joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b2650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64faf1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x6bd8a0]
push esi
mov dword [esp + 0x20], eax
push edi
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov byte [esp + 0xc], 0
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
cmp esi, edi
mov byte [esp + 0x30], 2
je 0x5b26fb
push ebp
mov ebp, dword [esp + 0x40]
mov edi, edi
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x5c]
cmp eax, edx
lea eax, [esp + 0x4c]
je 0x5b26c4
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x5c]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00403e70
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push ebp
call dword [eax]
add esp, 8
push 0x653e11
push 0x653e10
lea ecx, [esp + 0x18]
call fcn.00403e70
add esi, 4
cmp esi, edi
jne 0x5b26b0
pop ebp
mov esi, dword [esp + 0x38]
lea eax, [esi + 0x10]
mov dword [eax], esi
mov dword [esi + 0x14], eax
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
cmp ecx, eax
mov byte [esp + 0x30], 3
lea eax, [esp + 0xc]
je 0x5b2720
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
push ecx
push eax
mov ecx, esi
call fcn.00403b50
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x1c]
cmp eax, edx
mov dword [esp + 8], 1
mov byte [esp + 0x30], 1
je 0x5b276c
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x5b276c
sub eax, ecx
cmp eax, 0x80
jbe 0x5b2762
push ecx
call fcn.00611869
add esp, 4
jmp 0x5b276c
push eax
push ecx
call fcn.005d6970
add esp, 8
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0x58]
cmp eax, ecx
mov byte [esp + 0x30], 0
je 0x5b27a3
mov ecx, dword [esp + 0x48]
test ecx, ecx
je 0x5b27a3
sub eax, ecx
cmp eax, 0x80
jbe 0x5b2799
push ecx
call fcn.00611869
add esp, 4
jmp 0x5b27a3
push eax
push ecx
call fcn.005d6970
add esp, 8
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
call fcn.006122a5
add esp, 0x2c
ret
Function at 0x5caa80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x5caab0
push esi
call fcn.005ce580
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x5caaa9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x5cab27
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x5cab17
mov eax, dword [esi + 8]
test eax, eax
je 0x5caad4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x5cab13
cmp eax, 2
je 0x5cab17
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5caac7
cmp eax, 3
je 0x5caafa
cmp eax, 1
jne 0x5caac7
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x5caac7
mov ecx, dword [esi + 0x11c]
add dword [eax + 8], ecx
jmp 0x5caac7
xor al, al
pop esi
ret
mov edx, dword [esi + 0x7c]
mov dword [esi + 0x84], edx
call fcn.005ca760
pop esi
ret
cmp eax, 0xcc
je 0x5cab47
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [esi]
push esi
call dword [eax]
add esp, 4
call fcn.005ca760
pop esi
ret
Function at 0x5d6b00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ff48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx]
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x30]
cmp eax, ecx
lea esi, [edi + 0x30]
mov dword [esp + 0xc], 0
je 0x5d6b71
push esi
lea ecx, [esp + 0x28]
call fcn.005dca60
push ebx
mov ecx, esi
mov dword [esp + 0x1c], 0
call fcn.005e0710
push 1
mov ecx, edi
call fcn.005d6a30
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.005dca60
lea ecx, [esp + 0x24]
call fcn.005e0700
jmp 0x5d6b86
push 1
mov ecx, edi
call fcn.005d6a30
push esi
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.005dca60
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x5d6e20
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [ecx], vtable.stlpmtx_std::basic_ios_unsigned_short_int__class_stlpmtx_std::char_traits_unsigned_short_int__.0
jmp fcn.005d6d60

Function at 0x5d7200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ffab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x30]
mov dword [esi], vtable.stlpmtx_std::ios_base.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.005edf00
lea eax, [esi + 0x58]
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
lea ecx, [eax + 0x10]
mov dword [ecx], eax
mov dword [eax + 0x14], ecx
mov eax, dword [ecx]
mov ecx, dword [esp + 0xc]
mov byte [eax], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5d77b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
xor cl, cl
test eax, eax
jl 0x5d77cc
mov ecx, eax
sar ecx, 5
mov edx, dword [ecx*4 + 0x16c87e0]
and eax, 0x1f
mov cl, byte [edx + eax*8 + 4]
push ebx
xor ebx, ebx
test cl, 0x20
je 0x5d77d9
mov ebx, 8
test cl, cl
jns 0x5d77e5
or ebx, 0x4000
jmp 0x5d77eb
or ebx, 0x8000
push esi
push 0
lea eax, [esp + 0xc]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0xc]
push edx
mov esi, eax
push 0
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test esi, esi
pop esi
je 0x5d7826
test eax, eax
je 0x5d782a
or ebx, 2
jmp 0x5d782d
test eax, eax
jne 0x5d782d
or ebx, 1
mov ecx, ebx
xor eax, eax
and ecx, 3
sub ecx, eax
je 0x5d784c
dec ecx
je 0x5d7845
dec ecx
jne 0x5d7851
mov eax, 0x18
jmp 0x5d7851
mov eax, 0x10
jmp 0x5d7851
mov eax, 8
test bl, 8
je 0x5d7859
or eax, 1
test bh, bh
pop ebx
jns 0x5d7861
or eax, 4
add esp, 8
ret
Function at 0x5d7890
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 4]
mov dword [0x6ba690], ecx
add esp, 0x24
ret

