joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011a7
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405014
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x405040
push 0x405030
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
add esp, 0xc
push 0x40249c
push 0xb
call sub.CRTDLL.DLL_signal
add esp, 8
mov dword [0x405008], eax
mov dword [0x405008], 0x40249c
push dword [0x405040]
push dword [0x405030]
push dword [0x405020]
mov dword [0x40500c], esp
call fcn.004025bc
add esp, 0xc
mov dword [ebp - 4], 0
push eax
call sub.CRTDLL.DLL_exit
call sub.CRTDLL.DLL__cexit
call sub.KERNEL32.DLL_ExitProcess
pop edi
leave
ret

Function at 0x401356
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x10
call sub.USER32.DLL_GetSystemMetrics
mov edi, eax
push 0x11
call sub.USER32.DLL_GetSystemMetrics
mov esi, eax
push 0
push dword [0x403414]
push 0
push 0
push 0x64
push 0x12c
mov ecx, 2
cdq
idiv ecx
mov esi, eax
sub esi, 0x32
push esi
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub edi, 0x96
push edi
push 0x6ce0000
push 0x405678
push str.vgen_installWndClass
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [0x403b5c], eax
push 0
push dword [0x403414]
push 0
push dword [0x403b5c]
push 0x64
push 0xc8
push 0xa
push 0xa
push 0x50000000
push str._Componente:
push str.STATIC
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [0x403b60], eax
push 0x11
call sub.GDI32.DLL_GetStockObject
mov edi, eax
push 0
push edi
push 0x30
push dword [0x403b60]
call sub.USER32.DLL_SendMessageA
push 0
push dword [0x403414]
push 0
push dword [0x403b5c]
push 0x64
push 0xfa
push 0xa
push 0x5a
push 0x50000000
push str._BLADE_FACE
push str.STATIC
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [0x403740], eax
push 0x11
call sub.GDI32.DLL_GetStockObject
mov edi, eax
push 0
push edi
push 0x30
push dword [0x403740]
call sub.USER32.DLL_SendMessageA
push 0
push dword [0x403414]
push 0
push dword [0x403b5c]
push 0x64
push 0x12c
push 0x32
push 0x14
push 0x50000000
push 0x405655
push str.STATIC
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [section..bss], eax
push 0x11
call sub.GDI32.DLL_GetStockObject
mov edi, eax
push 0
push edi
push 0x30
push dword [section..bss]
call sub.USER32.DLL_SendMessageA
push 0x10
push 0x15c
push 0xa8
push 0
push str.SETUP.BMP
push 0
call sub.USER32.DLL_LoadImageA
mov dword [0x403b64], eax
push 0
push 0x401746
push dword [0x403b5c]
push 0x1f3
push dword [0x403414]
call sub.USER32.DLL_DialogBoxParamA
cmp eax, 0
jne 0x4014f1
push 0
call sub.CRTDLL.DLL_exit
add esp, 4
push 5
push dword [0x403b5c]
call sub.USER32.DLL_ShowWindow
mov eax, dword [0x403b5c]
pop edi
pop esi
ret
Function at 0x401596
Capabilities:
Get common file path
Get disk size
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push esi
push edi
mov dword [ebp - 0x414], 0
mov byte [ebp - 5], 0x78
mov dword [ebp - 0xc], 0x400
call fcn.0040223e
push 0x403b70
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea edi, [ebp - 0x418]
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40165e
call sub.CRTDLL.DLL_abort
jmp 0x40165e
mov byte [ebp - 5], 0xfe
mov dword [ebp - 0xc], 0x400
lea edi, [ebp - 5]
push edi
push 0x403010
push 0
push 0
lea edi, [ebp - 0xc]
push edi
lea edi, [ebp - 0x410]
push edi
mov edi, dword [ebp - 0x414]
mov esi, edi
add esi, 1
mov dword [ebp - 0x414], esi
push edi
push dword [ebp - 0x418]
call sub.ADVAPI32.DLL_RegEnumValueA
mov dword [ebp - 4], eax
push str.Desktop
lea edi, [ebp - 0x410]
push edi
call sub.CRTDLL.DLL__stricmp
add esp, 8
cmp eax, 0
je 0x401664
