joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404130
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x40956e]
test eax, eax
jg 0x404143
and dword [0x409534], 0
xor eax, eax
ret
push edi
push esi
mov esi, 0x800
cmp eax, esi
ja 0x404150
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll__lread]
push esi
push dword [0x409530]
push dword [0x408f4c]
call edi
cmp dword [0x408f5c], 0
mov ecx, eax
mov dword [0x409534], ecx
je 0x4041bf
cmp ecx, 0xffffffff
je 0x4041bf
cmp ecx, esi
je 0x4041d0
test ecx, ecx
jl 0x4041bf
mov ax, word [0x408a40]
push dword [0x408f60]
inc ax
push eax
call fcn.00401317
mov ecx, dword [0x409534]
test ecx, ecx
jne 0x4041b8
push esi
push dword [0x409530]
push dword [0x408f4c]
call edi
mov ecx, eax
mov dword [0x409534], ecx
cmp ecx, 0xffffffff
je 0x4041bf
mov esi, ecx
cmp ecx, esi
je 0x4041d0
push 2
call fcn.00401d5e
mov ecx, dword [0x409534]
sub dword [0x40956e], ecx
mov esi, dword [0x409530]
cmp dword [0x408f50], 0
mov dword [0x40957c], esi
je 0x404212
mov eax, ecx
mov edx, eax
dec eax
test edx, edx
je 0x404212
lea edi, [eax + 1]
call fcn.00405a83
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00405a99
inc esi
dec edi
pop ecx
jne 0x4041f7
mov ecx, dword [0x409534]
mov eax, ecx
dec ecx
pop esi
mov dword [0x409534], ecx
pop edi
ret

Function at 0x405a99
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x408fd0]
xor eax, ecx
mov edx, 0xff
and eax, edx
push esi
shr ecx, 8
mov eax, dword [eax*4 + 0x409000]
xor eax, ecx
mov ecx, dword [0x408fd8]
mov dword [0x408fd0], eax
and eax, edx
add eax, dword [0x408fd4]
mov esi, ecx
and esi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [0x408fd4], eax
shr eax, 0x18
xor esi, eax
shr ecx, 8
mov eax, dword [esi*4 + 0x409000]
pop esi
xor eax, ecx
mov dword [0x408fd8], eax
ret

Function at 0x405b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [0x408f58]
call fcn.00405af4
pop ecx
lea eax, [ebp - 0xc]
push 0xc
push dword [ebp + 8]
push eax
call fcn.00401000
add esp, 0xc
xor edi, edi
lea esi, [ebp + edi - 0xc]
call fcn.00405a83
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00405a99
inc edi
pop ecx
cmp edi, 0xc
jl 0x405ba7
cmp dword [0x408f54], 0
movzx ax, byte [ebp - 1]
je 0x405bda
xor ecx, ecx
mov cl, byte [0x409567]
jmp 0x405be3
mov ecx, dword [0x40956a]
shr ecx, 0x18
cmp ax, cx
je 0x405bed
or eax, 0xffffffff
jmp 0x405bef
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0xdcbdde
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xdcbde4
pop ebp
sub ebp, 0x10
sub ebp, 0x9cbdd4
jmp 0xdcbdfa
mov eax, 0x9cbdd4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d2
mov edx, 0x8cc22709
xor byte [eax], dl
inc eax
dec ecx
jne 0xdcbe11
jmp 0xdcbe24
add ah, 0x82
xor byte [0x88090909], 0xc8
int1
or dword [ecx], ecx
or dword [edx], ecx
les esi, [ecx + 0x909090c]
mov bl, 0x21
or dword [ecx], ecx
or esi, edi
jmp 0xdcbe4b
insd dword es:[edi], dx
sub eax, 0x2d0d80f5
test byte [ebp + 0x2d], ch
cmc
or byte [0x2ccd612d], 0x28
or dword [ecx + 0x19], esp
xchg ecx, eax
jb 0xdcbe6b
or byte [0x3bb0612d], ah
jg 0xdcbe81
loope 0xdcbe78
or al, 9
or dword [ecx], ecx
loopne 0xdcbeaa
or dword [ecx], ecx
or eax, esp
cmp dword [ecx], ecx
or dword [ecx], ecx
pop esp
test byte [ebp + 0x2d], ah
or dword [ecx], ecx
or dword [esp + eax*4 + 0x65], ebx
sub eax, 0x18c8209
or dword [ecx], ecx
or dword [edx + 0x909018c], eax
or dword [edx + 0x909059c], eax
or dword [edx + 0x9091984], eax
add eax, 0x82090909
test byte [ecx], bl
or dword [ecx], ecx
or eax, ecx
loopne 0xdcbe99
cmp byte [ebx], cl
mov cl, bl
or eax, 0xfd8c0640
div dh
test byte [edx + 0x6d842d25], 0x2d
or eax, 0x820905cb
test dword [0x909090d], ebp
popal
int 0x2c
sub byte [ecx], cl
popal
sbb dword [ecx + 0x25080972], edx
sub eax, 0xf52d6d84
or dword [ecx - 0x33], esp
sub al, 0x28
or dword [ecx + 0x19], esp
xchg ecx, eax
jb 0xdcbebe
or byte [0x2d6d842d], ah
cmc
add byte [0x90ce12d], 9
sub eax, 0x9090ce1
or eax, esp
inc edx
or ecx, dword [ecx]
