joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67166960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6722b791
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x67463180]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], 1
push eax
lea ecx, [esp + 0x18]
call sym.Qt5Core.dll_public:_void___thiscall_QDebugStateSaver::constructor_class_QDebug__
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x24], 2
call sym.Qt5Core.dll_public:_class_QString___thiscall_QUuid::toString_void_
mov esi, eax
mov ecx, dword [esp + 0x2c]
push str.QUuid_
mov byte [esp + 0x24], 3
mov byte [ecx + 0x14], 0
lea ecx, [esp + 0x30]
call sym.Qt5Core.dll_public:_class_QDebug____thiscall_QDebug::operator___char_const__
mov edx, dword [esi]
mov edi, eax
mov ecx, dword [edx + 0xc]
push dword [edx + 4]
add ecx, edx
push ecx
mov ecx, edi
call sym.Qt5Core.dll_private:_void___thiscall_QDebug::putString_class_QChar_const___unsigned_int_
mov ecx, dword [edi]
cmp byte [ecx + 0x14], 0
je 0x671669f6
push 0x20
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [edi]
push 0x29
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [edi]
cmp byte [ecx + 0x14], 0
je 0x67166a0e
push 0x20
call sym.Qt5Core.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x67166a2f
cmp ecx, 0xffffffff
je 0x67166a3c
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x67166a3c
mov eax, dword [esp + 0xc]
push 4
push 2
push eax
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData___unsigned_int__unsigned_int_
add esp, 0xc
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esi], ecx
inc dword [ecx + 0xc]
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 1
mov byte [esp + 0x20], 1
call sym.Qt5Core.dll_public:_void___thiscall_QDebugStateSaver::destructor_void_
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call sym.Qt5Core.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x671f13c0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jne 0x671f1447
mov eax, dword [esp + 0xc]
cmp eax, 5
ja case.default.0x671f13d5
jmp dword [eax*4 + 0x671f1474]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.Qt5Core.dll_struct_QMetaObject_const_QThread::staticMetaObject
jmp sym.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], sym.Qt5Core.dll_struct_QMetaObject_const_QThread::staticMetaObject
jmp sym.Qt5Core.dll_public:_static_void___cdecl_QMetaObject::activate_class_QObject___struct_QMetaObject_const___int__void___
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov eax, dword [eax + 4]
push dword [eax]
call sym.Qt5Core.dll_public:_void___thiscall_QThread::start_enum_QThread::Priority_
ret
mov ecx, dword [esp + 4]
push 7
call sym.Qt5Core.dll_public:_void___thiscall_QThread::start_enum_QThread::Priority_
ret
mov ecx, dword [esp + 4]
jmp sym.Qt5Core.dll_public:_void___thiscall_QThread::terminate_void_
mov ecx, dword [esp + 4]
jmp sym.Qt5Core.dll_public:_void___thiscall_QThread::quit_void_
cmp eax, 0xa
jne case.default.0x671f13d5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov eax, dword [eax]
cmp eax, sym.Qt5Core.dll_public:_void___thiscall_QThread::started_struct_QThread::QPrivateSignal_
jne 0x671f1465
mov dword [ecx], 0
ret
cmp eax, sym.Qt5Core.dll_public:_void___thiscall_QThread::finished_struct_QThread::QPrivateSignal_
jne case.default.0x671f13d5
mov dword [ecx], 1
ret
Function at 0x67225d70
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x67467938]
test eax, eax
jne 0x67225d8a
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x67467938], eax
jmp 0x67225d93
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
add eax, 0xfffffff8
mov ecx, eax
push esi
push edi
sub ecx, dword [eax + 4]
mov edi, dword [0x6746794c]
mov edx, dword [eax]
sub edi, edx
mov dword [0x6746794c], edi
cmp dword [ecx], 0
jne 0x67225dc4
add dword [ecx + 0x10], edx
lea esi, [ecx + 0x10]
mov eax, dword [esi]
mov dword [eax + ecx + 4], eax
jmp 0x67225ded
lea esi, [eax + 0x10]
mov ecx, eax
mov dword [esi], edx
mov edx, dword [0x67467948]
mov dword [eax], 0
mov dword [eax + 8], edx
mov dword [eax + 0xc], 0
test edx, edx
je 0x67225de8
mov dword [edx + 0xc], eax
mov dword [0x67467948], eax
push ebx
mov ebx, dword [esi]
cmp dword [ebx + ecx], 0
lea edx, [ebx + ecx]
jne 0x67225e2a
mov eax, dword [edx + 0x10]
add eax, ebx
mov dword [esi], eax
mov ebx, dword [edx + 8]
test ebx, ebx
je 0x67225e0d
mov eax, dword [edx + 0xc]
mov dword [ebx + 0xc], eax
mov ebx, dword [edx + 0xc]
mov eax, dword [edx + 8]
test ebx, ebx
je 0x67225e1c
mov dword [ebx + 8], eax
jmp 0x67225e21
mov dword [0x67467948], eax
mov eax, dword [esi]
mov dword [eax + ecx + 4], eax
lea edx, [eax + ecx]
cmp dword [ecx + 4], 0
pop ebx
jne 0x67225e7c
cmp dword [edx], 1
jne 0x67225e7c
mov edx, dword [0x67467950]
lea eax, [edi + edi*2]
sub edx, dword [esi]
shr eax, 1
cmp edx, eax
jbe 0x67225e7c
mov dword [0x67467950], edx
mov edx, dword [ecx + 8]
test edx, edx
je 0x67225e5a
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx + 8]
test edx, edx
je 0x67225e69
mov dword [edx + 8], eax
jmp 0x67225e6e
mov dword [0x67467948], eax
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [0x67467938]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
ret
Function at 0x1001962
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1028
call sub.ntdll.dll__chkstk
or dword [ebp - 4], 0xffffffff
or dword [ebp - 8], 0xffffffff
push esi
push edi
push 1
push 1
push 0x80000000
mov esi, 0x80
