joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023c4
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4023d6
call fcn.007483ec
mov eax, dword [0x7530a3]
shl eax, 2
mov dword [0x7530a7], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
mov dword [0x7530ab], edx
call fcn.0073b2fc
pop edx
call fcn.0073b198
call fcn.0073b444
push 0x75304c
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x7530ab], eax
push 0
jmp 0x749cc0
push ebx
push edi
push esi
sub esp, 0x50
mov esi, dword [esp + 0x60]
mov eax, dword [esi + 0x10]
and eax, 1
mov dword [0x7ae114], eax
call fcn.0073b410
sub esp, 8
push dword [esi + 0x20]
push dword [esi + 0x1c]
call fcn.00745af0
add esp, 4
push dword [esi + 0x28]
call fcn.0073cd48
add esp, 4
push dword [esi + 0x44]
call fcn.0073cd58
add esp, 0x10
mov dword [0x7d3298], 1
mov dword [0x7d329c], esi
lea eax, [esp + 4]
mov dword [0x7d3260], eax
call fcn.0074a6c0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x7d3264], eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x7d326c], eax
sub esp, 8
push dword [esi + 0x30]
push dword [esi + 0x2c]
call fcn.0074899c
add esp, 0x10
push dword [esi + 0x40]
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [esi + 0x34]
call fcn.007489dc
add esp, 8
push 0
push 0x7d3298
call fcn.00749a98
add esp, 0x10
test byte [esi + 0x10], 1
jne 0x749d94
sub esp, 4
push dword [0x7d3284]
push dword [0x7d3280]
push dword [0x7d327c]
call dword [esi + 0x18]
add esp, 0x10
push 0xffffffffffffffff
push eax
push 0
push 0
jmp 0x749e3f
mov eax, dword [0x7d326c]
nop dword [eax]
inc eax
mov cl, byte [eax - 1]
cmp cl, 9
je 0x749da0
cmp cl, 0x20
je 0x749da0
cmp cl, 0x22
jne 0x749dbc
mov cl, byte [eax]
mov edx, 0x22
jmp 0x749dc2
dec eax
mov edx, 0x20
movsx edi, cl
cmp edx, edi
je 0x749de2
nop dword [eax]
test cl, cl
je 0x749de2
cmp cl, 9
je 0x749de2
movsx ecx, byte [eax + 1]
inc eax
cmp edx, ecx
jne 0x749dd0
lea edi, [eax + 1]
cmp cl, 0x22
cmovne edi, eax
jmp 0x749df1
inc edi
movzx eax, byte [edi]
cmp al, 0x20
je 0x749df0
cmp al, 9
je 0x749df0
mov ebx, dword [esi + 0x18]
sub esp, 0xc
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
add esp, 0xc
mov esi, eax
sub esp, 0xc
lea eax, [esp + 0x18]
push eax
call sub.KERNEL32.DLL_GetStartupInfoA
add esp, 0xc
mov eax, dword [esp + 0x38]
test al, 1
movzx eax, word [esp + 0x3c]
mov ecx, 0xa
cmovne ecx, eax
push ecx
push edi
push 0
push esi
call ebx
push 0xffffffffffffffff
push eax
push 0
push 0
call fcn.007487a0
add esp, 0x10
add esp, 0x50
pop esi
pop edi
pop ebx
ret
Function at 0x40421c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
je 0x404257
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0
jne 0x404260
mov byte [ebp - 0xd], 0
jmp 0x4042fe
mov eax, dword [ebp + 0xc]
mov ecx, esp
mov dword [ecx], eax
call fcn.0073bc28
cmp eax, 0
jne 0x40427a
mov byte [ebp - 0xd], 0
jmp 0x4042fe
lea eax, [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp - 0x28]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
call fcn.00404310
test al, 1
jne 0x4042a4
mov byte [ebp - 0xd], 0
jmp 0x4042fe
xor eax, eax
lea ecx, [ebp + 0x10]
lea edx, [ebp + 0x18]
mov esi, dword [ebp - 0x28]
mov edi, dword [esi]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, esp
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x34]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], esi
lea ecx, [ebp + 0x10]
mov dword [eax + 0xc], ecx
mov dword [eax + 4], ebx
mov dword [eax], edi
mov dword [eax + 8], 0
mov dword [ebp - 0x3c], edx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
cmp eax, 0
setne al
xor al, 0xff
and al, 1
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
and al, 1
movzx eax, al
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4043d8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
je 0x404413
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0
jne 0x40441c
mov byte [ebp - 0xd], 0
jmp 0x40449f
mov eax, dword [ebp + 0xc]
mov ecx, esp
mov dword [ecx], eax
call fcn.0073bc28
cmp eax, 0
jne 0x404433
mov byte [ebp - 0xd], 0
jmp 0x40449f
lea eax, [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp - 0x28]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
call fcn.004044b0
test al, 1
jne 0x40445d
mov byte [ebp - 0xd], 0
jmp 0x40449f
xor eax, eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, esp
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 0xc], edi
