joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e4d0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp byte [esi], 0x3f
push edi
mov edi, ecx
jne 0x46e5ad
mov al, byte [esi + 1]
inc esi
mov dword [esp + 0x10], esi
test al, al
je 0x46e5a6
cmp al, 0x23
je 0x46e5a6
cmp al, 0x61
jl 0x46e502
cmp al, 0x7a
jle 0x46e574
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x46e574
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x46e574
cmp al, 0x2d
je 0x46e574
cmp al, 0x2e
je 0x46e574
cmp al, 0x5f
je 0x46e574
cmp al, 0x7e
je 0x46e574
cmp al, 0x21
je 0x46e574
cmp al, 0x24
je 0x46e574
cmp al, 0x26
je 0x46e574
cmp al, 0x27
je 0x46e574
cmp al, 0x28
je 0x46e574
cmp al, 0x29
je 0x46e574
cmp al, 0x2a
je 0x46e574
cmp al, 0x2b
je 0x46e574
cmp al, 0x2c
je 0x46e574
cmp al, 0x3b
je 0x46e574
cmp al, 0x3d
je 0x46e574
cmp al, 0x3a
je 0x46e574
cmp al, 0x40
je 0x46e574
cmp al, 0x2f
je 0x46e574
cmp al, 0x3f
je 0x46e574
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0x50]
push ecx
mov ecx, edi
call fcn.0046df50
mov esi, dword [esp + 0x10]
jmp 0x46e59c
inc esi
mov byte [esp + 8], al
mov dword [esp + 0x10], esi
cmp al, 0x80
jae 0x46e586
movsx eax, al
jmp 0x46e593
mov edx, dword [esp + 8]
push edx
call fcn.00423840
add esp, 4
push eax
lea ecx, [edi + 0x50]
call fcn.00414690
mov al, byte [esi]
test al, al
jne 0x46e4f2
or dword [edi + 0x108], 0x20
pop edi
mov eax, esi
pop esi
pop ecx
ret 4

Function at 0x46e5c0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp byte [esi], 0x23
mov ebx, ecx
jne 0x46e696
mov al, byte [esi + 1]
inc esi
mov dword [esp + 0x10], esi
test al, al
je 0x46e68f
push edi
lea edi, [ebx + 0x74]
cmp al, 0x61
jl 0x46e5ee
cmp al, 0x7a
jle 0x46e65d
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x46e65d
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x46e65d
cmp al, 0x2d
je 0x46e65d
cmp al, 0x2e
je 0x46e65d
cmp al, 0x5f
je 0x46e65d
cmp al, 0x7e
je 0x46e65d
cmp al, 0x21
je 0x46e65d
cmp al, 0x24
je 0x46e65d
cmp al, 0x26
je 0x46e65d
cmp al, 0x27
je 0x46e65d
cmp al, 0x28
je 0x46e65d
cmp al, 0x29
je 0x46e65d
cmp al, 0x2a
je 0x46e65d
cmp al, 0x2b
je 0x46e65d
cmp al, 0x2c
je 0x46e65d
cmp al, 0x3b
je 0x46e65d
cmp al, 0x3d
je 0x46e65d
cmp al, 0x3a
je 0x46e65d
cmp al, 0x40
je 0x46e65d
cmp al, 0x2f
je 0x46e65d
cmp al, 0x3f
je 0x46e65d
lea eax, [esp + 0x14]
push eax
push edi
mov ecx, ebx
call fcn.0046df50
mov esi, dword [esp + 0x14]
jmp 0x46e684
inc esi
mov byte [esp + 0xc], al
mov dword [esp + 0x14], esi
cmp al, 0x80
jae 0x46e66f
movsx eax, al
jmp 0x46e67c
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00423840
add esp, 4
push eax
mov ecx, edi
call fcn.00414690
mov al, byte [esi]
test al, al
jne 0x46e5e6
pop edi
or dword [ebx + 0x108], 0x40
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x470160
Capabilities:
Delete registry key
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x90]
call fcn.004876c0
lea ecx, [esi + 0x100]
call fcn.004876c0
lea ecx, [esi + 0x58]
call fcn.0048e430
test al, al
je 0x47019a
cmp dword [esi + 0xc8], 0
lea ecx, [esi + 0xc8]
je 0x47019a
pop esi
jmp fcn.0048e430
pop esi
ret

Function at 0x4701a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c8ca8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
mov esi, ecx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], edi
mov word [esp + 0x10], ax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov edx, dword [esi]
mov edx, dword [edx + 0x20]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x48], edi
call edx
test al, al
je 0x470228
lea ebx, [ebx]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, esi
inc edi
call eax
test al, al
jne 0x470210
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x24], 8
jb 0x470249
mov edx, dword [esp + 0x10]
push edx
call fcn.00584768
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00585b7b
add esp, 0x38
ret 4