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.010018f4
mov edi, eax
test edi, edi
jl 0x1001a18
push 5
push 0
push 0x40000000
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
call fcn.010018f4
mov edi, eax
test edi, edi
jl 0x1001a18
push 5
push 0x18
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call sub.ntdll.dll_NtQueryInformationFile
mov edi, eax
test edi, edi
jl 0x1001a18
mov esi, dword [ebp - 0x20]
test esi, esi
jbe 0x1001a18
lea eax, [ebp + 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x1028]
push eax
push dword [ebp - 4]
call fcn.0100189c
mov edi, eax
test edi, edi
jl 0x1001a18
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x1028]
push eax
push dword [ebp - 8]
call fcn.0100183f
mov edi, eax
test edi, edi
jl 0x1001a18
sub esi, dword [ebp + 0xc]
jne 0x10019d9
cmp dword [ebp - 4], 0xffffffff
je 0x1001a26
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
cmp dword [ebp - 8], 0xffffffff
je 0x1001a34
push dword [ebp - 8]
call sub.ntdll.dll_NtClose
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x1001a41
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x1001a55
mov eax, 0xc000000d
jmp 0x1001a6e
cmp dword [ebp + 0xc], 0
je 0x1001a4e
push 4
push 0x28
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.ntdll.dll_NtQueryInformationFile
leave
ret 8

Function at 0x1001a77
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x1001a8b
mov eax, 0xc000000d
jmp 0x1001aa4
cmp dword [ebp + 0xc], 0
je 0x1001a84
push 4
push 0x28
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.ntdll.dll_NtSetInformationFile
leave
ret 8

Function at 0x1001aad
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 8], 0
je 0x1001ae3
cmp dword [ebp + 8], 0xffffffff
je 0x1001ae3
push 5
push 0x18
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
jl 0x1001ae8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
jmp 0x1001ae8
mov eax, 0xc0000008
leave
ret 8
Function at 0x1001af1
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
cmp dword [ebp + 8], 0
push esi
mov byte [ebp - 1], 1
je 0x1001be6
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1001be6
or dword [esi], 0xffffffff
push 1
push 1
push 0x80000000
push 0x80
push dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call fcn.010018f4
test eax, eax
jl 0x1001beb
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
call fcn.01001aad
mov ebx, eax
test ebx, ebx
jge 0x1001b54
mov byte [ebp - 1], 0
jmp 0x1001bcb
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1001b81
and dword [ebp - 8], 0
push 0xe
push 8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0xc], edi
call dword [sym.imp.ntdll.dll_ZwSetInformationFile]
mov ebx, eax
test ebx, ebx
jl 0x1001bc6
sub dword [ebp + 8], edi
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], eax
jbe 0x1001bca
lea eax, [ebp + 0xc]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0x10]
call fcn.0100189c
mov ebx, eax
test ebx, ebx
jl 0x1001bc3
mov edi, dword [ebp + 0xc]
push edi
push dword [esi]
lea eax, [ebp - 0x414]
push eax
call fcn.010025fb
sub dword [ebp + 8], edi
mov dword [esi], eax
jne 0x1001b8a
jmp 0x1001bca
or dword [esi], 0xffffffff
mov byte [ebp - 1], 0
pop edi
cmp dword [ebp + 0x10], 0xffffffff
je 0x1001bd9
push dword [ebp + 0x10]
call sub.ntdll.dll_NtClose
cmp byte [ebp - 1], 0
je 0x1001be1
xor ebx, ebx
mov eax, ebx
pop ebx
jmp 0x1001beb
mov eax, 0xc000000d
pop esi
leave
ret 0xc

Function at 0x1001bf5
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
or dword [ebp - 4], 0xffffffff
xor eax, eax
cmp dword [ebp + 8], eax
jne 0x1001c12
mov eax, 0xc000000d
jmp 0x1001c94
mov ecx, dword [ebp + 0xc]
cmp ecx, eax
je 0x1001c08
push eax
push eax
push 0x4060
push 1
push 1
push eax
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x100180
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x1c], ecx
call sub.ntdll.dll_NtCreateFile
test eax, eax
jl 0x1001c83
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 4]
call fcn.01001a41
test eax, eax
jl 0x1001c83
test byte [ebp - 0x2c], 1
je 0x1001c83
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x2c], 0x80
call fcn.01001a77
push dword [ebp - 4]
call sub.ntdll.dll_NtClose
lea eax, [ebp - 0x24]
push eax
call sub.ntdll.dll_NtDeleteFile
leave
ret 8

Function at 0x1001d44
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x1001d6d
cmp dword [ebp + 8], 0
je 0x1001d6d
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ntdll.dll_NtQueryValueKey
jmp 0x1001d72
mov eax, 0xc000000d
pop ebp
ret 0x14
Function at 0x1002a88
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x145c
call sub.ntdll.dll__chkstk
lea eax, [ebp - 0x145c]
push eax
call fcn.01001e59
test al, al
je 0x1002b0e
push 0x10017a0
push 5
lea eax, [ebp - 0x145c]
push 6
push eax
call fcn.0100265e
add esp, 0x10
push dword [ebp + 8]
lea eax, [ebp - 0x145c]
push eax
call fcn.010029e6
test al, al
je 0x1002ade
lea eax, [ebp - 0x145c]
push eax
call fcn.01002a47
lea eax, [ebp - 0x145c]
push eax
call fcn.01002a5f
push 0x1001774
push 5
lea eax, [ebp - 0x145c]
push 6
push eax
call fcn.0100265e
add esp, 0x10
lea eax, [ebp - 0x145c]
push eax
call fcn.01001f4d
push 0
push 0xffffffffffffffff
call sub.ntdll.dll_NtTerminateProcess
leave
ret 4
Function at 0x100511a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.01002e90
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10051af
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x10068d0]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x10051af