Function at 0x5d78b0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [ecx]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push ecx
xor esi, esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x5d78de
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5d78e8
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret
mov edx, edi
pop edi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x5d80e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebx, ecx
mov ecx, dword [esp + 0x20]
push edi
xor edi, edi
cmp ecx, 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x10]
jb 0x5d8107
lea eax, [esp + 0x14]
mov ebp, dword [eax]
cmp ecx, ebp
mov dword [esp + 0x18], ebp
jb 0x5d8225
push esi
mov eax, dword [esp + 0x24]
mov edx, dword [ebx]
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebp
lea esi, [edi + eax]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x5d8219
test byte [ebx + 8], 4
jne 0x5d8209
lea edi, [esi + eax - 1]
cmp esi, edi
mov ebp, esi
ja 0x5d81fb
mov al, byte [ebp]
cmp al, 0x1a
je 0x5d81e6
cmp al, 0xd
je 0x5d8166
mov byte [esi], al
jmp 0x5d8173
cmp ebp, edi
jae 0x5d818a
cmp byte [ebp + 1], 0xa
je 0x5d8174
mov byte [esi], 0xd
inc esi
inc ebp
cmp ebp, edi
jbe 0x5d8153
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
sub esi, eax
mov edi, esi
jmp 0x5d820b
mov edx, dword [ebx]
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1f]
push ecx
push edx
mov byte [esp + 0x27], 0x20
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5d8170
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x5d81e1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov byte [esi], 0xd
inc esi
add ecx, edx
cmp esi, ecx
jae 0x5d81d0
cmp al, 0xd
je 0x5d81d0
mov byte [esi], al
jmp 0x5d8173
mov eax, dword [ebx]
push 1
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x5d8174
mov byte [esi], 0xa
jmp 0x5d8173
cmp ebp, edi
ja 0x5d81fb
mov ecx, dword [ebx]
push 1
sub edi, ebp
push 0
inc edi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
sub esi, eax
mov edi, esi
jmp 0x5d820b
add edi, eax
mov edx, dword [esp + 0x28]
sub edx, edi
cmp edx, ebp
jae 0x5d8116
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x5d9980
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x650050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esi], vtable.stlpmtx_std::basic_streambuf_unsigned_short_int__class_stlpmtx_std::char_traits_unsigned_short_int__.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call fcn.005edf00
mov dword [esi], vtable.stlpmtx_std::basic_filebuf_unsigned_short_int__class_stlpmtx_std::char_traits_unsigned_short_int__.0
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], bl
mov eax, 1
lea ecx, [esp + 8]
mov dword [esp + 0x18], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
call fcn.005edf00
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x20], 1
call fcn.005d94b0
lea ecx, [esp + 8]
call fcn.005e0700
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5d999b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x650050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esi], vtable.stlpmtx_std::basic_streambuf_unsigned_short_int__class_stlpmtx_std::char_traits_unsigned_short_int__.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call fcn.005edf00
mov dword [esi], vtable.stlpmtx_std::basic_filebuf_unsigned_short_int__class_stlpmtx_std::char_traits_unsigned_short_int__.0
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], bl
mov eax, 1
lea ecx, [esp + 8]
mov dword [esp + 0x18], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
call fcn.005edf00
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x20], 1
call fcn.005d94b0
lea ecx, [esp + 8]
call fcn.005e0700
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5d9bc5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x4c]
cmp eax, ecx
push edi
jbe 0x5d9bfb
mov edx, dword [esi + 0x40]
sub eax, ecx
mov edi, eax
je 0x5d9bf4
push edi
push ecx
push edx
call fcn.00611870
add esp, 0xc
add eax, edi
mov dword [esi + 0x4c], eax
jmp 0x5d9c01