push str.C:WINDOWSESCRITORIO
push 0x403010
call sub.CRTDLL.DLL_sprintf
add esp, 8
cmp dword [ebp - 4], 0
je 0x4015f0
push dword [ebp - 0x418]
call sub.ADVAPI32.DLL_RegCloseKey
push str.C:GEN
push 0x403750
call sub.CRTDLL.DLL_sprintf
add esp, 8
push str.C:WINESCRITORIOMASTER_VGEN
push 0x403b70
call sub.CRTDLL.DLL_sprintf
add esp, 8
fldz
fcomp dword [0x405068]
fnstsw ax
sahf
jne 0x401704
lea edi, [ebp - 0x444]
push edi
lea edi, [ebp - 0x440]
push edi
lea edi, [ebp - 0x43c]
push edi
lea edi, [ebp - 0x438]
push edi
push 0x40557f
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov eax, dword [ebp - 0x438]
mul dword [ebp - 0x43c]
mov dword [ebp - 0x448], eax
mov edi, dword [ebp - 0x448]
mov eax, edi
mul dword [ebp - 0x440]
mov dword [ebp - 0x44c], eax
mov edi, dword [ebp - 0x44c]
shr edi, 0x14
push 0
push edi
fild qword [esp]
add esp, 8
fstp dword [0x405068]
mov edi, dword [ebp + 8]
mov dword [0x403414], edi
call fcn.00401244
cmp eax, 0
jne 0x40171b
xor eax, eax
jmp 0x401740
call fcn.00401356
mov dword [0x403b54], eax
cmp eax, 0
jne 0x40172e
xor eax, eax
jmp 0x401740
call fcn.004019dd
push 0
call sub.USER32.DLL_PostQuitMessage
mov eax, dword [ebp - 0x42c]
pop edi
pop esi
leave
ret 0x10
Function at 0x401ece
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
push ebx
push edi
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_SetCurrentDirectoryA
cmp eax, 0
jne 0x401ef0
push 0
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateDirectoryA
call fcn.00402208
push dword [ebp + 8]
push str._s.
lea edi, [ebp - 0x86e]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea edi, [ebp - 0x140]
push edi
lea edi, [ebp - 0x86e]
push edi
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x144], eax
push dword [ebp + 0xc]
push str.Copiando__s
lea edi, [ebp - 0x768]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea edi, [ebp - 0x768]
push edi
push 0
push 0xc
push dword [section..bss]
call sub.USER32.DLL_SendMessageA
mov edi, dword [ebp - 0x140]
cmp edi, 0x20
je 0x401f78
cmp edi, 0x20
jne 0x401f69
mov ebx, 1
jmp 0x401f6e
mov ebx, 0
mov edi, ebx
or edi, 2
cmp edi, 0
je 0x401fd3
lea edi, [ebp - 0x114]
push edi
push dword [ebp + 8]
push str._s_s
lea edi, [ebp - 0x24a]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
lea edi, [ebp - 0x114]
push edi
push dword [ebp + 0xc]
push str._s_s
lea edi, [ebp - 0x350]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call fcn.00402208
push 1
lea edi, [ebp - 0x350]
push edi
lea edi, [ebp - 0x24a]
push edi
call sub.KERNEL32.DLL_CopyFileA
call fcn.00402208
cmp dword [ebp - 0x140], 0x10
jne 0x402070
cmp byte [ebp - 0x114], 0x2e
je 0x402070
call fcn.00402208
lea edi, [ebp - 0x114]
push edi
push dword [ebp + 8]
push str._s_s
lea edi, [ebp - 0x456]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
lea edi, [ebp - 0x114]
push edi
push dword [ebp + 0xc]
push str._s_s
lea edi, [ebp - 0x55c]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
lea edi, [ebp - 0x55c]
push edi
lea edi, [ebp - 0x456]
push edi
push str._s_na_n_s
lea edi, [ebp - 0x768]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call fcn.00402208
lea edi, [ebp - 0x55c]
push edi
lea edi, [ebp - 0x456]
push edi
call fcn.00401ece
add esp, 8
call fcn.00402208
lea edi, [ebp - 0x140]
push edi
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindNextFileA
cmp eax, 0
jne 0x401f52
push dword [ebp - 0x144]
call sub.KERNEL32.DLL_FindClose
pop edi
pop ebx
leave
ret
Function at 0x40209a
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push edi
call fcn.00402208
push dword [ebp + 8]
push str._s.