or dword [ebp + ebp*2 + 0x2580f52d], eax
sub eax, 0x7cf6e582
add eax, 0xe1017cf6
jno 0xdcbee4
or dword [ecx], ecx
xor byte [ecx + eax - 0x77f6f6f7], 0xf8
clc
scasb al, byte es:[edi]
push es
nop
push esi
mov al, bh
clc
scasb al, byte es:[edi]
push es
nop
push esi
cmp al, al
cmp bl, bl
mov ah, cl
or al, 0x41
push es
lea eax, [edi + 9]
or dword [ecx], ecx
push es
add dword [ecx + 9], 0x826f0909
adc eax, 0xe1f28930
push es
lea edx, [ebx]
or dword [ecx], ecx
or dword [ecx - 0x72f91f0e], ecx
sbb byte [ecx], cl
or dword [ecx], ecx
outsd dx, dword [esi]
mov dl, dh
imul byte [esi + eax]
lea ebx, [ecx + ecx]
or dword [ecx], ecx
dec eax
loopne 0xdcbeec
div dh
mul byte [eax]
inc ebp
xor byte [eax], cl
mov cl, al
or al, 0x8a
loope 0xdcbf41
loopne 0xdcbeea
div dh
mul byte [eax]
pop ebp
xor byte [ebx], cl
mov cl, al
jp 0xe266cd28
jecxz 0xdcbf50
mov ah, cl
or al, 0xe0
mov byte [0x82f6f6f6], al
and eax, 0x2d6d842d
or eax, 0x5c0905cb
sub eax, 0x905cb0d
pop esp
and ch, 0x5f
pop esi
pop esp
cmp byte [ebp + eax - 0x7e], 0x74
add ebp, esi
mov ebx, 0x880f8389
iretd
Function at 0x4012d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
lea eax, [ebp - 4]
push eax
push 0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4012fd
xor eax, eax
jmp 0x40138e
push esi
push 0
push dword [ebp + 8]
mov esi, 0x20a
mov edx, esi
lea ecx, [ebp - 0x31c]
call section..text
push str.ShellOpenCommand
mov edx, esi
lea ecx, [ebp - 0x31c]
call fcn.004012aa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40135c
xor eax, eax
jmp 0x40138d
cmp byte [ebp - 0x110], 0
lea esi, [ebp - 0x110]
je 0x401380
movzx eax, byte [esi]
push eax
call dword [sym.imp.MSVCR71.dll_isspace]
test eax, eax
pop ecx
je 0x401380
inc esi
cmp byte [esi], 0
jne 0x40136b
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x401392
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
imul eax, eax, 0x106
push ebx
lea ebx, [eax + 0x403260]
cmp byte [ebx], 0
jne 0x40144d
push esi
push edi
push 0x5c
mov esi, 0x403140
push esi
call dword [sym.imp.MSVCR71.dll__mbsrchr]
test eax, eax
pop ecx
pop ecx
mov edi, 0x118
jne 0x4013e0
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x4013f9
sub eax, esi
inc eax
cmp eax, edi
jbe 0x4013e9
mov eax, edi
push 0
push esi
mov edx, eax
lea ecx, [ebp - 0x118]
call section..text
push 0x4020e8
mov edx, edi
lea ecx, [ebp - 0x118]
call fcn.004012aa
push dword [ebp + 8]
call fcn.00401037
push eax
mov edx, edi
lea ecx, [ebp - 0x118]
call fcn.004012aa
lea eax, [ebp - 0x118]
push 0
push eax
call dword [sym.imp.MSVCR71.dll__access]
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
jne 0x40144d
push 1
lea eax, [ebp - 0x118]
push eax
mov edx, 0x106
mov ecx, ebx
call section..text
pop ebx
leave
ret 4
Function at 0x401452
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
xor eax, eax
push 3
inc eax
call fcn.00401392
cmp byte [0x403366], 0
jne 0x401534
push ebx
push edi
mov ebx, 0x403366
push ebx
push str.VisualFoxProRuntime.9
call fcn.004012d8
test eax, eax
mov edi, dword [sym.imp.MSVCR71.dll__access]
je 0x4014a5
push 0
push ebx
call edi
test eax, eax
pop ecx
pop ecx
je 0x4014a5
mov byte [0x403366], 0
jmp 0x401528
cmp byte [0x403366], 0
jne 0x401532
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40151f
add eax, 0xc
cmp eax, 0x105
jg 0x40151f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4020e8
lea eax, [ebp - 0x118]
push eax
call esi
push 3
call fcn.00401037
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
push 0
push eax
call edi
test eax, eax
pop ecx
pop ecx
pop esi
jne 0x40151f
push 1
lea eax, [ebp - 0x118]
push eax
mov edx, 0x106
mov ecx, ebx
call section..text
cmp byte [0x403366], 0
jne 0x401532
xor eax, eax
inc eax
push 3
call fcn.00401392
pop edi
pop ebx
leave
ret

Function at 0x433003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x404708
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040696c
test esi, esi
jne 0x40473e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406af4