Function at 0x470270
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5c8ca8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
mov esi, ecx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], edi
mov word [esp + 0x10], ax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x48], edi
call edx
test al, al
je 0x4702f8
lea ebx, [ebx]
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, esi
inc edi
call eax
test al, al
jne 0x4702e0
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x24], 8
jb 0x470319
mov edx, dword [esp + 0x10]
push edx
call fcn.00584768
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00585b7b
add esp, 0x38
ret 4
Function at 0x477b10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ce1ce
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], vtable.wxDDEServer.0
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], eax
xor ecx, ecx
mov word [esi + 0xc], cx
mov dword [esp + 0x18], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push eax
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 1
mov dword [esi + 0x30], vtable.wxListBase.0
call fcn.00443970
mov dword [esi + 0x30], vtable.wxDDEConnectionList.0
mov byte [esp + 0x18], 2
call fcn.00477a50
push esi
mov ecx, 0x68b22c
call fcn.00443990
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x478430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5ce3c5
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0xc4]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], vtable.wxDDEServer.0
xor ebp, ebp
mov dword [esp + 0xcc], 2
cmp dword [esi + 0x1c], ebp
je 0x4785cc
lea edi, [esi + 0xc]
push edi
call fcn.00477ef0
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x4785cc
mov eax, dword [0x695c90]
push 2
push ebp
push ebx
push eax
call sub.USER32.dll_DdeNameService
test eax, eax
jne 0x4785c0
push str.Failed_to_unregister_DDE_server__s
lea ecx, [esp + 0x7c]
call fcn.00402bb0
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], ebp
mov word [esp + 0x40], cx
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
xor edx, edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], dx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov byte [esp + 0xcc], 5
call fcn.00425e70
cmp eax, ebp
je 0x478529
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x80]
push ecx
mov ecx, eax
call fcn.00429320
cmp eax, ebp
jne 0x478536
lea edx, [esp + 0x78]
push edx
call fcn.004292f0
add esp, 4
push eax
lea ecx, [esp + 0x68]
call fcn.00406160
push ebp
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x28], esp
push eax
mov ecx, edi
mov byte [esp + 0xe0], 6
call fcn.00406280
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0xb0]
push edx
call fcn.00413c20
add esp, 0x14
push eax
mov byte [esp + 0xd4], 7
call fcn.00477660
add esp, 8
lea ecx, [esp + 0x9c]
call fcn.00405eb0
lea ecx, [esp + 0x64]
mov byte [esp + 0xcc], 5
call fcn.004020c0
lea ecx, [esp + 0x1c]
call fcn.00405eb0
lea ecx, [esp + 0x40]
call fcn.00405eb0
lea ecx, [esp + 0x78]
mov byte [esp + 0xcc], 2
call fcn.00405eb0
mov eax, dword [0x695c90]
push ebx
push eax
call sub.USER32.dll_DdeFreeStringHandle
push esi
mov ecx, 0x68b22c
call fcn.00443df0
mov eax, dword [esi + 0x3c]
cmp eax, ebp
je 0x4785f3
mov edi, edi
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
mov edi, dword [eax + 0xc]
mov eax, dword [edx + 0x3c]
call eax
mov eax, edi
cmp edi, ebp
jne 0x4785e0
mov eax, dword [esi + 0x3c]
cmp eax, ebp
je 0x478618
lea ebx, [ebx]
mov ecx, dword [eax + 8]
mov edi, dword [eax + 0xc]
cmp ecx, ebp
je 0x478612
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, edi
cmp edi, ebp
jne 0x478600
lea ecx, [esi + 0x30]
mov byte [esp + 0xcc], 1
call fcn.00443f50
mov ecx, dword [esi + 0x28]
push ecx
call fcn.005844d1
add esp, 4
cmp dword [esi + 0x20], 8
jb 0x478646
mov eax, dword [esi + 0xc]
push eax
call fcn.00584768
add esp, 4
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], ebp
xor edx, edx
mov word [esi + 0xc], dx
mov ecx, esi
mov dword [esp + 0xcc], 0xffffffff
mov dword [esi], vtable.wxObject.0
call fcn.00423980
mov ecx, dword [esp + 0xc4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.00585b7b
add esp, 0xbc
ret
Function at 0x479ad0
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
je 0x479bdf
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x20]
xor ebp, ebp
cmp edi, 3
jb 0x479b66
add ebp, 4
test ecx, ecx
je 0x479b5b
cmp ebp, esi
ja 0x479b75
movzx eax, byte [edx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [edx]
movzx ebx, byte [edx + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [edx + 1]
movzx ebx, byte [edx + 2]
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movzx eax, byte [edx + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
sub edi, 3
add edx, 3
cmp edi, 3
jae 0x479af3
test edi, edi
je 0x479bd8
add ebp, 4
test ecx, ecx
je 0x479bd8
cmp ebp, esi
jbe 0x479b7d
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
cmp edi, 2
jne 0x479b87
mov al, byte [edx + 1]
jmp 0x479b89
xor al, al
movzx esi, byte [edx]
shr esi, 2
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
movzx edx, byte [edx]
movzx esi, al
and edx, 3
shl edx, 4
mov eax, esi
shr eax, 4
or edx, eax
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
cmp edi, 2
jne 0x479bd0
and esi, 0xf
mov al, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
pop edi
mov byte [ecx + 2], al
pop esi
mov eax, ebp
pop ebp
mov byte [ecx + 3], 0x3d
pop ebx
ret
mov al, 0x3d
mov byte [ecx + 2], al
mov byte [ecx + 3], al
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
or eax, 0xffffffff
ret