lea edi, [ebp - 0x458]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea edi, [ebp - 0x140]
push edi
lea edi, [ebp - 0x458]
push edi
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x24c], eax
lea edi, [ebp - 0x664]
push edi
push 0
push 0xc
push dword [section..bss]
call sub.USER32.DLL_SendMessageA
mov edi, dword [ebp - 0x140]
cmp edi, 0x20
je 0x402143
cmp edi, 0x20
jne 0x402107
mov ebx, 1
jmp 0x40210c
mov ebx, 0
mov edi, ebx
or edi, 2
cmp edi, 0
jne 0x402143
cmp dword [ebp - 0x140], 0x20
jne 0x40212b
mov dword [ebp - 0x668], 1
jmp 0x402135
mov dword [ebp - 0x668], 0
mov edi, dword [ebp - 0x668]
or edi, 1
cmp edi, 0
je 0x402188
lea edi, [ebp - 0x114]
push edi
push dword [ebp + 8]
push str._s_s
lea edi, [ebp - 0x246]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call fcn.00402208
push pe_nt_image_headers32
lea edi, [ebp - 0x246]
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
lea edi, [ebp - 0x246]
push edi
call sub.KERNEL32.DLL_DeleteFileA
call fcn.00402208
cmp dword [ebp - 0x140], 0x10
jne 0x4021d6
cmp byte [ebp - 0x114], 0x2e
je 0x4021d6
call fcn.00402208
lea edi, [ebp - 0x114]
push edi
push dword [ebp + 8]
push str._s_s
lea edi, [ebp - 0x352]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call fcn.00402208
lea edi, [ebp - 0x352]
push edi
call fcn.0040209a
add esp, 4
call fcn.00402208
lea edi, [ebp - 0x140]
push edi
push dword [ebp - 0x24c]
call sub.KERNEL32.DLL_FindNextFileA
cmp eax, 0
jne 0x4020f0
push dword [ebp - 0x24c]
call sub.KERNEL32.DLL_FindClose
push dword [ebp + 8]
call sub.KERNEL32.DLL_RemoveDirectoryA
pop edi
pop ebx
leave
ret
Function at 0x40223e
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push 0x28
push 0
lea edi, [ebp - 0x28]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov dword [ebp - 0x28], 3
lea edi, [0x40240c]
mov dword [ebp - 0x24], edi
mov edi, dword [0x403414]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], 5
lea edi, str.vgen_installWndClass
mov dword [ebp - 4], edi
mov dword [ebp - 8], 0
push 0x7f00
push 0
call sub.USER32.DLL_LoadCursorA
mov dword [ebp - 0x10], eax
push 0x7f00
push 0
call sub.USER32.DLL_LoadIconA
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x28]
push edi
call sub.USER32.DLL_RegisterClassA
or ax, ax
je 0x402408
push 0x134
push str.Desinstalador_de_Visual_GEN_v1.5
push str.Esta_aplicaci
push dword [0x403b5c]
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 7
jne 0x4022e3
push 0
call sub.CRTDLL.DLL_exit
add esp, 4
push 0x114
push str.Desinstalador_de_Visual_GEN_v1.5
push str.Los_juegos_creados_tambi
push dword [0x403b5c]
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 7
jne 0x402310
push 0
call sub.CRTDLL.DLL_exit
add esp, 4
push 0x10
call sub.USER32.DLL_GetSystemMetrics
mov edi, eax
push 0x11
call sub.USER32.DLL_GetSystemMetrics
mov esi, eax
push 0
push dword [0x403414]
push 0
push 0
push 0x50
push 0x12c
mov ecx, 2
cdq
idiv ecx
mov esi, eax
sub esi, 0x32
push esi
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub edi, 0x96
push edi
push 0x6c40000
push 0x40514a
push str.vgen_installWndClass
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [0x403b5c], eax
push 0
push dword [0x403414]
push 0
push dword [0x403b5c]
push 0x64
push 0xc8
push 0xa
push 0xa
push 0x50000000
push str._Eliminando_directorio_C:GEN_...
push str.STATIC
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [0x403b60], eax
push 0x11
call sub.GDI32.DLL_GetStockObject
mov edi, eax
push 0
push edi
push 0x30
push dword [0x403b60]
call sub.USER32.DLL_SendMessageA
push 5
push dword [0x403b5c]
call sub.USER32.DLL_ShowWindow
push str.C:GEN
call fcn.0040209a
add esp, 4
push str.C:GEN
call fcn.0040209a
add esp, 4
push 0x30
push 0x405070
push str.Los_siguientes_elementos_no_han_sido_eliminados_de_su_disco_duro:_n_n_Directorio_C:GEN_n_Carpeta_Visual_GEN_v1.5_en_el_escritorio_n_nPuede_eliminarlos_manualmente.
