x14]
and edi, 1
cmp edi, 0
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x45f570
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
xor ecx, eax
mov eax, dword [ebp - 0xc]
sub eax, 0x270
mov edx, dword [ebp - 0x20]
xor ecx, dword [edx + eax*4 + 0x638]
mov eax, dword [ebp - 0xc]
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x45f518
mov eax, 0x9908b0df
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x20]
mov edx, dword [esi + edx*4 + 0x9c4]
and edx, 0x80000000
mov edi, dword [esi + 4]
and edi, 0x7fffffff
or edx, edi
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x18]
shr edx, 1
mov edi, dword [ebp - 0x18]
and edi, 1
cmp edi, 0
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
jne 0x45f5e7
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x3c]
xor ecx, eax
mov eax, dword [ebp - 0x20]
xor ecx, dword [eax + 0x634]
mov edx, dword [ebp - 0xc]
mov dword [eax + edx*4 + 4], ecx
mov dword [eax], 0
add esp, 0x3c
pop esi
pop edi
pop ebp
ret
Function at 0x465e24
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00468a88
test esi, esi
jne 0x465e5a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00468c20
jmp 0x465e78
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00465d04
mov edi, eax
test esi, esi
je 0x465e78
cmp dword [ebx], 0
je 0x465e78
dec esi
jmp 0x465e61
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x467794
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00467c54
mov byte [esp], al
cmp byte [esp], 0
jne 0x46791d
test edi, edi
je 0x46791d
mov byte [esp + 1], 0
test ebp, ebp
jle 0x46785d
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x467838
cmp edi, 0xffffffff
je 0x4677f9
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4677f9
mov byte [esp], 0
jmp 0x46791d
cmp dword [esi], 1
jg 0x467838
cmp dword [esi], 0
jne 0x46782a
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x46782a
call fcn.00554af8
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x46791d
lea eax, [esp + 0xc]
call fcn.0046742c
dec ebp
test ebp, ebp
jg 0x4677de
cmp edi, 0xffffffff
je 0x46785d
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x46785b
mov byte [esp], 0
jmp 0x46791d
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4677a2
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x46785d
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00467998
mov edx, eax
mov ebx, dword [0x579c48]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4678c1
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4678bf
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4678c1
xor edi, edi
cmp byte [esp], 0
je 0x4678e7
mov ebx, dword [esi]
test bl, 1
jne 0x4678fd
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4678c7
mov byte [esp + 1], 1
jmp 0x4678fd
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4678e7
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x467874
cmp byte [esp], 0
je 0x46791d
call fcn.00554af8
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x468720
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5793a4], 0
je 0x468787
cmp word [0x579694], 0xd7b2
jne 0x468749
cmp dword [0x57969c], 0
jbe 0x468749
mov eax, 0x579690
call dword [0x5796ac]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4687b4
call fcn.0046929c
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x55b5fc], 0
jne 0x4687a3
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret

Function at 0x468948
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x55b5c0], 0
je 0x468973
mov edx, edi
mov eax, esi
call dword [0x55b5c0]
mov ebx, eax
jmp 0x468984
mov eax, 8
call fcn.00465634
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x5793a5], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x468910
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
jne 0x4689b4
mov eax, ebx
call fcn.00465650
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x46c54c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46c6b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00468a88
cmp si, word [0x55bfd0]
jb 0x46c5e9
cmp si, word [0x55c1d0]
ja 0x46c5e9
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jl 0x46c5e9
mov ebx, edi
add ebx, dword [ebp - 8]
sar ebx, 1
jns 0x46c5b4
adc ebx, 0
cmp si, word [ebx*8 + 0x55bfd0]
jae 0x46c5c3
mov edi, ebx
dec edi
jmp 0x46c5e4
cmp si, word [ebx*8 + 0x55bfd0]
jbe 0x46c5d3
inc ebx
mov dword [ebp - 8], ebx
jmp 0x46c5e4
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x55bfd4]
call fcn.0046c46c
jmp 0x46c5e9
cmp edi, dword [ebp - 8]
jge 0x46c5a8
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x46c698
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x46c698
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00469588
push dword [ebp - 0x160]
push 0x46c6d4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00469588
push dword [ebp - 0x164]
push 0x46c6e4
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00469588
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004697c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c6bf
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00468ae8
pop eax
jmp eax
Function at 0x46c86c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c972
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x57bf68
call sub.KERNEL32.DLL_EnterCriticalSection
cmp bx, word [0x57bf80]
jne 0x46c8b8
mov eax, esi
mov edx, 0x57bf82
mov ecx, 0x55
call fcn.00469588
push 0x57bf68
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x46c95a
push 0x57bf68
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
call fcn.00468a88
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x46c927
cmp byte [0x57bf64], 0
je 0x46c8ec
mov edx, esi
mov eax, ebx
call fcn.0046c750
jmp 0x46c927
mov edx, esi
mov eax, ebx
call fcn.0046c54c
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0x46c927
cmp dword [esi], 0
je 0x46c910
mov eax, esi
mov edx, 0x46c98c
call fcn.004696e4
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0046c54c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004696e4
push 0x57bf68
call sub.KERNEL32.DLL_EnterCriticalSection
mov word [0x57bf80], bx
mov eax, dword [esi]
call fcn.004694ec
mov ecx, eax
mov eax, 0x57bf82
mov edx, 0xaa
call fcn.0046c3cc
push 0x57bf68
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c979
lea eax, [ebp - 4]
call fcn.00468a88
pop eax
jmp eax
Function at 0x46cbb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00468b7c
xor eax, eax
push ebp
push 0x46cddc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x46cbfa
push 0x105
lea eax, [ebp - 0x21e]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
jmp 0x46cc14
mov eax, dword [ebp - 4]
call fcn.004694ec
mov ecx, eax
lea eax, [ebp - 0x21e]
mov edx, 0x105
call fcn.0046c3cc
cmp word [ebp - 0x21e], 0
je 0x46cdbf
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x46cdec
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x46cce3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x46cdec
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x46cce3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x46ce28
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x46cce3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x46ce28
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x46cce3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x46ce5c
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x46cce3
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x46ce90
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
jne 0x46cdbf
xor eax, eax
push ebp
push 0x46cdb8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
lea eax, [ebp - 0x21e]
call fcn.0046c9b4
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x46cd46
mov eax, dword [ebp - 0x14]
call fcn.00465634
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0046954c
jmp 0x46cd91
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0x46ced0
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x46cd91
mov eax, dword [ebp - 0x14]
call fcn.00465634
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x46ced0
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0046954c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cdbf
cmp dword [ebp - 0xc], 0
je 0x46cdac
mov eax, dword [ebp - 0xc]
call fcn.00465650
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cde3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00468ae8
pop eax
jmp eax