joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40daa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457719
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
call fcn.0042c800
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40db03
push 0x80004005
call fcn.004049e0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea ebx, [esi + 1]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
test ebx, ebx
jns 0x40db2e
push 0x80070057
call fcn.004049e0
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
or ecx, eax
jge 0x40db47
push ebx
mov ecx, edi
call fcn.00404890
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp esi, 0xffffffff
jne 0x40db6d
mov eax, dword [edi]
test eax, eax
jne 0x40db5f
xor esi, esi
jmp 0x40db71
push dword [eax - 8]
push eax
call fcn.0043f5ec
add esp, 8
mov esi, eax
test esi, esi
js 0x40db24
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x40db24
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [edi]
mov word [eax + esi*2], cx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40dba0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457ad9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.0042c800
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x40dbf5
push 0x80004005
call fcn.004049e0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
mov dword [ebp - 0x10], 1
or ecx, eax
jge 0x40dc2d
push 0x104
mov ecx, esi
call fcn.00404890
push dword [esi]
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
mov eax, dword [esi]
js 0x40dc81
test eax, eax
jne 0x40dc4b
xor ecx, ecx
jmp 0x40dc5d
push dword [eax - 8]
push eax
call fcn.0043f5ec
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x40dc87
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x40dc87
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [eax - 8], 0
jge 0x40dc91
push 0x80070057
call fcn.004049e0
mov dword [eax - 0xc], 0
xor ecx, ecx
mov eax, dword [esi]
mov word [eax], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40dcc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457719
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
call fcn.0042c800
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40dd23
push 0x80004005
call fcn.004049e0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea ebx, [esi + 1]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
test ebx, ebx
jns 0x40dd4e
push 0x80070057
call fcn.004049e0
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, ebx
or ecx, eax
jge 0x40dd67
push ebx
mov ecx, edi
call fcn.00404890
push dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, 0xffffffff
jne 0x40dd8d
mov eax, dword [edi]
test eax, eax
jne 0x40dd7f
xor esi, esi
jmp 0x40dd91
push dword [eax - 8]
push eax
call fcn.0043f5ec
add esp, 8
mov esi, eax
test esi, esi
js 0x40dd44
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x40dd44
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [edi]
mov word [eax + esi*2], cx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ddc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457b08
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x14], 0
call fcn.0042c800
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x40de0f
push 0x80004005
call fcn.004049e0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x208
or eax, ecx
jge 0x40de45
push 0x208
lea ecx, [ebp - 0x10]
call fcn.00404890
mov esi, dword [ebp - 0x10]
push esi
push 0
push 0x46af1c
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push dword [esi - 8]
mov ebx, eax
push esi
call fcn.0043f5ec
add esp, 8
test eax, eax
js 0x40decc
cmp eax, dword [esi - 8]
jg 0x40decc
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test ebx, ebx
jne 0x40deb9
push 0x464d24
mov ecx, edi
call fcn.00404700
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40dea5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add esi, 0xfffffff0
push esi
call fcn.00404190
add esp, 4
add eax, 0x10
mov dword [edi], eax
jmp 0x40de87
push 0x80070057
call fcn.004049e0
int3
Function at 0x40ec30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0x46af14
push ebx
call fcn.00440b81
mov esi, eax
add esp, 8
test esi, esi
je 0x40ec6c
push 2
push 0
push esi
call fcn.00440cef
add esp, 0xc
push esi
test eax, eax
je 0x40ec75
call fcn.0044054a
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00441102
add esp, 4
mov edi, eax
push esi
call fcn.0044054a
add esp, 4
push 0x46af14
push ebx
call fcn.00440b81
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40ec6c
mov esi, dword [ebp - 4]
mov ecx, esi
push 0xffffffffffffffff
push edi
call fcn.0042fccb
push ebx
push 1
push edi
push dword [esi + 4]
call fcn.0044021e
push ebx
mov esi, eax
call fcn.0044054a
add esp, 0x14
cmp esi, 1
jne 0x40ec6c
mov esi, dword [ebp - 4]
mov edx, edi
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.0040eb70
test eax, eax
je 0x40ec6c
add eax, 0x18
sub esi, eax
add esi, edi
cmp esi, 0x10
jbe 0x40ec6c
test eax, eax
je 0x40ec6c
cmp byte [eax], 0x4b
jne 0x40ec6c
cmp byte [eax + 1], 0x42
jne 0x40ec6c
cmp byte [eax + 2], 0x44
jne 0x40ec6c
cmp byte [eax + 3], 0x45
jne 0x40ec6c
lea esi, [eax + 4]
test esi, esi
je 0x40ec6c
xor edx, edx
lea ecx, [ebp - 0xc]