push dword [0x403b5c]
call sub.USER32.DLL_MessageBoxA
push 0
call sub.CRTDLL.DLL_exit
add esp, 4
pop edi
pop esi
leave
ret
Function at 0x407724
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409da8
test esi, esi
jne 0x40775a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409f40
jmp 0x407778
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407668
mov edi, eax
test esi, esi
je 0x407778
cmp dword [ebx], 0
je 0x407778
dec esi
jmp 0x407761
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4089f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408eb0
mov byte [esp], al
cmp byte [esp], 0
jne 0x408b79
test edi, edi
je 0x408b79
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408ab9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408a94
cmp edi, 0xffffffff
je 0x408a55
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408a55
mov byte [esp], 0
jmp 0x408b79
cmp dword [esi], 1
jg 0x408a94
cmp dword [esi], 0
jne 0x408a86
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408a86
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408b79
lea eax, [esp + 0xc]
call fcn.004086c8
dec ebp
test ebp, ebp
jg 0x408a3a
cmp edi, 0xffffffff
je 0x408ab9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408ab7
mov byte [esp], 0
jmp 0x408b79
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4089fe
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408ab9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408bf4
mov edx, eax
mov ebx, dword [0x6b98fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408b1d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408b1b
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408b1d
xor edi, edi
cmp byte [esp], 0
je 0x408b43
mov ebx, dword [esi]
test bl, 1
jne 0x408b59
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408b23
mov byte [esp + 1], 1
jmp 0x408b59
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408b43
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408ad0
cmp byte [esp], 0
je 0x408b79
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409a40
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x6b905c], 0
je 0x409aa7
cmp word [0x6b9348], 0xd7b2
jne 0x409a69
cmp dword [0x6b9350], 0
jbe 0x409a69
mov eax, 0x6b9344
call dword [0x6b9360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409ad4
call fcn.0040a704
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x6af036], 0
jne 0x409ac3
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x409c68
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x6af038], 0
je 0x409c93
mov edx, edi
mov eax, esi
call dword [0x6af038]
mov ebx, eax
jmp 0x409ca4
mov eax, 8
call fcn.00406ff0
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x6b905d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409c30
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409cd4
mov eax, ebx
call fcn.0040700c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40da04
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40db6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409da8
cmp si, word [0x6afa18]
jb 0x40da9c
cmp si, word [0x6afc18]
ja 0x40da9c
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40da9c
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x6afa18]
jae 0x40da76
mov edi, ebx
dec edi
jmp 0x40da97
cmp si, word [ebx*8 + 0x6afa18]
jbe 0x40da86
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40da97
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x6afa1c]
call fcn.0040d920
jmp 0x40da9c
cmp edi, dword [ebp - 8]
jae 0x40da60
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40db4b
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40db4b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040aa64
push dword [ebp - 0x160]
push 0x40db88
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040aa64
push dword [ebp - 0x164]
push 0x40db98
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040aa64
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040ac9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40db72
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409e08
pop eax
jmp eax
Function at 0x40dd20
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40de26
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6bbc18
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x6bbc30]
jne 0x40dd6c
mov eax, esi
mov edx, 0x6bbc32
mov ecx, 0x55
call fcn.0040aa64
push 0x6bbc18
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40de0e
push 0x6bbc18
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00409da8
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40dddb
cmp byte [0x6bbc14], 0
je 0x40dda0
mov edx, esi
mov eax, ebx
call fcn.0040dc04
jmp 0x40dddb
mov edx, esi
mov eax, ebx
call fcn.0040da04
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40dddb
cmp dword [esi], 0
je 0x40ddc4
mov eax, esi
mov edx, 0x40de40
call fcn.0040abbc
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040da04
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040abbc
push 0x6bbc18
call sub.kernel32.dll_EnterCriticalSection
mov word [0x6bbc30], bx
mov eax, dword [esi]
call fcn.0040a9b0
mov ecx, eax
mov eax, 0x6bbc32
mov edx, 0xaa
call fcn.0040d880
push 0x6bbc18
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de2d
lea eax, [ebp - 4]
call fcn.00409da8
pop eax
jmp eax
Function at 0x40e068
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409e9c
xor eax, eax
push ebp
push 0x40e290
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40e0ae
push 0x105
lea eax, [ebp - 0x21e]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40e0c8
mov eax, dword [ebp - 4]
call fcn.0040a9b0
mov ecx, eax
lea eax, [ebp - 0x21e]
mov edx, 0x105
call fcn.0040d880
cmp word [ebp - 0x21e], 0
je 0x40e273
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40e2a0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e197
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40e2a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e197
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40e2dc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e197
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40e2dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e197
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40e310
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40e197
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x40e344
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40e273
xor eax, eax
push ebp
push 0x40e26c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
lea eax, [ebp - 0x21e]
call fcn.0040de68
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40e1fa
mov eax, dword [ebp - 0x14]
call fcn.00406ff0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040aa10
jmp 0x40e245
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0x40e384
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40e245
mov eax, dword [ebp - 0x14]
call fcn.00406ff0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x40e384
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.0040aa10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e273
cmp dword [ebp - 0xc], 0
je 0x40e260
mov eax, dword [ebp - 0xc]
call fcn.0040700c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e297
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409e08
pop eax
jmp eax