joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c6a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ecx
mov dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0
jne 0x40c6f5
push ebx
xor ebx, 0x12635
add ebx, 0x11c79
pop ebx
push edx
push edx
add esp, 4
sub edx, 0x4c79
call 0x40c6dc
add byte [ebx], dh
inc edx
cmp al, 0x3e
dec edi
cmp byte [ebx], bh
xor al, 0x83
les eax, [ecx + eax*4]
ljmp 0xc75a
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0xe0], 0
push esi
jmp 0x40c715
and esi, 0xc637
sub esi, 0x8a32
pop esi
push ecx
push edi
add esp, 4
or ecx, 0xfa3a
jmp 0x40c736
xor ecx, 0x115ed
pop ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
jne 0x40c792
push ecx
push ecx
add esp, 4
add ecx, 0x16292
pop ecx
push edi
or edi, 0xcad7
call 0x40c771
add byte [ecx], bh
dec ebp
dec edx
inc ebx
dec ebx
cmp al, byte [edi + 0x3f]
cmp al, 0x83
les eax, [ecx + eax*4]
iretd
mov edx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x7c]
add eax, dword [edx + 0x3c]
invalid
invalid

Function at 0x40c771
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ecx
mov dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0
jne 0x40c6f5
push ebx
xor ebx, 0x12635
add ebx, 0x11c79
pop ebx
push edx
push edx
add esp, 4
sub edx, 0x4c79
call 0x40c6dc
add byte [ebx], dh
inc edx
cmp al, 0x3e
dec edi
cmp byte [ebx], bh
xor al, 0x83
les eax, [ecx + eax*4]
ljmp 0xc75a
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0xe0], 0
push esi
jmp 0x40c715
and esi, 0xc637
sub esi, 0x8a32
pop esi
push ecx
push edi
add esp, 4
or ecx, 0xfa3a
jmp 0x40c736
xor ecx, 0x115ed
pop ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
jne 0x40c792
push ecx
push ecx
add esp, 4
add ecx, 0x16292
pop ecx
push edi
or edi, 0xcad7
call 0x40c771
add byte [ecx], bh
dec ebp
dec edx
inc ebx
dec ebx
cmp al, byte [edi + 0x3f]
cmp al, 0x83
les eax, [ecx + eax*4]
iretd
mov edx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x7c]
add eax, dword [edx + 0x3c]
invalid
invalid

Function at 0x40c880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
test byte [ebx], al
lea esi, [esp + edi*8 - 0x72760001]
sub al, 0xff
invalid
Function at 0x40cd2f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
add esp, 4
or esi, 0xf0d8
or esi, 0x12865
add esi, 0x11717
or esi, 0xf0d
pop esi
mov edx, dword [ebp - 0x458]
mov dword [ebp - 0x90], edx
jmp 0x40cc6c
cmp dword [ebp - 0x90], 0
je 0x40cd15
push edx
push edi
add esp, 4
jmp 0x40cc86
add edx, 0x17a1
sub edx, 0x160df
pop edx
push ecx
push edx
add esp, 4
sub ecx, 0x2ec1
or ecx, 0xc2f
xor ecx, 0xa284
pop ecx
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x45c], ecx
mov edx, dword [ebp - 0x45c]
mov dword [ebp - 0x460], edx
lea eax, [ebp - 0x2b0]
push eax
call dword [ebp - 0x460]
test eax, eax
jne 0x40cd15
push eax
xor eax, 0x12c85
jmp 0x40cce4
pop eax
push edi
call 0x40ccf6
add byte [ecx + 0x3d], al
inc edx
xor al, 0x3e
cmp eax, 0x3c3a4f43
add esp, 4
sub edi, 0x2034
and edi, 0x1114c
pop edi
mov dword [ebp - 0x1b8], 0
jmp 0x40d7bc
push edi
and edi, 0x3cf5
sub edi, 0x3fb6
call 0x40cd2f
add byte [ecx + ecx*2], dh
cmp byte ss:[ebp + 0x3e], al
inc ebx
add esp, 4
sub edi, 0x6ec8
pop edi
push ebx
sub ebx, 0x16e4a
sub ebx, 0xd97c
pop ebx
push edi
push esi
add esp, 4