mov eax, edx
mov dword [esi + 0x4c], eax
jmp 0x5d9c01
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x4c], ecx
mov eax, dword [esi + 0x4c]
mov edx, dword [esi + 0x44]
sub edx, eax
push edx
lea ecx, [esi + 0x20]
push eax
call fcn.005d80e0
test eax, eax
jle 0x5d9d18
jmp 0x5d9c20
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x4c]
mov edi, dword [esi + 0x38]
lea ebp, [esp + 0x10]
push ebp
push edx
add ecx, eax
push edi
mov eax, ecx
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x4c], ecx
mov ecx, dword [esi + 0x74]
mov ebx, dword [ecx]
push eax
lea eax, [esi + 0x54]
push eax
call dword [ebx + 8]
cmp eax, 3
je 0x5d9d18
cmp eax, 2
je 0x5d9ce1
mov eax, dword [esi + 0x38]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
mov edx, dword [esp + 0x14]
je 0x5d9c73
cmp edx, dword [esi + 0x40]
je 0x5d9ce1
xor ebx, ebx
cmp byte [esi + 0x30], bl
je 0x5d9c8d
mov edi, ecx
sub edi, eax
sar edi, 1
imul edi, dword [esi + 0x78]
mov ebp, edx
sub ebp, dword [esi + 0x40]
cmp edi, ebp
jne 0x5d9ce3
cmp ecx, eax
jne 0x5d9cc7
mov ebp, dword [esi + 0x40]
mov edi, edx
sub edi, ebp
cmp edi, dword [esi + 0x7c]
jge 0x5d9ce3
cmp ecx, eax
jne 0x5d9cc7
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub ecx, eax
push ecx
push eax
lea ecx, [esi + 0x20]
call fcn.005d80e0
cmp eax, ebx
jg 0x5d9c20
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0x38]
pop edi
mov dword [esi + 0x48], edx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ax, word [eax]
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor ebx, ebx
mov eax, dword [esi + 0x58]
cmp eax, ebx
je 0x5d9d02
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x5d9cff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], ebx
mov byte [esi + 0x33], bl
mov dword [esi + 0x58], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], 1
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 8
ret
push esi
mov esi, ecx
mov al, byte [esi + 0x33]
test al, al
jne 0x5da23a
call fcn.005d9b10
test al, al
jne 0x5da260
mov eax, 0xffff
pop esi
ret
mov al, byte [esi + 0x36]
test al, al
je 0x5da260
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x70]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x6c]
cmp eax, ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov byte [esi + 0x36], 0
je 0x5da260
mov ax, word [eax]
pop esi
ret
mov ecx, esi
pop esi
jmp 0x5d9bc0
Function at 0x5da220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x4c]
cmp eax, ecx
push edi
jbe 0x5d9bfb
mov edx, dword [esi + 0x40]
sub eax, ecx
mov edi, eax
je 0x5d9bf4
push edi
push ecx
push edx
call fcn.00611870
add esp, 0xc
add eax, edi
mov dword [esi + 0x4c], eax
jmp 0x5d9c01
mov eax, edx
mov dword [esi + 0x4c], eax
jmp 0x5d9c01
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x4c], ecx
mov eax, dword [esi + 0x4c]
mov edx, dword [esi + 0x44]
sub edx, eax
push edx
lea ecx, [esi + 0x20]
push eax
call fcn.005d80e0
test eax, eax
jle 0x5d9d18
jmp 0x5d9c20
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x4c]
mov edi, dword [esi + 0x38]
lea ebp, [esp + 0x10]
push ebp
push edx
add ecx, eax
push edi
mov eax, ecx
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x4c], ecx
mov ecx, dword [esi + 0x74]
mov ebx, dword [ecx]
push eax
lea eax, [esi + 0x54]
push eax
call dword [ebx + 8]
cmp eax, 3
je 0x5d9d18
cmp eax, 2
je 0x5d9ce1
mov eax, dword [esi + 0x38]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
mov edx, dword [esp + 0x14]
je 0x5d9c73
cmp edx, dword [esi + 0x40]
je 0x5d9ce1
xor ebx, ebx
cmp byte [esi + 0x30], bl
je 0x5d9c8d
mov edi, ecx
sub edi, eax
sar edi, 1
imul edi, dword [esi + 0x78]
mov ebp, edx
sub ebp, dword [esi + 0x40]
cmp edi, ebp
jne 0x5d9ce3
cmp ecx, eax
jne 0x5d9cc7
mov ebp, dword [esi + 0x40]
mov edi, edx
sub edi, ebp
cmp edi, dword [esi + 0x7c]
jge 0x5d9ce3
cmp ecx, eax
jne 0x5d9cc7
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub ecx, eax
push ecx
push eax
lea ecx, [esi + 0x20]
call fcn.005d80e0
cmp eax, ebx
jg 0x5d9c20
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0x38]
pop edi