mov dword [eax + 4], esi
mov dword [eax], edx
mov dword [eax + 8], 0
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
cmp eax, 0
setne al
xor al, 0xff
and al, 1
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
and al, 1
movzx eax, al
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4061d4
Capabilities:
Extract resource via kernel32 functions
Read file via mapping
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, 0xa
mov edi, dword [ebp + 0xc]
mov ebx, esp
mov dword [ebx + 4], edi
mov dword [ebx + 8], 0xa
mov dword [ebx], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], esi
call sub.KERNEL32.DLL_FindResourceA
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40622b
mov dword [ebp - 0x10], 0
jmp 0x40640f
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], 0
mov dword [ebp - 0x40], eax
call sub.KERNEL32.DLL_LoadResource
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40625b
mov dword [ebp - 0x10], 0
jmp 0x40640f
mov eax, dword [ebp - 0x18]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_LockResource
sub esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40627f
mov dword [ebp - 0x10], 0
jmp 0x40640f
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], 0
mov dword [ebp - 0x44], eax
call sub.KERNEL32.DLL_SizeofResource
sub esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4062af
mov dword [ebp - 0x10], 0
jmp 0x40640f
mov eax, 0xc0000000
xor ecx, ecx
mov edx, 2
mov esi, 0x80
mov edi, dword [ebp + 8]
mov ebx, esp
mov dword [ebx], edi
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0x80
mov dword [ebx + 0x10], 2
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 0xc0000000
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], esi
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
xor ecx, ecx
mov edx, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov edi, esp
mov dword [edi + 0x10], esi
mov dword [edi], eax
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 4
mov dword [edi + 4], 0
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x5c], ecx
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40635b
mov dword [ebp - 0x10], 0
jmp 0x40640f
mov eax, 2
xor ecx, ecx
mov edx, dword [ebp - 0x28]
mov esi, esp
mov dword [esi], edx
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 2
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.0073b8f8
mov ecx, dword [ebp - 0x2c]
Function at 0x407088
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x164
mov eax, dword [ebp + 8]
mov ecx, 2
xor edx, edx
mov dword [esp], 2
mov dword [esp + 4], 0
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], edx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4070da
mov dword [ebp - 8], 0xffffffff
jmp 0x4071d3
lea eax, [ebp - 0x134]
xor ecx, ecx
mov edx, 0x128
mov esi, eax
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x128
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x14c], edx
call fcn.0073bac3
mov dword [ebp - 0x134], 0x128
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], eax
call sub.KERNEL32.DLL_Process32First
sub esp, 8
cmp eax, 0
je 0x4071b1
jmp 0x40713c
lea eax, [ebp - 0x134]
add eax, 0x24
mov ecx, dword [ebp - 0x138]
mov dword [esp], ecx
mov dword [ebp - 0x150], eax
call fcn.004071e0
mov ecx, dword [ebp - 0x150]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0073b7f5
cmp eax, 0
je 0x407190
mov eax, dword [ebp - 0xc]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x154], eax
jmp 0x4071d3
jmp 0x407192
lea eax, [ebp - 0x134]
mov ecx, dword [ebp - 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.KERNEL32.DLL_Process32Next
sub esp, 8
cmp eax, 0
jne 0x40713c
jmp 0x4071b1
cmp dword [ebp - 0xc], 0
je 0x4071cc
mov eax, dword [ebp - 0xc]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov dword [ebp - 0x158], eax
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 8]
add esp, 0x164
pop esi
pop ebp
ret
Function at 0x407294
Capabilities:
Enumerate threads
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 8]
mov ecx, 4
xor edx, edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x1c
mov dword [esp], 4
mov dword [esp + 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
sub esp, 8
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.KERNEL32.DLL_Thread32First
sub esp, 8
cmp eax, 0
je 0x40736b
jmp 0x4072f2
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
je 0x4072fc