and edi, 0x11e8c
jmp 0x40cd59
pop edi
push ebx
jmp 0x40cd62
call 0x40cd6f
add byte [edi], bh
inc edx
inc edi
xor dh, byte [0xc4833e3c]
add al, 0x81
ret
push 0
call dword [ebp - 0x1b8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cd6f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
add esp, 4
or esi, 0xf0d8
or esi, 0x12865
add esi, 0x11717
or esi, 0xf0d
pop esi
mov edx, dword [ebp - 0x458]
mov dword [ebp - 0x90], edx
jmp 0x40cc6c
cmp dword [ebp - 0x90], 0
je 0x40cd15
push edx
push edi
add esp, 4
jmp 0x40cc86
add edx, 0x17a1
sub edx, 0x160df
pop edx
push ecx
push edx
add esp, 4
sub ecx, 0x2ec1
or ecx, 0xc2f
xor ecx, 0xa284
pop ecx
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x45c], ecx
mov edx, dword [ebp - 0x45c]
mov dword [ebp - 0x460], edx
lea eax, [ebp - 0x2b0]
push eax
call dword [ebp - 0x460]
test eax, eax
jne 0x40cd15
push eax
xor eax, 0x12c85
jmp 0x40cce4
pop eax
push edi
call 0x40ccf6
add byte [ecx + 0x3d], al
inc edx
xor al, 0x3e
cmp eax, 0x3c3a4f43
add esp, 4
sub edi, 0x2034
and edi, 0x1114c
pop edi
mov dword [ebp - 0x1b8], 0
jmp 0x40d7bc
push edi
and edi, 0x3cf5
sub edi, 0x3fb6
call 0x40cd2f
add byte [ecx + ecx*2], dh
cmp byte ss:[ebp + 0x3e], al
inc ebx
add esp, 4
sub edi, 0x6ec8
pop edi
push ebx
sub ebx, 0x16e4a
sub ebx, 0xd97c
pop ebx
push edi
push esi
add esp, 4
and edi, 0x11e8c
jmp 0x40cd59
pop edi
push ebx
jmp 0x40cd62
call 0x40cd6f
add byte [edi], bh
inc edx
inc edi
xor dh, byte [0xc4833e3c]
add al, 0x81
ret
push 0
call dword [ebp - 0x1b8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cd96
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xbabe
pop edx
push edi
or edi, 0x10943
pop edi
push esi
and esi, 0x41cf
jmp 0x40cdb7
pop esi
mov edx, dword [ebp - 0x464]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x468], eax
push eax
and eax, 0xa8aa
call 0x40cddd
add byte [edx + 0x4d], cl
inc ecx
dec ebp
xor eax, 0x4249423e
add esp, 4
call 0x40cdef
add byte [ecx + 0x4f], cl
dec ecx
dec ebx
dec esp
dec edx
cmp byte [edi - 0x7d], al
les eax, [ecx + eax*4]
invalid

Function at 0x40cddd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xbabe
pop edx
push edi
or edi, 0x10943
pop edi
push esi
and esi, 0x41cf
jmp 0x40cdb7
pop esi
mov edx, dword [ebp - 0x464]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x468], eax
push eax
and eax, 0xa8aa
call 0x40cddd
add byte [edx + 0x4d], cl
inc ecx
dec ebp
xor eax, 0x4249423e
add esp, 4
call 0x40cdef
add byte [ecx + 0x4f], cl
dec ecx
dec ebx
dec esp
dec edx
cmp byte [edi - 0x7d], al
les eax, [ecx + eax*4]
invalid

Function at 0x40cdef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xbabe
pop edx
push edi
or edi, 0x10943
pop edi
push esi
and esi, 0x41cf
jmp 0x40cdb7
pop esi
mov edx, dword [ebp - 0x464]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x468], eax
push eax
and eax, 0xa8aa
call 0x40cddd
add byte [edx + 0x4d], cl
inc ecx
dec ebp
xor eax, 0x4249423e
add esp, 4
call 0x40cdef
add byte [ecx + 0x4f], cl
dec ecx
dec ebx
dec esp
dec edx
cmp byte [edi - 0x7d], al
les eax, [ecx + eax*4]
invalid
Function at 0x40d054
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
or ebx, 0xad74
call fcn.0040cefd
add byte [edx], bh
cmp dword [ebx], esi
dec ecx
aas
cmp bh, byte [ecx]
aas
