joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4830b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405e74
xor eax, eax
push ebp
push 0x48332b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x94]
call fcn.00405f10
mov edi, dword [ebp - 0x414]
push 0
push 0x48333c
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x483344
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x4832f8
mov eax, dword [0x486594]
mov eax, dword [eax]
sub eax, 6
je 0x483149
dec eax
je 0x48317e
jmp 0x4832f8
push 0
push 0x483354
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x483364
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x483370
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
jmp 0x4831eb
push 0
push 0x483378
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x483354
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x483364
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x483370
push 0
push edi
call sub.user32.dll_FindWindowExA
mov edi, eax
jmp 0x4831eb
push 0x400
lea eax, [ebp - 0x40d]
push eax
push edi
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x418]
lea eax, [ebp - 0x40d]
call fcn.004095dc
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 8]
call fcn.00408544
mov eax, dword [0x486594]
cmp dword [eax], 6
jne 0x483287
cmp dword [esi + 0x98], 0
je 0x483241
mov eax, 0x48633c
mov edx, dword [esi + 0x98]
call fcn.0040435c
jmp 0x483251
mov eax, 0x48633c
mov edx, dword [esi + 0x9c]
call fcn.0040435c
call fcn.00406624
cmp dword [eax + 0x10], 0
jne 0x4832f8
test edi, edi
jbe 0x4832f8
push 0x482f00
push 0xfffffffffffffffc
push edi
call sub.user32.dll_SetWindowLongA
mov esi, eax
call fcn.00406624
mov dword [eax + 0x10], esi
jmp 0x4832f8
test edi, edi
je 0x4832f8
lea ecx, [ebp - 0xd]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00479058
test al, al
je 0x4832f8
cmp dword [esi + 0x9c], 0
je 0x4832f8
cmp dword [ebp - 0xc], 0
je 0x4832f8
mov dl, byte [ebp - 0xd]
mov eax, dword [ebp - 0xc]
call fcn.00479340
test al, al
je 0x4832f8
mov al, byte [0x48338c]
push eax
lea eax, [ebp - 0x41c]
push eax
mov ecx, dword [esi + 0x9c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040db18
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 8]
call fcn.004043a0
mov eax, dword [ebp - 8]
call fcn.004047c8
push eax
push edi
call sub.user32.dll_SetWindowTextA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483332
lea eax, [ebp - 0x41c]
mov edx, 2
call fcn.0040432c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040432c
lea eax, [ebp - 4]
call fcn.00405e00
ret
Function at 0x483e48
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x483ebb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0xff]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0xff]
call fcn.004095dc
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.0046af8c
mov edx, dword [ebp - 0x104]
mov eax, ebx
call fcn.0040435c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483ec2
lea eax, [ebp - 0x104]
call fcn.00404308
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402c00
pop dword [ebp - 0x40]
mov eax, 0x676457e9
sub eax, 0x67242be9
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xa50f8d84
sub dword [ebp - 0x50], 0x56bd4839
mov dword [ebp - 0x4c], 0xd56d4c1f
sub dword [ebp - 0x4c], 0xa339ffda
mov dword [ebp - 0x48], 0x93d88d23
add dword [ebp - 0x48], 0xb873b70b
mov dword [ebp - 0x44], 0x19d819ee
sub dword [ebp - 0x44], 0x19d819ee
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf9384637
add dword [ebp - 0x50], 0x7b3a231f
mov dword [ebp - 0x4c], 0xca3fa229
add dword [ebp - 0x4c], 0x772cbf4c
mov dword [ebp - 0x48], 0x1aa2509d
add dword [ebp - 0x48], 0x48cd1bcf
mov dword [ebp - 0x44], 0x85ec6a2a
add dword [ebp - 0x44], 0x7a1395d6
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3bfba
push 0
call eax
mov ecx, 0xd80aee7a
sub ecx, 0xd80a914d
xor edi, edi
add edi, eax
mov edx, 0x411000
add edx, dword [ebp - 0x40]
mov esi, 0xe7ad6557
sub esi, 0x2999d1ee
sub dword [ebp - 0x10], esi
mov ebx, dword [edx]
add ebx, esi
xor dword [ebp - 0x20], esi
mov dword [edi], ebx
xor dword [ebp - 0x28], 0x65d791d0
add edi, 0x19ddc6e7
add edi, 0xe622391d
add edx, 0x1971711c
sub edx, 0x19717118
loop 0x402d14
add eax, 0x91df09c1
add eax, 0x6e225dc6
xor ebx, ebx
add ebx, eax
add eax, 0xaca4c9bb
add eax, 0x535b364a
mov ecx, 0x325c73d
add ecx, 0xfd1a38c3
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x309d7391
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x50508f0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0xa3f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa3f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa3f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa3f06a
add dl, dl
jne 0xa3f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa3f0dc
xor eax, eax
add dl, dl
jne 0xa3f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa3f17d
add dl, dl
jne 0xa3f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa3f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa3f075
mov eax, 1
add dl, dl
jne 0xa3f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa3f0e1
sub eax, ebx
mov ebx, 1
jne 0xa3f128
mov ecx, 1
add dl, dl
jne 0xa3f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa3f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa3f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa3f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa3f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa3f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa3f136
cmp eax, 0x7d00
jae 0xa3f16d
cmp eax, 0x500
jb 0xa3f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa3f075
cmp eax, 0x7f
ja 0xa3f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa3f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa3f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa3f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x8f6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008f61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8f607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f606a
add dl, dl
jne 0x8f6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f60dc
xor eax, eax
add dl, dl
jne 0x8f6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f617d
add dl, dl
jne 0x8f60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8f60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8f6075
mov eax, 1
add dl, dl
jne 0x8f60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f60e1
sub eax, ebx
mov ebx, 1
jne 0x8f6128
mov ecx, 1
add dl, dl
jne 0x8f610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8f6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8f613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8f614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f6136
cmp eax, 0x7d00
jae 0x8f616d
cmp eax, 0x500
jb 0x8f6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f6075
cmp eax, 0x7f