jmp 0x40475c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040464c
mov edi, eax
test esi, esi
je 0x40475c
cmp dword [ebx], 0
je 0x40475c
dec esi
jmp 0x404745
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x404790
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x527008], 0x8088405
inc edx
mov dword [ebx + 0x527008], edx
fld qword [ebx + 0x527790]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x405698
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405a84
mov byte [esp], al
cmp byte [esp], 0
jne 0x405821
test edi, edi
je 0x405821
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405758
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x405733
cmp edi, 0xffffffff
je 0x4056f7
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4056f7
mov byte [esp], 0
jmp 0x405821
mov ebx, dword [esi]
cmp ebx, 1
jg 0x405733
test ebx, ebx
jne 0x40572c
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.0040257c
test eax, eax
jne 0x40572c
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405821
pause
dec ebp
test ebp, ebp
jg 0x4056dc
cmp edi, 0xffffffff
je 0x405758
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405756
mov byte [esp], 0
jmp 0x405821
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4056a6
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.0040257c
cmp ebx, eax
jne 0x405758
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405894
mov edx, eax
mov ebx, dword [0x52c8c8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4057bf
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4057bd
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4057bf
xor edi, edi
cmp byte [esp], 0
je 0x4057e8
mov ebx, dword [esi]
test bl, 1
jne 0x405801
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.0040257c
cmp ebx, eax
jne 0x4057c5
mov byte [esp + 1], 1
jmp 0x405801
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.0040257c
cmp ebx, eax
jne 0x4057e8
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x405772
cmp byte [esp], 0
je 0x405821
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4063a4
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x52eae4
cmp dword [ebp + 0xc], 2
jl 0x4063b8
mov ebx, 0x52eb14
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x4063f0
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, sub.kernel32.dll_RaiseException
mov dword [0x52c014], eax
mov eax, 0x4025c4
mov dword [0x52c018], eax
mov eax, ebx
call fcn.00406288
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x406425
cmp al, 3
jge 0x406425
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x406436
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x406441
call dword [ecx + eax*4]
cmp dword [0x52c034], 0
jne 0x406457
mov byte [0x52c03c], 1
fnstcw word [0x527024]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.004066ac
call fcn.00406338
ret 4

Function at 0x40661c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x52c050], 0
je 0x40667d
cmp word [0x52c32c], 0xd7b2
jne 0x406645
cmp dword [0x52c334], 0
jbe 0x406645
mov eax, 0x52c328
call dword [0x52c344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4066a8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x527028], 0
jne 0x406699
push 0
push 0x527798
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406828
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x52702c], 0
je 0x406853
mov edx, edi
mov eax, esi
call dword [0x52702c]
mov ebx, eax
jmp 0x406864
mov eax, 8
call fcn.00404380
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x52c051], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x4067f0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x406899
mov edx, 8
mov eax, ebx
call fcn.0040439c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x408b80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408ce5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040696c
cmp si, word [0x5277e8]
jb 0x408c18
cmp si, word [0x5279e8]
ja 0x408c18