cmp eax, dword [ebx - 0x1c7efb3c]
add esp, 4
and ebx, 0x1685e
pop ebx
push eax
add esp, 4
xor eax, 0xc639
pop eax
mov eax, dword [ebp - 0x27c]
mov cx, word [eax]
mov word [ebp - 0x1de], cx
mov edx, dword [ebp - 0x27c]
add edx, 2
mov dword [ebp - 0x27c], edx
mov ax, word [ebp - 0x1de]
mov word [ebp - 0x28], ax
push edi
sub edi, 0x4294
and edi, 0x1216e
add edi, 0xe89b
xor edi, 0x8a16
pop edi
push edx
jmp 0x40d046
call 0x40d054
add byte [edx + 0x35], cl
dec ebx
inc esi
dec eax
xor eax, 0xc483424f
add al, 0x5a
movzx ecx, word [ebp - 0x28]
test ecx, ecx
jne 0x40d075
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x358], edx
jmp 0x40d0f8
movzx ecx, word [ebp - 0x50]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x40cf6e
movzx eax, word [ebp - 0x50]
xor eax, 0x20
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x40cf6e
push edx
xor edx, 0x3dc1
pop edx
push eax
push eax
add esp, 4
add eax, 0x1577a
and eax, 0x4fdd
call 0x40d0c0
add byte [edi], bh
cmp al, 0x38
dec edx
inc eax
cmp dh, byte [edi + edi]
xor al, byte [ebx - 0x377efb3c]
invalid
cmp dword [ebp - 0x358], 0
jne 0x40d141
push eax
sub eax, 0x1fad
sub eax, 0x3cdb
pop eax
push esi
call 0x40d11f
add byte [eax + 0x39], al
inc ebx
cmp cl, byte [ebx + 0x4e]
cmp eax, 0xc4834b3f
add al, 0x5e
push edi
sub edi, 0x1413a
jmp 0x40d132
pop edi
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x74], edx
jmp 0x40d1d8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov dword [ebp - 0xb4], ecx
push edi
xor edi, 0x1329e
or edi, 0x88a9
pop edi
push esi
push eax
add esp, 4
xor esi, 0x11d8c
and esi, 0x43ff
pop esi
push edx
push esi
add esp, 4
and edx, 0xa30f
xor edx, 0x12c1c
pop edx
mov edx, dword [ebp - 0xb4]
cmp edx, dword [ebp - 0x280]
je 0x40d19f
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 0x30], 0
jne 0x40cee3
push eax
or eax, 0x126af
sub eax, 0x10252
jmp 0x40d1b2
pop eax
push esi
push ecx
add esp, 4
or esi, 0x16c8a
xor esi, 0x4468
pop esi
push edi
push edx
add esp, 4
sub edi, 0xda4
pop edi
mov dword [ebp - 0x74], 0
Function at 0x40d0c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
or ebx, 0xad74
call fcn.0040cefd
add byte [edx], bh
cmp dword [ebx], esi
dec ecx
aas
cmp bh, byte [ecx]
aas
cmp eax, dword [ebx - 0x1c7efb3c]
add esp, 4
and ebx, 0x1685e
pop ebx
push eax
add esp, 4
xor eax, 0xc639
pop eax
mov eax, dword [ebp - 0x27c]
mov cx, word [eax]
mov word [ebp - 0x1de], cx
mov edx, dword [ebp - 0x27c]
add edx, 2
mov dword [ebp - 0x27c], edx
mov ax, word [ebp - 0x1de]
mov word [ebp - 0x28], ax
push edi
sub edi, 0x4294
and edi, 0x1216e
add edi, 0xe89b
xor edi, 0x8a16
pop edi
push edx
jmp 0x40d046
call 0x40d054
add byte [edx + 0x35], cl
dec ebx
inc esi
dec eax
xor eax, 0xc483424f
add al, 0x5a
movzx ecx, word [ebp - 0x28]
test ecx, ecx
jne 0x40d075
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x358], edx
jmp 0x40d0f8
movzx ecx, word [ebp - 0x50]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x40cf6e
movzx eax, word [ebp - 0x50]
xor eax, 0x20
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x40cf6e
push edx
xor edx, 0x3dc1
pop edx
push eax
push eax
add esp, 4
add eax, 0x1577a
and eax, 0x4fdd
call 0x40d0c0
add byte [edi], bh
cmp al, 0x38
dec edx
inc eax
cmp dh, byte [edi + edi]
