joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d4b7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41d4f9
call fcn.0042253d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41d4f9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41d4f0
xor eax, eax
jmp 0x41d501
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041d507
pop edi
pop esi
pop ebx
ret 4

Function at 0x422d5a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x422d88
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x422da6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00422cc0
jmp 0x422da6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x422da6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00422cc0
test edi, edi
mov eax, edi
jne 0x422d90
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401100
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x12]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x18], ax
call fcn.0040c0e0
add esp, 0xc
mov dword [esp + 4], ebx
cmp edi, ebx
je 0x401221
cmp esi, ebx
je 0x401221
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401150
sub eax, edx
sar eax, 1
je 0x401221
cmp dword [esp + 0x220], ebx
je 0x401175
lea edx, [esp + 0xc]
push edx
jmp 0x4011af
mov eax, dword [esp + 0x21c]
cmp dword [eax], 3
jne 0x4011aa
push 0x104
lea ecx, [esp + 0x10]
push ecx
call dword [fcn.0041c0e0]
push 0x41dccc
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.00408fc5
add esp, 0xc
jmp 0x4011ba
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [fcn.0041c128]
push esi
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.00408fc5
push 0x41dcd0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00409108
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, ebx
je 0x401221
push eax
push 1
push 0x200
push edi
call fcn.004093fb
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040948f
add esp, 0x14
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret 8
mov ecx, dword [esp + 0x214]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret 8

Function at 0x4012b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.0040c0e0
add esp, 0xc
cmp edi, esi
je 0x401398
mov eax, 0x41dcd8
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4012f5
sub eax, edx
sar eax, 1
je 0x40131f
push 0x41dcdc
lea edx, [esp + 8]
push 0x41dcd8
push edx
call fcn.00409108
add esp, 0xc
jmp 0x40135a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [fcn.0041c128]
push 0x41dc98
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.00408fc5
push 0x41dcdc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00409108
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40137d
push eax
push 1
push 0x200
push edi
call fcn.0040966d
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040948f
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret
Function at 0x402850
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
mov eax, 0x41dcd8
mov dword [esp], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402862
sub eax, edx
sar eax, 1
jne 0x402879
xor eax, eax
add esp, 0x18
ret
push 0x41dcdc
lea eax, [esp + 4]
push 0x41dcd8
push eax
call fcn.00409108
add esp, 0xc
test eax, eax
jne 0x402873
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov word [esp + 0x14], ax
mov eax, dword [esp]
push eax
mov ecx, 0x4d42
push 1
mov word [esp + 0x10], cx
lea ecx, [esp + 0x10]
add edx, 0xe
push 0xe
push ecx
mov dword [esp + 0x1a], edx
mov dword [esp + 0x22], 0x36
call fcn.0040966d
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edx
push 1
push eax
push ecx
call fcn.0040966d
mov edx, dword [esp + 0x20]
push edx
call fcn.0040948f
add esp, 0x24
mov eax, 1
add esp, 0x18
ret