Function at 0x47a130
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5da428
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov esi, dword [esp + 0x44]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0xc], 0
call eax
push eax
push esi
mov dword [esp + 0x44], 0
call fcn.00461870
mov ecx, dword [esp + 0x30]
push ecx
call fcn.005844d1
add esp, 0xc
cmp dword [esp + 0x20], 8
jb 0x47a1a7
mov edx, dword [esp + 0xc]
push edx
call fcn.00584768
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00585b7b
add esp, 0x38
ret 4
Function at 0x47a630
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x208
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x204], eax
mov edx, dword [esp + 0x210]
push esi
mov esi, dword [esp + 0x210]
push edi
push 0x100
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 8]
push edx
xor edi, edi
push eax
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x47a68a
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
xor ecx, ecx
mov word [esi], cx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
jmp 0x47a696
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.00402c90
mov ecx, dword [esp + 0x20c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00585b7b
add esp, 0x208
ret 8

Function at 0x47abb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ce7b6
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x148], eax
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x154]
mov dword fs:[0], eax
mov esi, dword [esp + 0x164]
push 0x5fec74
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.00402bb0
lea ecx, [esp + 0x30]
mov dword [esp + 0x15c], 0
call fcn.00460220
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
mov byte [esp + 0x160], 1
call fcn.004609a0
push eax
mov ecx, esi
call fcn.004607b0
lea ecx, [esp + 0x30]
call fcn.00426610
mov edx, dword [esp + 0x28]
push edx
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x20], 8
jb 0x47ac5f
mov eax, dword [esp + 0xc]
push eax
call fcn.00584768
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x154]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.00585b7b
add esp, 0x158
ret 4
Function at 0x47b980
Capabilities:
Identify system language via api

Disassembly:
push 0xffffffffffffffff
push 0x5ceaf3
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0xe4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0xfc]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x10c]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [esp + 0x104], esi
mov dword [esp + 0x1c], 1
call fcn.0047a6c0
test al, al
je 0x47bb1b
call fcn.00432d10
cmp eax, 0x1000
jl 0x47bad6
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push 8
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [0x695cb8]
test eax, eax
je 0x47bb7c
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0058229a
mov ebp, eax
add esp, 4
mov dword [esp + 0x24], ebp
lea eax, [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x1c]
push ecx
push 8
mov dword [esp + 0x114], 1
call dword [0x695cb8]
test eax, eax
je 0x47bac8
xor edi, edi
mov esi, ebp
cmp dword [esp + 0x14], edi
jbe 0x47bac8
push esi
lea ecx, [esp + 0x2c]
call fcn.00402c90
lea edx, [esp + 0x28]
push edx
mov ecx, ebx
mov byte [esp + 0x108], 2
call fcn.0047b8c0
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x38]
push ecx
lea esi, [esi + eax*2 + 2]
mov byte [esp + 0x108], 1
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x3c], 8
jb 0x47bac1
mov edx, dword [esp + 0x28]
push edx
call fcn.00584768
add esp, 4
inc edi
cmp edi, dword [esp + 0x14]
jb 0x47ba72
push ebp
call fcn.00585c9e
add esp, 4
jmp 0x47bb7c
push 0x55
lea eax, [esp + 0x50]
push eax
call dword [0x695cb4]
test eax, eax
je 0x47bb7c
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00402c90
lea edx, [esp + 0x28]
push edx
mov ecx, ebx
mov dword [esp + 0x108], 3
call fcn.0047b8c0
lea ecx, [esp + 0x28]
call fcn.00405eb0
jmp 0x47bb7c
call fcn.0043a340
mov ebp, eax
mov edi, dword [ebp]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, 0x1400
cmp ax, cx
je 0x47bb7c
mov esi, eax
and esi, 0x3ff
shr eax, 0xa
xor ecx, ecx
test edi, edi
je 0x47bb7c
mov ebp, dword [ebp + 8]
lea edx, [ebp + 0x74]
nop
cmp dword [edx - 4], esi
jne 0x47bb59
cmp dword [edx], eax
je 0x47bb66
inc ecx
add edx, 0xc4
cmp ecx, edi
jb 0x47bb50
jmp 0x47bb7c
cmp ecx, edi
jae 0x47bb7c
imul ecx, ecx, 0xc4
lea edx, [ecx + ebp + 0x28]
push edx
mov ecx, ebx
call fcn.0047b8c0
mov eax, ebx
mov ecx, dword [esp + 0xfc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xe4]
xor ecx, esp
call fcn.00585b7b
add esp, 0xf4
ret
Function at 0x480770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cf048
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], eax
call fcn.0041de00
mov ecx, dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.0041d2b0
push eax
push edi
push esi
call fcn.00423450
add esp, 0x10
cmp byte [esp + 0x2c], 0
mov edi, eax
je 0x480815
mov esi, dword [esp + 0x24]
test esi, esi
je 0x480815
mov edx, dword [esi + 0x1c]
push edx
call fcn.005844d1
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x4807f7
mov eax, dword [esi]
push eax
call fcn.00584768
add esp, 4
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push esi
mov word [esi], cx
call fcn.00584768
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14