xor al, byte [ebx - 0x377efb3c]
invalid
cmp dword [ebp - 0x358], 0
jne 0x40d141
push eax
sub eax, 0x1fad
sub eax, 0x3cdb
pop eax
push esi
call 0x40d11f
add byte [eax + 0x39], al
inc ebx
cmp cl, byte [ebx + 0x4e]
cmp eax, 0xc4834b3f
add al, 0x5e
push edi
sub edi, 0x1413a
jmp 0x40d132
pop edi
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x74], edx
jmp 0x40d1d8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov dword [ebp - 0xb4], ecx
push edi
xor edi, 0x1329e
or edi, 0x88a9
pop edi
push esi
push eax
add esp, 4
xor esi, 0x11d8c
and esi, 0x43ff
pop esi
push edx
push esi
add esp, 4
and edx, 0xa30f
xor edx, 0x12c1c
pop edx
mov edx, dword [ebp - 0xb4]
cmp edx, dword [ebp - 0x280]
je 0x40d19f
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 0x30], 0
jne 0x40cee3
push eax
or eax, 0x126af
sub eax, 0x10252
jmp 0x40d1b2
pop eax
push esi
push ecx
add esp, 4
or esi, 0x16c8a
xor esi, 0x4468
pop esi
push edi
push edx
add esp, 4
sub edi, 0xda4
pop edi
mov dword [ebp - 0x74], 0
Function at 0x40d11f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
or ebx, 0xad74
call fcn.0040cefd
add byte [edx], bh
cmp dword [ebx], esi
dec ecx
aas
cmp bh, byte [ecx]
aas
cmp eax, dword [ebx - 0x1c7efb3c]
add esp, 4
and ebx, 0x1685e
pop ebx
push eax
add esp, 4
xor eax, 0xc639
pop eax
mov eax, dword [ebp - 0x27c]
mov cx, word [eax]
mov word [ebp - 0x1de], cx
mov edx, dword [ebp - 0x27c]
add edx, 2
mov dword [ebp - 0x27c], edx
mov ax, word [ebp - 0x1de]
mov word [ebp - 0x28], ax
push edi
sub edi, 0x4294
and edi, 0x1216e
add edi, 0xe89b
xor edi, 0x8a16
pop edi
push edx
jmp 0x40d046
call 0x40d054
add byte [edx + 0x35], cl
dec ebx
inc esi
dec eax
xor eax, 0xc483424f
add al, 0x5a
movzx ecx, word [ebp - 0x28]
test ecx, ecx
jne 0x40d075
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x358], edx
jmp 0x40d0f8
movzx ecx, word [ebp - 0x50]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x40cf6e
movzx eax, word [ebp - 0x50]
xor eax, 0x20
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x40cf6e
push edx
xor edx, 0x3dc1
pop edx
push eax
push eax
add esp, 4
add eax, 0x1577a
and eax, 0x4fdd
call 0x40d0c0
add byte [edi], bh
cmp al, 0x38
dec edx
inc eax
cmp dh, byte [edi + edi]
xor al, byte [ebx - 0x377efb3c]
invalid
cmp dword [ebp - 0x358], 0
jne 0x40d141
push eax
sub eax, 0x1fad
sub eax, 0x3cdb
pop eax
push esi
call 0x40d11f
add byte [eax + 0x39], al
inc ebx
cmp cl, byte [ebx + 0x4e]
cmp eax, 0xc4834b3f
add al, 0x5e
push edi
sub edi, 0x1413a
jmp 0x40d132
pop edi
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x74], edx
jmp 0x40d1d8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov dword [ebp - 0xb4], ecx
push edi
xor edi, 0x1329e
or edi, 0x88a9
pop edi
push esi
push eax
add esp, 4
xor esi, 0x11d8c
and esi, 0x43ff
pop esi
push edx
push esi
add esp, 4
and edx, 0xa30f
xor edx, 0x12c1c
pop edx
mov edx, dword [ebp - 0xb4]
cmp edx, dword [ebp - 0x280]
je 0x40d19f
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 0x30], 0
jne 0x40cee3
push eax
or eax, 0x126af
sub eax, 0x10252
jmp 0x40d1b2
pop eax
push esi
push ecx
add esp, 4
or esi, 0x16c8a
xor esi, 0x4468
pop esi
push edi
push edx
add esp, 4
sub edi, 0xda4
pop edi
mov dword [ebp - 0x74], 0
Function at 0x40ec80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424128