Function at 0x402ac0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.0040c0e0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x402b8f
mov eax, 0x41dc98
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402b05
sub eax, edx
sar eax, 1
je 0x402b8f
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [fcn.0041c128]
push 0x41dc98
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00408fc5
push 0x41dcd0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00409108
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x402b8f
push eax
push 1
push 0x200
push esi
call fcn.004093fb
mov eax, dword [esp + 0x14]
push eax
call fcn.0040948f
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00408fb6
add esp, 0x214
ret
Function at 0x403370
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x320
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x31c], eax
mov eax, dword [0x41de88]
mov ecx, dword [0x41de8c]
mov edx, dword [0x41de90]
push 0x103
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov ax, word [0x41de94]
lea ecx, [esp + 0x15]
push 0
push ecx
mov dword [esp + 0x14], edx
mov word [esp + 0x18], ax
mov byte [esp + 0x1c], 0
call fcn.0040c0e0
push 0x103
lea edx, [esp + 0x125]
push 0
push edx
mov byte [esp + 0x12c], 0
call fcn.0040c0e0
push 0x103
lea eax, [esp + 0x235]
push 0
push eax
mov byte [esp + 0x23c], 0
call fcn.0040c0e0
add esp, 0x24
lea ecx, [esp + 0x114]
push ecx
push 0x104
call dword [0x41c078]
lea eax, [esp]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403415
push esi
push edi
lea edi, [esp + 0x11c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403428
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0x104
lea edx, [esp + 0x1c]
mov ecx, eax
push edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call dword [0x41c074]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x224]
push 0x104
push ecx
call fcn.0040a477
lea edx, [esp + 0x22c]
push 0x5c
push edx
call fcn.0040a680
add esp, 0x14
test eax, eax
je 0x403482
mov byte [eax], 0
lea eax, [esp + 0x11c]
push 0x41de98
push eax
call fcn.0040a460
mov esi, eax
add esp, 8
test esi, esi
je 0x4035e4
push esi
push 1
push 9
push 0x41de9c
call fcn.0040966d
push esi
push 1
push 5
push 0x41dea8
call fcn.0040966d
lea eax, [esp + 0x38]
add esp, 0x20
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4034d0
push esi
sub eax, edx
push 1
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.0040966d
push esi
push 1
push 2
push 0x41deb0
call fcn.0040966d
push esi
push 1
push 0xa
push 0x41deb4
call fcn.0040966d
lea eax, [esp + 0x48]
add esp, 0x30
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403510
push esi
sub eax, edx
push 1
push eax
lea edx, [esp + 0x24]
push edx
call fcn.0040966d
push esi
push 1
push 0xf
push 0x41dec0
call fcn.0040966d
push esi
push 1
push 7
push 0x41ded0
call fcn.0040966d
lea eax, [esp + 0x250]
add esp, 0x30
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403552
push esi
sub eax, ecx
push 1
push eax
lea eax, [esp + 0x22c]
push eax
call fcn.0040966d
push esi
push 1
push 3
push 0x41deb0
call fcn.0040966d
push esi
push 1
push 5
push 0x41dea8
call fcn.0040966d
lea eax, [esp + 0x14c]
add esp, 0x30
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403597
push esi
sub eax, ecx
push 1
push eax
lea ecx, [esp + 0x128]
push ecx
call fcn.0040966d
push esi
push 1
push 1
push 0x41ded8
call fcn.0040966d
push esi
call fcn.0040948f
add esp, 0x24
push 0
push 0
push 0
lea edx, [esp + 0x128]
push edx
push 0x41dedc
push 0
call dword [0x41c194]
mov ecx, dword [esp + 0x324]
pop edi
pop esi
xor ecx, esp
call fcn.00408fb6
add esp, 0x320
ret
Function at 0x404960
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.00413af0
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0x1008], eax
mov edx, dword [edi]
mov eax, dword [esp + 0x1010]
push ebx
push ebp
mov ebp, dword [0x41c20c]
xor ebx, ebx
push ebx
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x1c], eax
call ebp
cmp eax, 4
je 0x4049b8
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.00408fb6
add esp, 0x100c
ret
cmp dword [esp + 8], ebx
jbe 0x4049f7
push esi
nop
mov ecx, dword [edi]
push 0
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x4049f6
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.0040966d
add ebx, esi
add esp, 0x10
cmp ebx, dword [esp + 0xc]
jb 0x4049c0
pop esi
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
push eax
call fcn.0040948f
mov ecx, dword [esp + 0x1014]
add esp, 4
cmp ebx, dword [esp + 8]
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.00408fb6
add esp, 0x100c
ret
Function at 0x406be0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x406be7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x406cc4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f3a8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x41f3a8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x41f3a8]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f3a8]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f3a8]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f3a8]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f3a8]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f3a8]
inc ecx
sub edx, 8
sub esi, 1
jne 0x406c00
pop edi
test edx, edx
je 0x406ceb
jmp 0x406cd0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x41f3a8]
inc ecx
sub edx, 1
jne 0x406cd0
not eax
pop esi
ret

Function at 0x406cf0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x41f3a8]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x41f3a8]
mov dword [edx + 8], ecx
ret

Function at 0x406d40
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x41f3a8]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x41f3a8]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x1010457
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10104b1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x101047e
xor eax, eax
jmp 0x10104b0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x10104a2
cmp esi, eax
jae 0x101047a
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1010494
cmp esi, eax
jae 0x101047a
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x10105d4
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x106406c]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x20008
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
xor edi, edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x101069a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push ebx
push 1
push dword [ebp - 0x10]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1010699
push dword [ebp - 0x14]
call fcn.0101dd0b
mov edi, eax
cmp edi, ebx
pop ecx
je 0x1010699
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push edi
push 1
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x1010699
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1010699
push dword [ebp - 0x18]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov dword [ebp - 0x1c], ecx
pop esi
cmp dword [ebp - 0x18], ebx
je 0x10106a8
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp edi, ebx
je 0x10106b3
push edi
call fcn.0101d9dc
pop ecx
cmp dword [ebp - 0x10], ebx
pop edi
pop ebx
je 0x10106c3
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
call fcn.0101cfec
leave
ret
Function at 0x1011056
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x105614a
call fcn.0101d9b8
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, ecx
mov dword [esi], eax
lea eax, [edi + 4]
push eax
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
call fcn.01010eb5
and dword [ebp - 4], 0
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
call fcn.01010eb5
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
lea eax, [edi + 0x34]
push eax
lea ecx, [esi + 0x34]
call fcn.01010eb5
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
lea eax, [edi + 0x48]
push eax
lea ecx, [esi + 0x48]
call fcn.01010eb5
mov byte [ebp - 4], 3
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10111c1
Capabilities:
Set current directory