Function at 0x480b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cf0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00420510
mov dword [esp + 8], eax
mov dword [esp + 0x24], 0
call fcn.00420510
mov dword [esp + 0xc], eax
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 0x5fe464
push eax
mov byte [esp + 0x30], 1
call fcn.00402340
add esp, 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov esi, dword [esi + 8]
lea ecx, [esp + 8]
mov dword [esp + 0x24], 2
call fcn.0041de00
mov ecx, dword [esp + 0x2c]
push esi
push eax
push ecx
call fcn.00423450
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.004020c0
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 4

Function at 0x480d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cf0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00420510
mov dword [esp + 8], eax
mov dword [esp + 0x24], 0
call fcn.00420510
mov dword [esp + 0xc], eax
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 0x5fefa0
push eax
mov byte [esp + 0x30], 1
call fcn.00402340
add esp, 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
movzx esi, byte [esi + 8]
lea ecx, [esp + 8]
mov dword [esp + 0x24], 2
call fcn.0041de00
mov ecx, dword [esp + 0x2c]
push esi
push eax
push ecx
call fcn.00423450
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.004020c0
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 4
Function at 0x480f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cf0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00420510
mov dword [esp + 8], eax
mov dword [esp + 0x24], 0
call fcn.00420510
mov dword [esp + 0xc], eax
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 0x5fef78
push eax
mov byte [esp + 0x30], 1
call fcn.00402340
add esp, 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov esi, dword [esi + 8]
lea ecx, [esp + 8]
mov dword [esp + 0x24], 2
call fcn.0041de00
mov ecx, dword [esp + 0x2c]
push esi
push eax
push ecx
call fcn.00423450
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.004020c0
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 4

Function at 0x480ff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5cf140
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [esp + 0x50]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov edx, dword [ecx]
mov edx, dword [edx + 8]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x4c], ebx
call edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.00406280
push eax
push esi
mov byte [esp + 0x50], 1
call fcn.00421be0
add esp, 8
cmp byte [esp + 0x14], bl
je 0x4810b1
mov esi, dword [esp + 0xc]
cmp esi, ebx
je 0x4810b1
mov ecx, dword [esi + 0x1c]
push ecx
call fcn.005844d1
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x481099
mov edx, dword [esi]
push edx
call fcn.00584768
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push esi
mov word [esi], ax
call fcn.00584768
add esp, 4
mov ecx, dword [esp + 0x34]
push ecx
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x2c], 8
jb 0x4810d2
mov edx, dword [esp + 0x18]
push edx
call fcn.00584768
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00585b7b
add esp, 0x40
ret 4
Function at 0x481100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cf188
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00420510
mov dword [esp + 0xc], eax
xor edi, edi
mov dword [esp + 0x28], edi
call fcn.00420510
mov dword [esp + 0x10], eax
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push str._lld
push eax
mov byte [esp + 0x34], 1
call fcn.00402340
add esp, 0xc
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 2
call fcn.0041de00
mov ecx, dword [esp + 0x30]
push esi
push edi
push eax
push ecx
call fcn.00423450
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004020c0
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x4811b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cf188
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00420510
mov dword [esp + 0xc], eax
xor edi, edi
mov dword [esp + 0x28], edi
call fcn.00420510
mov dword [esp + 0x10], eax
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push str._llu
push eax
mov byte [esp + 0x34], 1
call fcn.00402340
add esp, 0xc
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 2
call fcn.0041de00
mov ecx, dword [esp + 0x30]
push esi
push edi
push eax
push ecx
call fcn.00423450
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004020c0
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4