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4304f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
mov ebx, 8
sub eax, ebx
or eax, ecx
jge 0x40ece9
mov eax, ebx
lea ecx, [ebp - 0x10]
call fcn.00401be0
mov esi, dword [ebp - 0x10]
cmp dword [esi - 8], ebx
jge 0x40ecf8
push 0x80070057
call fcn.00401000
push ebx
push esi
push 9
xor eax, eax
mov dword [esi - 0xc], ebx
push 0x800
mov word [esi + 0x10], ax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [esi - 4], 1
jle 0x40ed26
mov ecx, dword [esi - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00401700
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x42bd88
push esi
call fcn.004146d4
lea eax, [esi - 0x10]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ed5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
mov ebx, eax
shr ax, 0xa
and ebx, 0x3ff
movzx esi, ax
lea eax, [ebx - 4]
cmp eax, 0x1a
ja case.0x40ed79.13
jmp dword [eax*4 + 0x40ee94]
cmp esi, 2
jne 0x40ee66
mov eax, 0x432b4c
jmp 0x40ee6b
mov eax, 0x432b50
jmp 0x40ee6b
mov eax, 0x432b80
jmp 0x40ee6b
mov eax, 0x432b58
jmp 0x40ee6b
cmp esi, 2
jne 0x40edc0
mov eax, 0x432b64
jmp 0x40ee6b
mov eax, 0x432b60
jmp 0x40ee6b
mov eax, 0x432b6c
jmp 0x40ee6b
mov eax, 0x432b74
jmp 0x40ee6b
mov eax, 0x432b88
jmp 0x40ee6b
mov eax, 0x432b94
jmp 0x40ee6b
mov eax, 0x432b5c
jmp 0x40ee6b
mov eax, 0x432b54
jmp 0x40ee6b
mov eax, 0x432b68
jmp 0x40ee6b
mov eax, 0x432b70
jmp 0x40ee6b
mov eax, 0x432b84
jmp 0x40ee6b
cmp esi, 1
jne 0x40ee1e
mov eax, 0x432b8c
jmp 0x40ee6b
mov eax, 0x432b90
jmp 0x40ee6b
mov eax, 0x432b78
jmp 0x40ee6b
mov eax, 0x432b7c
jmp 0x40ee6b
cmp esi, 3
je 0x40ee44
cmp esi, 2
je 0x40ee44
mov eax, 0x432b9c
jmp 0x40ee6b
mov eax, 0x432b98
jmp 0x40ee6b
mov eax, 0x432ba0
jmp 0x40ee6b
mov eax, 0x432ba4
jmp 0x40ee6b
push str.Unknown_current_OS_language.__defaulting_to_English_
call fcn.004116f0
add esp, 4
mov eax, 0x432b48
call fcn.004013d0
mov edx, dword [edi]
push edx
push esi
push ebx
push str.Got_Current_OS_Language__primaryLangID:__d_subLangID:__d__which_translates_to_EAD_language__s
call fcn.004116d0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ef00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423f50
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4304f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10
lea eax, [ebp - 0x20]
push eax
push 0x5a
push 0x400
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x40efaa
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.00412580
mov edi, dword [ebp - 0x24]
push edi
push esi
push str.GetCountryCodeFromOS_failed:__d___s_
call fcn.00411710
lea eax, [edi - 0x10]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40efa6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x40efee
lea ecx, [ebp - 0x24]
push ecx
lea esi, [ebp - 0x20]
call fcn.0040f100
mov dword [ebp - 4], 1
mov ebx, dword [eax]
mov eax, edi
call fcn.00406eb0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40efec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413430
mov esp, ebp
pop ebp
ret
Function at 0x411320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
xor al, al
mov ebx, ecx
test edi, edi
je 0x41136f
cmp dword [ebx + 8], 0xffffffff