cmp eax, 1
je 0x10051c7
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10051af
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x1005184
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x10051ab
xor eax, eax
inc eax
jmp 0x10051e3
cmp esi, ebx
jae 0x10051b3
xor eax, eax
jmp 0x10051e3
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10068d0]
jmp 0x10051c9
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x168827d0
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xb4c47f8
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4044d4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406848
test esi, esi
jne 0x40450c
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406984
jmp 0x40452a
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404418
mov edi, eax
test esi, esi
je 0x40452a
cmp dword [ebx], 0
je 0x40452a
dec esi
jmp 0x404513
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405ce4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45204c], 0
je 0x405d45
cmp word [0x452328], 0xd7b2
jne 0x405d0d
cmp dword [0x452330], 0
jbe 0x405d0d
mov eax, 0x452324
call dword [0x452340]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405d70
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x450030], 0
jne 0x405d61
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x408384
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4084eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00406848
cmp si, word [0x4507d0]
jb 0x40841e
cmp si, word [0x4509d0]
ja 0x40841e
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x40841e
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4507d0]
jae 0x4083f8
mov edi, ebx
dec edi
jmp 0x408419
cmp si, word [ebx*8 + 0x4507d0]
jbe 0x408408
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408419
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4507d4]
call fcn.00408294
jmp 0x40841e
cmp edi, dword [ebp - 0xc]
jae 0x4083e2
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4084cd
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4084cd
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a30
push dword [ebp - 0x164]
push 0x408508
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406a30
push dword [ebp - 0x168]
push 0x408518
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a30
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406de8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4084f2
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406840
ret
Function at 0x4086a4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4087a9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x454b54
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x454b6c]
jne 0x4086f0
mov eax, esi
mov edx, 0x454b70
mov ecx, 0x55
call fcn.00406a30
push 0x454b54
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408793
push 0x454b54
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
xor edx, edx
call fcn.00406848
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408761
cmp byte [0x454b50], 0
je 0x408726
mov edx, esi
mov eax, ebx
call fcn.00408584
jmp 0x408761
mov edx, esi
mov eax, ebx
call fcn.00408384
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408761
cmp dword [esi], 0
je 0x40874a
mov eax, esi
mov edx, 0x4087c4
call fcn.00406c44
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408384
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406c44
push 0x454b54
call sub.kernel32.dll_EnterCriticalSection
mov word [0x454b6c], bx
push 0xaa
mov eax, dword [esi]
call fcn.004068d4
push eax
push 0x454b70
call sub.kernel32.dll_lstrcpynW
push 0x454b54
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4087b0
lea eax, [ebp - 4]
call fcn.00406838
ret
Function at 0x4089e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406830
xor eax, eax
push ebp
push 0x408bcd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408a28
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x408a42
push 0x105
mov eax, dword [ebp - 4]
call fcn.004068d4
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x408bb7
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408bdc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408ad1
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408bdc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408ad1
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408c10
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408ad1
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408c44
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x408bb7
xor eax, eax
push ebp
push 0x408bb0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.004087ec
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408b40
mov eax, dword [ebp - 0x10]
call fcn.00404180
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004069f4
jmp 0x408b8b
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x408c84
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408b8b
mov eax, dword [ebp - 0x10]
call fcn.00404180
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x408c84
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004069f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408bb7
cmp dword [ebp - 8], 0
je 0x408ba6
mov eax, dword [ebp - 8]
call fcn.0040419c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408bd4
lea eax, [ebp - 4]
call fcn.00406838
ret