jmp 0x40734f
mov eax, 0x1fffff
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov esi, esp
mov dword [esi + 8], edx
mov dword [esi + 4], 0
mov dword [esi], 0x1fffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.DLL_OpenThread
sub esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40734d
xor eax, eax
mov ecx, dword [ebp - 0x28]
mov edx, esp
mov dword [edx], ecx
mov dword [edx + 4], 0
mov dword [ebp - 0x40], eax
call sub.KERNEL32.DLL_TerminateThread
sub esp, 8
mov dword [ebp - 0x44], eax
jmp 0x40734f
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.KERNEL32.DLL_Thread32Next
sub esp, 8
cmp eax, 0
jne 0x4072f2
jmp 0x40736b
mov eax, 0xffffffff
cmp dword [ebp - 0x24], eax
je 0x407387
mov eax, dword [ebp - 0x24]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov dword [ebp - 0x48], eax
add esp, 0x54
pop esi
pop ebp
ret
Function at 0x40de9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
mov dword [ebp - 0xc], eax
call fcn.004071e0
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_GetFileAttributesA
sub esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40dece
mov byte [ebp - 1], 0
jmp 0x40dee3
mov eax, dword [ebp - 8]
and eax, 0x10
cmp eax, 0
je 0x40dedf
mov byte [ebp - 1], 1
jmp 0x40dee3
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
and al, 1
movzx eax, al
add esp, 0x18
pop ebp
ret 4

Function at 0x41636c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00419138
test esi, esi
jne 0x4163a2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004192d0
jmp 0x4163c0
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004162b0
mov edi, eax
test esi, esi
je 0x4163c0
cmp dword [ebx], 0
je 0x4163c0
dec esi
jmp 0x4163a9
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x417e54
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00418314
mov byte [esp], al
cmp byte [esp], 0
jne 0x417fdd
test edi, edi
je 0x417fdd
mov byte [esp + 1], 0
test ebp, ebp
jle 0x417f1d
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x417ef8
cmp edi, 0xffffffff
je 0x417eb9
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x417eb9
mov byte [esp], 0
jmp 0x417fdd
cmp dword [esi], 1
jg 0x417ef8
cmp dword [esi], 0
jne 0x417eea
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x417eea
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x417fdd
lea eax, [esp + 0xc]
call fcn.00417b08
dec ebp
test ebp, ebp
jg 0x417e9e
cmp edi, 0xffffffff
je 0x417f1d
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x417f1b
mov byte [esp], 0
jmp 0x417fdd
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x417e62
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x417f1d
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00418058
mov edx, eax
mov ebx, dword [0x7b01ec]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x417f81
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x417f7f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x417f81
xor edi, edi
cmp byte [esp], 0
je 0x417fa7
mov ebx, dword [esi]
test bl, 1
jne 0x417fbd
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x417f87
mov byte [esp + 1], 1
jmp 0x417fbd
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x417fa7
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x417f34
cmp byte [esp], 0
je 0x417fdd
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x418dd0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x7af94c], 0
je 0x418e37
cmp word [0x7afc38], 0xd7b2
jne 0x418df9
cmp dword [0x7afc40], 0
jbe 0x418df9
mov eax, 0x7afc34
call dword [0x7afc50]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x418e64
call fcn.00419aa8
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x79fab0], 0
jne 0x418e53
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x418ff8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x79fa74], 0
je 0x419023
mov edx, edi
mov eax, esi
call dword [0x79fa74]
mov ebx, eax
jmp 0x419034
mov eax, 8
call fcn.00415be4
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x7af94d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x418fc0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
test esi, esi
jne 0x419064
mov eax, ebx
call fcn.00415c00
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x41caf8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x41cc5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00419138
cmp si, word [0x7a0484]
jb 0x41cb90