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x408c18
mov ebx, dword [ebp - 8]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x5277e8]
jae 0x408bf2
mov edi, ebx
dec edi
jmp 0x408c13
cmp si, word [ebx*8 + 0x5277e8]
jbe 0x408c02
inc ebx
mov dword [ebp - 8], ebx
jmp 0x408c13
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x5277ec]
call fcn.00408a90
jmp 0x408c18
cmp edi, dword [ebp - 8]
jae 0x408bdc
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x408cc7
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408cc7
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004073b4
push dword [ebp - 0x160]
push 0x408d00
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004073b4
push dword [ebp - 0x164]
push 0x408d10
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004073b4
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.004075ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408cec
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004069cc
ret
Function at 0x408e98
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408f9b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x52eb51
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x52eb6a]
jne 0x408ee4
mov eax, esi
mov edx, 0x52eb6c
mov ecx, 0x55
call fcn.004073b4
push 0x52eb51
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408f85
push 0x52eb51
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.0040696c
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408f53
cmp byte [0x52eb50], 0
je 0x408f18
mov edx, esi
mov eax, ebx
call fcn.00408d7c
jmp 0x408f53
mov edx, esi
mov eax, ebx
call fcn.00408b80
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x408f53
cmp dword [esi], 0
je 0x408f3c
mov eax, esi
mov edx, 0x408fb4
call fcn.0040750c
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408b80
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040750c
push 0x52eb51
call sub.kernel32.dll_EnterCriticalSection
mov word [0x52eb6a], bx
push 0xaa
mov eax, dword [esi]
call fcn.00407318
push eax
push 0x52eb6c
call sub.kernel32.dll_lstrcpynW
push 0x52eb51
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408fa2
lea eax, [ebp - 4]
call fcn.0040696c
ret
Function at 0x4091d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a50
xor eax, eax
push ebp
push 0x4093f5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x409210
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40922a
push 0x105
mov eax, dword [ebp - 4]
call fcn.00407318
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x4093df
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409404
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4092f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409404
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4092f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409440
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4092f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409440
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4092f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x409474
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x4092f9
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4094a8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4093df
xor eax, eax
push ebp
push 0x4093d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408fdc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x409368
mov eax, dword [ebp - 0x10]
call fcn.00404380
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407378
jmp 0x4093b3
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x4094e8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4093b3
mov eax, dword [ebp - 0x10]
call fcn.00404380
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x4094e8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093df
cmp dword [ebp - 8], 0
je 0x4093ce
mov eax, dword [ebp - 8]
call fcn.0040439c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093fc
lea eax, [ebp - 4]
call fcn.0040696c
ret