je 0x41136f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebx + 8]
push 0
mov esi, eax
lea eax, [ebp + 8]
push eax
add esi, esi
push esi
push edi
push ecx
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41136c
cmp esi, dword [ebp + 8]
pop esi
pop edi
sete al
pop ebx
pop ebp
ret 4
xor al, al
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x412e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423d19
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4304f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x10]
push eax
push str.SOFTWAREElectronic_ArtsEA_Core
mov dword [ebp - 4], ebx
mov edi, 1
push 0x80000002
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x412f58
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
push ebx
lea edx, [ebp - 0x18]
push edx
push ebx
push eax
push ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412f4e
mov edi, dword [ebp - 0x14]
inc edi
cmp edi, ebx
jge 0x412ed9
push 0x80070057
call fcn.00401000
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x412ef5
mov eax, edi
mov ecx, esi
call fcn.00401be0
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x412ecf
mov dword [eax - 0xc], edi
mov edx, dword [esi]
xor ecx, ecx
mov word [edx + edi*2], cx
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov eax, dword [esi]
mov ecx, dword [eax - 8]
cmp eax, ebx
jne 0x412f2e
xor eax, eax
jmp 0x412f3c
push ecx
push eax
call fcn.00413c94
add esp, 8
cmp eax, ebx
jl 0x412ecf
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x412ecf
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4304f0]
jne 0x41343a
repz ret
jmp fcn.004159d4
Function at 0x41bcda
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4304f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416691
and dword [ebp - 0x14], 0
cmp dword [0x4326b4], 0
mov dword [ebp - 0x18], eax
jne 0x41bd8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41be35
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42831c
push ebx
call edi
test eax, eax
je 0x41be35
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4326b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4326b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4326bc], eax
call edi
push eax
call esi
mov dword [0x4326c4], eax
test eax, eax
je 0x41bd8d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4326c0], eax
mov eax, dword [0x4326c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41bde6
cmp dword [0x4326c4], ecx
je 0x41bde6
push eax
call esi
push dword [0x4326c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41bde6
test ebx, ebx
je 0x41bde6
call edi
test eax, eax
je 0x41bddd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41bddd
test byte [ebp - 8], 1
jne 0x41bde6
or dword [ebp + 0x10], 0x200000
jmp 0x41be19
mov eax, dword [0x4326b8]
cmp eax, dword [ebp - 0x18]
je 0x41be19
push eax
call esi
test eax, eax
je 0x41be19
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41be19
mov eax, dword [0x4326bc]
cmp eax, dword [ebp - 0x18]
je 0x41be19
push eax
call esi
test eax, eax
je 0x41be19
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4326b4]
call esi
test eax, eax
je 0x41be35
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41be37
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413430
leave
ret