cmp si, word [0x7a0684]
ja 0x41cb90
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x41cb90
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x7a0484]
jae 0x41cb6a
mov edi, ebx
dec edi
jmp 0x41cb8b
cmp si, word [ebx*8 + 0x7a0484]
jbe 0x41cb7a
inc ebx
mov dword [ebp - 8], ebx
jmp 0x41cb8b
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x7a0488]
call fcn.0041ca14
jmp 0x41cb90
cmp edi, dword [ebp - 8]
jae 0x41cb54
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x41cc3f
push 2
movzx eax, si
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x41cc3f
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00419e64
push dword [ebp - 0x160]
push 0x41cc7c
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00419e64
push dword [ebp - 0x164]
push 0x41cc8c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00419e64
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0041a09c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cc66
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00419198
pop eax
jmp eax
Function at 0x41ce14
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41cf1a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x7b2510
call sub.KERNEL32.DLL_EnterCriticalSection
cmp bx, word [0x7b2528]
jne 0x41ce60
mov eax, esi
mov edx, 0x7b252a
mov ecx, 0x55
call fcn.00419e64
push 0x7b2510
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x41cf02
push 0x7b2510
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
call fcn.00419138
push 2
movzx eax, bx
push eax
call sub.KERNEL32.DLL_IsValidLocale
test eax, eax
je 0x41cecf
cmp byte [0x7b250c], 0
je 0x41ce94
mov edx, esi
mov eax, ebx
call fcn.0041ccf8
jmp 0x41cecf
mov edx, esi
mov eax, ebx
call fcn.0041caf8
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
cmp bx, ax
je 0x41cecf
cmp dword [esi], 0
je 0x41ceb8
mov eax, esi
mov edx, 0x41cf34
call fcn.00419fbc
call sub.KERNEL32.DLL_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0041caf8
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00419fbc
push 0x7b2510
call sub.KERNEL32.DLL_EnterCriticalSection
mov word [0x7b2528], bx
mov eax, dword [esi]
call fcn.00419db0
mov ecx, eax
mov eax, 0x7b252a
mov edx, 0xaa
call fcn.0041c974
push 0x7b2510
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cf21
lea eax, [ebp - 4]
call fcn.00419138
pop eax
jmp eax
Function at 0x41d15c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041922c
xor eax, eax
push ebp
push 0x41d384
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x41d1a2
push 0x105
lea eax, [ebp - 0x21e]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
jmp 0x41d1bc
mov eax, dword [ebp - 4]
call fcn.00419db0
mov ecx, eax
lea eax, [ebp - 0x21e]
mov edx, 0x105
call fcn.0041c974
cmp word [ebp - 0x21e], 0
je 0x41d367
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x41d394
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x41d28b
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x41d394
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x41d28b
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x41d3d0
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x41d28b
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x41d3d0
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x41d28b
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x41d404
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x41d28b
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x41d438
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
jne 0x41d367
xor eax, eax
push ebp
push 0x41d360
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
lea eax, [ebp - 0x21e]
call fcn.0041cf5c
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x41d2ee
mov eax, dword [ebp - 0x14]
call fcn.00415be4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00419e10
jmp 0x41d339
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0x41d478
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x41d339
mov eax, dword [ebp - 0x14]
call fcn.00415be4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x41d478
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00419e10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d367
cmp dword [ebp - 0xc], 0
je 0x41d354
mov eax, dword [ebp - 0xc]
call fcn.00415c00
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d38b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00419198
pop eax
jmp eax