Disassembly:
mov eax, 0x10561a0
call fcn.0101d9b8
sub esp, 0x10
push esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.01010c62
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.01010c62
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.01010c62
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.01025540
test al, al
jne 0x1011210
xor esi, esi
jmp 0x101124b
push 0
lea eax, [ebp - 0x14]
push eax
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.01010eb5
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
call fcn.01027890
test eax, eax
jne 0x101120c
cmp dword [ebp + 0xc], eax
je 0x1011248
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x101120c
xor esi, esi
inc esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.01010c92
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.01010c92
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.01010c92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01010c92
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret 8
Function at 0x1012480
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10562dc
call fcn.0101d9b8
sub esp, 0xc
push esi
lea ecx, [ebp - 0x14]
call fcn.01010c62
and dword [ebp - 4], 0
mov esi, 0x105
push esi
lea ecx, [ebp - 0x14]
call fcn.01011310
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x101252a
push ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.01010a85
lea ecx, [ebp - 0x10]
call fcn.01010c62
mov byte [ebp - 4], 1
push dword [0x1064004]
lea ecx, [ebp - 0x18]
call fcn.0101236d
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.01025680
mov bl, al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.01010c92
test bl, bl
pop ebx
je 0x101251e
push dword [ebp - 0x10]
mov ecx, 0x1064e14
call fcn.0101c853
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.01010c92
jmp 0x101252c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.01010c92
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.01010c92
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1012d24
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x105641a
call fcn.0101d9b8
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp si, di
mov dword [ebp - 0x10], edi
jne 0x1012dfa
call fcn.010165f0
test eax, eax
je 0x1012ec6
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov esi, eax
push esi
call fcn.010172c6
test eax, eax
movzx eax, si
push eax
je 0x1012d6e
push 0x10034fc
jmp 0x1012e89
cmp dword [ebp + 0xc], edi
je 0x1012d7d
push 0x1003480
jmp 0x1012e89
push 0x1003408
push 3
call fcn.0101254c
add esp, 0xc
cmp dword [ebp + 8], edi
jne 0x1012dee
lea ecx, [ebp + 8]
call fcn.01010c62
mov dword [ebp - 4], edi
lea ecx, [ebp + 0xc]
call fcn.01010c62
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
push 0x1388
push eax
call fcn.01011603
lea eax, [ebp + 0xc]
push 0x13c7
push eax
call fcn.01011603
add esp, 0x10
push 0x30
push dword [ebp + 8]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.01010c92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01010c92
mov dword [ebp - 0x10], 0x717
jmp 0x1012ec6
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call edi
cmp ax, si
je 0x1012e31
push ebx
movzx ebx, si
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
push ebx
je 0x1012e21
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x1012e30
push 0x1003390
push 2
call fcn.0101254c
add esp, 0xc
pop ebx
lea eax, [ebp + 0xc]
push eax
push 0x101056f
push 1
push 0x10
push 0
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
test eax, eax
je 0x1012e66
cmp si, word [ebp + 0xc]
jne 0x1012e66
movzx eax, si
push eax
push 0x1003318
push 2
call fcn.0101254c
add esp, 0xc
call fcn.010165f0
test eax, eax
je 0x1012eb3
push esi
call fcn.010173f5
test eax, eax
je 0x1012ea8
call edi
cmp ax, si
jne 0x1012e8d
movzx eax, si
push eax
push 0x10032a0
push 1
jmp 0x1012ebe
call edi
movzx eax, ax
push eax
movzx eax, si
push eax
push 0x1003188
push 1
call fcn.0101254c
add esp, 0x10
jmp 0x1012ec6
movzx eax, si
push eax
push 0x1003100
jmp 0x1012ebc
movzx eax, si
push eax
push 0x1003040
push 2
call fcn.0101254c
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x10173f5
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x1056bde
call fcn.0101d9b8
sub esp, 0x24
push ebx
xor ebx, ebx
cmp dword [0x1064f54], ebx
push esi
push edi
jne 0x1017416
xor eax, eax
jmp 0x101752b
mov ax, word [ebp + 8]
cmp ax, bx
jne 0x1017425
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
lea ecx, [ebp - 0x14]
mov word [0x1064f48], ax
call fcn.01010c62
mov dword [ebp - 4], ebx
push 0xa
lea ecx, [ebp - 0x30]
call fcn.010166b9
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
push eax
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x1064f54
call fcn.01016977
mov byte [ebp - 4], 2
mov byte [ebp - 4], 1
call fcn.01017243
lea ecx, [ebp + 8]
call fcn.01010c62
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x30]
xor edi, edi
jmp 0x10174fe
mov eax, esi
mov esi, dword [esi]
add eax, 8
push eax
lea ecx, [ebp - 0x10]
call fcn.01016977
mov byte [ebp - 4], 4
lea eax, [ebp + 8]
push eax
push ebx
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.01016977
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
call fcn.0101706f
cmp eax, ebx
je 0x10174f2
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x10174f2
push 0x100294c
push 0x1004af0
lea ecx, [ebp + 8]
call fcn.01016ce0
push dword [ebp + 8]
call fcn.01025370
movzx ecx, word [0x1064f48]
cmp eax, ecx
jne 0x10174f2
push dword [ebp - 0x10]
push 0x1064f58
call fcn.01016653
xor edi, edi
inc edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.01016940
cmp esi, ebx
jne 0x101747c
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.01010c92
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x30]
call fcn.010167a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.01010c92
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4