mov dword [esi + 0x48], edx
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ax, word [eax]
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor ebx, ebx
mov eax, dword [esi + 0x58]
cmp eax, ebx
je 0x5d9d02
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x5d9cff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], ebx
mov byte [esi + 0x33], bl
mov dword [esi + 0x58], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], 1
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
pop edi
pop esi
pop ebp
or ax, 0xffff
pop ebx
add esp, 8
ret
push esi
mov esi, ecx
mov al, byte [esi + 0x33]
test al, al
jne 0x5da23a
call fcn.005d9b10
test al, al
jne 0x5da260
mov eax, 0xffff
pop esi
ret
mov al, byte [esi + 0x36]
test al, al
je 0x5da260
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x70]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x6c]
cmp eax, ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov byte [esi + 0x36], 0
je 0x5da260
mov ax, word [eax]
pop esi
ret
mov ecx, esi
pop esi
jmp 0x5d9bc0
Function at 0x5da273
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov al, byte [esi + 0x34]
test al, al
jne 0x5da291
call fcn.005d9b60
test al, al
jne 0x5da291
or ax, 0xffff
pop esi
add esp, 8
ret 4
mov eax, dword [esi + 0x3c]
sub eax, 2
push ebp
mov ebp, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x14]
cmp ax, 0xffff
push edi
mov edi, dword [esi + 0x38]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
je 0x5da2b9
mov word [ebp], ax
add ebp, 2
cmp edi, ebp
push ebx
je 0x5da352
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x74]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esi + 0x44]
push edx
push eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push ebp
push edi
lea eax, [esi + 0x50]
mov dword [esp + 0x28], edi
mov ebx, dword [ecx]
push eax
call dword [ebx + 4]
cmp eax, 3
je 0x5da368
cmp eax, 2
je 0x5da38b
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
mov eax, dword [esp + 0x14]
jne 0x5da317
mov edx, ebp
sub edx, edi
sar edx, 1
imul edx, dword [esi + 0x78]
mov ebx, eax
sub ebx, dword [esi + 0x40]
cmp ebx, edx
je 0x5da326
mov dl, byte [esi + 0x30]
xor ebx, ebx
cmp dl, bl
jne 0x5da38d
cmp ecx, edi
je 0x5da38d
jmp 0x5da328
xor ebx, ebx
mov ecx, dword [esi + 0x40]
sub eax, ecx
push eax
push ecx
lea ecx, [esi + 0x20]
call fcn.005d8230
test al, al
je 0x5da38d
mov eax, dword [esp + 0x10]
sub eax, edi
sar eax, 1
lea edi, [edi + eax*2]
cmp edi, ebp
jne 0x5da2c2
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp ax, 0xffff
sete cl
pop ebx
pop edi
pop ebp
pop esi
dec ecx
and eax, ecx
add esp, 8
ret 4
xor eax, eax
pop ebx
pop edi
mov byte [esi + 0x34], al
mov byte [esi + 0x33], al
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
pop ebp
mov byte [esi + 0x35], 1
or ax, 0xffff
pop esi
add esp, 8
ret 4
xor ebx, ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x33], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
pop ebx
pop edi
pop ebp
mov byte [esi + 0x35], 1
or ax, 0xffff
pop esi
add esp, 8
ret 4

Function at 0x5f38b0
Capabilities:
Get geographical location

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
push 2
lea eax, [esp + 4]
push eax
push 0x54
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov al, byte [esp]
cmp al, 0x30
jne 0x5f38d2
xor eax, eax
pop ecx
ret
xor ecx, ecx
cmp al, 0x31
sete cl
lea ecx, [ecx + ecx - 1]
mov eax, ecx
pop ecx
ret

Function at 0x5f38f0
Capabilities:
Get geographical location

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
push 2
lea eax, [esp + 4]
push eax
push 0x55
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov al, byte [esp]
cmp al, 0x30
jne 0x5f3912
xor eax, eax
pop ecx
ret
xor ecx, ecx
cmp al, 0x31
sete cl
lea ecx, [ecx + ecx - 1]
mov eax, ecx
pop ecx
ret

Function at 0x5f3930
Capabilities:
Get geographical location

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
push 2
lea eax, [esp + 4]
push eax
push 0x52
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp]
push eax
call fcn.0061350d
add esp, 8
ret