call fcn.004280d0
test eax, eax
je 0x40ec6c
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov edx, edi
mov dword [ebp - 8], 0
mov ecx, esi
call fcn.00427f90
add esp, 8
mov ebx, eax
test edi, edi
je 0x40ed60
push edi
call fcn.0043f656
add esp, 4
test ebx, ebx
je 0x40ec6c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
pop edi
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
sub esi, dword [esi + 8]
mov dword [eax], esi
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411ba0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4580d0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], edx
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x411c09
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x3c]
call fcn.0042cc09
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
push dword [ebp - 0x10]
call fcn.0042cebb
lea ecx, [ebp - 0x50]
call fcn.0042fb6f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 0x14]
push 0xffffffffffffffff
lea eax, [eax*2 + 2]
push eax
call fcn.0042fccb
mov edi, dword [ebp - 0x4c]
xor esi, esi
cmp dword [ebp - 0x10], esi
jbe 0x411cb3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x411cf5
test esi, esi
js 0x411cf0
cmp esi, dword [ebp - 0x34]
jge 0x411cf0
mov eax, dword [ebp - 0x38]
lea edx, [eax + esi*4]
test edi, edi
jne 0x411c8d
xor eax, eax
jmp 0x411ca4
mov eax, edi
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411c92
sub eax, ebx
mov ebx, dword [ebp - 0x1c]
sar eax, 1
push eax
push edi
mov ecx, edx
call fcn.004045b0
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x411c50
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x3c]
push eax
call fcn.0042cd1d
mov bl, 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.0042fb86
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.0042cc20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042c9be
xor bl, bl
jmp 0x411cc1
Function at 0x4125d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4581b8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0
push str.Languages
push esi
mov dword [ebp - 0x14], 0
call edi
test eax, eax
jne 0x4127be
cmp dword [ebp - 0x18], 7
jne 0x4127be
lea ecx, [ebp - 0x44]
call fcn.0042fb6f
push 0xffffffffffffffff
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x14]
call fcn.0042fccb
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x40]
push 0
push 0
push str.Languages
push esi
call edi
test eax, eax
je 0x41266e
xor bl, bl
jmp 0x412787
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x30]
mov edi, dword [ebp - 0x40]
shr eax, 1
lea ebx, [edi + eax*2]
mov dword [ebp - 0x1c], ebx
call fcn.0042cc09
mov byte [ebp - 4], 1
cmp edi, ebx
jae 0x41276d
cmp word [edi], 0
je 0x41276d
mov esi, ebx
sub esi, edi
sar esi, 1
call fcn.0042c800
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4127b4
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 2
test esi, esi
js 0x4127aa
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x4126ea
push esi
lea ecx, [ebp - 0x10]
call fcn.00404890
mov ebx, dword [ebp - 0x10]
push esi
push edi
push ebx
call fcn.00441ac4
xor eax, eax
mov word [ebx + esi*2], ax
mov eax, dword [ebp - 0x10]
push dword [eax - 8]
push eax
call fcn.0043f5ec
mov edx, eax
add esp, 0x14
test edx, edx
js 0x4127aa
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ecx - 8]
jg 0x4127aa
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov word [eax + edx*2], cx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
call fcn.0042ce32
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0xc]
lea edx, [eax - 0x10]
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lea edi, [edi + ecx*2]
or ecx, 0xffffffff
add edi, 2
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x412762
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x1c]
cmp edi, ebx
jb 0x412690
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
call fcn.0042cd1d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
mov bl, 1
call fcn.0042cc20
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
call fcn.0042fb86
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004049e0
push 0x80004005
call fcn.004049e0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4127e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4581e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov esi, dword [ebp + 8]
xor edx, edx
xor eax, eax
mov ebx, dword [esi + 8]
test ebx, ebx
jle 0x412849
lea esp, [esp]
test eax, eax
js 0x412917
cmp eax, ebx
jge 0x412917
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + eax*4]
mov ecx, dword [ecx - 0xc]
test ecx, ecx
je 0x412903
inc edx
inc eax
add edx, ecx
cmp eax, ebx
jl 0x412820
lea edx, [edx + 1]
lea edi, [edx + edx]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], edi
call fcn.0042fb6f
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.0042fccb
mov eax, dword [ebp - 0x2c]
xor edi, edi
mov dword [ebp - 0x14], eax
mov ecx, eax
mov dword [ebp - 0x10], ecx
test ebx, ebx
jle 0x4128c1
lea ecx, [ecx]
test edi, edi
js 0x412917
cmp edi, dword [esi + 8]
jge 0x412917
mov eax, dword [esi + 4]
mov eax, dword [eax + edi*4]
mov esi, dword [eax - 0xc]
push esi
push eax
push ecx
call fcn.00441ac4
mov eax, dword [ebp - 0x10]