ja 0x8f6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8f619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8f6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x696809cb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x573360fb
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4047fc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406518
test esi, esi
jne 0x404832
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406670
jmp 0x404850
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004046e0
mov edi, eax
test esi, esi
je 0x404850
cmp dword [ebx], 0
je 0x404850
dec esi
jmp 0x404839
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405550
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405800
mov byte [esp], al
cmp byte [esp], 0
jne 0x4056dc
test edi, edi
je 0x4056dc
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405613
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x4055ee
cmp edi, 0xffffffff
je 0x4055af
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4055af
mov byte [esp], 0
jmp 0x4056dc
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4055ee
test ebx, ebx
jne 0x4055e4
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.004026e0
test eax, eax
jne 0x4055e4
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4056dc
call 0x405844
dec ebp
test ebp, ebp
jg 0x405594
cmp edi, 0xffffffff
je 0x405613
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405611
mov byte [esp], 0
jmp 0x4056dc
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40555e
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.004026e0
cmp ebx, eax
jne 0x405613
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040574c
mov edx, eax
mov ebx, dword [0x44b8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x40567a
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405678
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x40567a
xor edi, edi
cmp byte [esp], 0
je 0x4056a3
mov ebx, dword [esi]
test bl, 1
jne 0x4056bc
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.004026e0
cmp ebx, eax
jne 0x405680
mov byte [esp + 1], 1
jmp 0x4056bc
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.004026e0
cmp ebx, eax
jne 0x4056a3
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x40562d
cmp byte [esp], 0
je 0x4056dc
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406244
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x44b058], 0
je 0x4062ab
cmp word [0x44b344], 0xd7b2
jne 0x40626d
cmp dword [0x44b34c], 0
jbe 0x40626d
mov eax, 0x44b340
call dword [0x44b35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x4062d8
call fcn.00406c60
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x44802e], 0
jne 0x4062c7
push 0
push 0x4489ba
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4084b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408619
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406518
cmp si, word [0x4489f8]
jb 0x40854c
cmp si, word [0x448bf8]
ja 0x40854c
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40854c
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4489f8]
jae 0x408526
mov edi, ebx
dec edi
jmp 0x408547
cmp si, word [ebx*8 + 0x4489f8]
jbe 0x408536
inc ebx
mov dword [ebp - 8], ebx
jmp 0x408547
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4489fc]
call fcn.004083c4
jmp 0x40854c
cmp edi, dword [ebp - 8]
jae 0x408510
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4085fb
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4085fb
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00406fd4
push dword [ebp - 0x160]
push 0x408634
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00406fd4
push dword [ebp - 0x164]
push 0x408644
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00406fd4
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040720c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408620
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00406578
ret
Function at 0x4087cc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4088cf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44db88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x44dba0]
jne 0x408818
mov eax, esi
mov edx, 0x44dba2
mov ecx, 0x55
call fcn.00406fd4
push 0x44db88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4088b9
push 0x44db88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406518
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408887
cmp byte [0x44db84], 0
je 0x40884c
mov edx, esi
mov eax, ebx
call fcn.004086b0
jmp 0x408887
mov edx, esi
mov eax, ebx
call fcn.004084b4
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408887
cmp dword [esi], 0
je 0x408870
mov eax, esi
mov edx, 0x4088e8
call fcn.0040712c
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.004084b4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040712c
push 0x44db88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x44dba0], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406f40
push eax
push 0x44dba2
call sub.kernel32.dll_lstrcpynW
push 0x44db88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4088d6
lea eax, [ebp - 4]
call fcn.00406518
ret
Function at 0x408b04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004065fc
xor eax, eax
push ebp
push 0x408d29
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408b44
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x408b5e
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406f40
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x408d13
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408d38
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408c2d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408d38
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408c2d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408d74
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408c2d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408d74
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408c2d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408da8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408c2d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408ddc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x408d13
xor eax, eax
push ebp
push 0x408d0c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408910
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408c9c
mov eax, dword [ebp - 0x10]
call fcn.0040443c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406f98
jmp 0x408ce7
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x408e1c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408ce7
mov eax, dword [ebp - 0x10]
call fcn.0040443c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x408e1c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d13
cmp dword [ebp - 8], 0
je 0x408d02
mov eax, dword [ebp - 8]
call fcn.00404458
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408d30
lea eax, [ebp - 4]
call fcn.00406518
ret