xor ecx, ecx
lea eax, [eax + esi*2]
mov esi, dword [ebp + 8]
mov word [eax], cx
inc edi
add esp, 0xc
lea ecx, [eax + 2]
mov dword [ebp - 0x10], ecx
cmp edi, ebx
jl 0x412880
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x18]
xor edx, edx
push eax
push 7
push edx
push str.Languages
push dword [ebp - 0x1c]
mov word [ecx], dx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
sete bl
call fcn.0042fb86
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042c9be
int3
Function at 0x413510
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458398
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x34]
call fcn.00411760
lea edx, [ebp - 0x34]
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.004130d0
or esi, 0xffffffff
test al, al
je 0x41360f
cmp byte [ebp - 0x30], 0
je 0x41360f
mov edx, edi
lea ecx, [ebp - 0x14]
call fcn.00416db0
push 0x46b7d0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push 0x4da7d8
push eax
call fcn.004040b0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403960
mov byte [ebp - 4], 1
add esp, 0x18
mov edx, dword [ebp - 0x18]
mov ecx, esi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4135be
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [ebp - 0x10]
test eax, eax
mov ecx, esi
sete bl
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4135ed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x413611
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x413611
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x413634
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov ecx, esi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x413650
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x2c]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x41366a
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415300
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458638
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
call esi
mov edi, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0x46541c
push ecx
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00406a50
mov ebx, dword [ebp - 0x24]
push ebx
push edi
call esi
cmp eax, edi
je 0x41537e
mov byte [ebp - 0xd], 0
jmp 0x4153b7
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
cmp edi, eax
je 0x4153b3
mov esi, dword [ebp - 0x20]
push ecx
push esi
mov ecx, edi
call fcn.00406a50
mov ecx, dword [edi + 4]
mov edx, ebx
test esi, esi
je 0x4153b3
test ecx, ecx
je 0x4153e0
test ebx, ebx
je 0x4153e0
mov eax, dword [edx]
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
lea edx, [edx + 4]
dec esi
jne 0x4153a5
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x4153cb
push ebx
call fcn.0042b706
add esp, 4
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042c9be
int3
Function at 0x416560
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4587f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x47c9a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp edi, eax
jne 0x4165d8
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
jne 0x4165b0
xor al, al
jmp 0x416682
lea edx, [ebp - 0x24]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4165b6
sub edx, ecx
lea eax, [ebp - 0x24]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.004045b0
mov al, 1
jmp 0x416682
call fcn.0042c800
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4165f4
push 0x80004005
call fcn.004049e0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
push 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0x464d24
mov dword [ebp - 0x30], edi
mov byte [ebp - 0x2c], 0
call fcn.004045b0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push 0x4164a0
call fcn.00430814
test eax, eax
jne 0x41663c
xor bl, bl
jmp 0x41665c
push 0xffffffffffffffff
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov bl, byte [ebp - 0x2c]
test bl, bl
je 0x41665c
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040e0c0
mov bl, byte [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov esi, dword [ebp - 0x28]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x416680
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f01f
mov esp, ebp
pop ebp
ret
Function at 0x4171e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457719
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x47c9a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.0042c800
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x417239
push 0x80004005
call fcn.004049e0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0
push 0
push 2
mov dword [ebp - 4], 0
push ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
je 0x4172cd
jns 0x417270
push 0x80070057
call fcn.004049e0
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x41728b
push edi
mov ecx, esi
call fcn.00404890
push edi
push dword [esi]
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [edi - 1]
cmp ecx, 0xffffffff
jne 0x4172b7
mov eax, dword [esi]
test eax, eax
jne 0x4172a9
xor ecx, ecx
jmp 0x4172bb
push dword [eax - 8]
push eax
call fcn.0043f5ec
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x417266
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x417266
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret