joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51df2cb3
Capabilities:
Check os version
Get keyboard layout

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xd0
mov eax, dword [0x51e8c240]
push ebx
push esi
mov dword [ebp + 0x74], eax
push edi
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
mov dword [0x51e85cc0], ebx
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor edi, edi
inc edi
cmp dword [ebp - 0x10], edi
je 0x51e2f760
cmp dword [ebp - 0x10], 2
jne 0x51df2d3b
mov eax, dword [0x51e85cbc]
cmp eax, 4
je 0x51e2f821
cmp eax, 5
jl 0x51df2d3b
mov esi, dword [sym.imp.KERNEL32.dll_IsValidLocale]
or byte [0x51e85cc1], 2
push edi
push 0x401
call esi
test eax, eax
jne 0x51e2f8d7
push edi
push 0x40d
call esi
test eax, eax
jne 0x51e2f8e3
and dword [0x51e8b564], 0
lea esp, [ebp - 0x64]
mov ecx, dword [ebp + 0x74]
call fcn.51e03d50
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
or byte [0x51e85cc1], 4
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, eax
cmp esi, ebx
je 0x51df2d34
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push esi
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push edi
call esi
mov ebx, eax
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
push ebx
push edi
call esi
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
xor ebx, ebx
cmp byte [ebp - 0x24], 0xb2
jne 0x51e2f7be
or dword [0x51e85cc0], 7
inc ebx
mov dword [0x51eb794c], ebx
jmp 0x51e2f7bf
inc ebx
cmp byte [ebp - 0x24], 0xb1
jne 0x51e2f7d2
or dword [0x51e85cc0], 0x70
mov dword [0x51eb794c], ebx
mov eax, dword [ebp - 0x1c]
shl eax, 0x10
add eax, dword [ebp - 0x18]
cmp eax, 0x4000a
jae 0x51df2d34
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
call esi
mov edi, 0x3ff
and ax, di
cmp ax, 4
je 0x51e2f816
call esi
and ax, di
cmp ax, 0x11
je 0x51e2f816
call esi
and ax, di
cmp ax, 0x12
jne 0x51df2d34
mov dword [0x51eb7950], ebx
jmp 0x51df2d34
or byte [0x51e85cc1], 1
push edi
push 0x401
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
je 0x51e2f87e
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
je 0x51e2f877
shl eax, 2
add eax, 3
and eax, 0xfffffffc
call fcn.51e038cf
mov ebx, esp
test ebx, ebx
je 0x51df2d34
push ebx
push edi
call esi
xor eax, eax
test edi, edi
jle 0x51e2f87e
cmp byte [ebx + eax*4], 1
je 0x51e2f877
inc eax
cmp eax, edi
jl 0x51e2f86a
jmp 0x51e2f87e
or dword [0x51e85cc0], 7
push 1
push 0x40d
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x51df2d34
push 0
push 0
call esi
mov edi, eax
test edi, edi
je 0x51e2f8e3
shl eax, 2
add eax, 3
and eax, 0xfffffffc
call fcn.51e038cf
mov ebx, esp
test ebx, ebx
je 0x51df2d34
push ebx
push edi
call esi
xor eax, eax
test edi, edi
jle 0x51df2d34
cmp word [ebx + eax*4], 0x40d
je 0x51e2f8e3
inc eax
cmp eax, edi
jl 0x51e2f8c5
jmp 0x51df2d34
or dword [0x51e85cc0], 7
jmp 0x51df2d24
or dword [0x51e85cc0], 0x70
jmp 0x51df2d34
Function at 0x51df4b1c
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov eax, dword [0x51e874e4]
push esi
push edi
mov edi, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [esp + 0x18]
cmp esi, 4
jb 0x51e3391e
add esi, 3
mov ecx, edi
and esi, 0xfffffffc
call fcn.51df4c9b
mov edi, eax
test edi, edi
je 0x51df4d79
push ebx
xor ebx, ebx
mov bx, word [edi + 6]
push ebp
cmp ebx, 0xffff
je 0x51e33928
mov eax, dword [esp + 0x1c]
and word [ebx*2 + 0x51e85cd0], 0x7fff
xor ebp, ebp
mov ecx, eax
mov bp, word [eax - 2]
and ecx, 0xffff
cmp ebp, ecx
jge 0x51df4bba
lea edx, [ebp + 3]
and edx, 0xfffffffc
cmp edx, ebp
jne 0x51df4bba
sub eax, ebp
xor ecx, ecx
mov dword [esp + 0x1c], eax
mov cx, word [eax + 2]
cmp ecx, ebp
jne 0x51df4bba
mov edx, eax
mov ecx, edi
call fcn.51df4cd7
test eax, eax
jne 0x51e33970
mov eax, dword [esp + 0x10]
xor edx, edx
lea ecx, [esi + eax]
mov dx, word [edi + 4]
add edx, edi
lea ebp, [ecx + 4]
cmp ebp, edx
mov dword [esp + 0x1c], edx
ja 0x51df4c0d
xor ebp, ebp
mov bp, word [ecx + 2]
lea edx, [ebp + 3]
and edx, 0xfffffffc
cmp edx, ebp
jne 0x51df4c0d
mov edx, dword [esp + 0x1c]
add ecx, ebp
cmp ecx, edx
ja 0x51df4c0d
lea edx, [esi + eax]
xor ecx, ecx
mov cx, word [edx + ebp - 2]
cmp ebp, ecx
jne 0x51df4c0d
mov ecx, edi
call fcn.51df4cd7
test eax, eax
je 0x51df4c09
add esi, ebp
mov eax, dword [esp + 0x10]
mov ebp, eax
xor ecx, ecx
mov cx, word [edi + 4]
and ebp, 0xffff
lea edx, [esi + ebp]
cmp edx, ecx
jne 0x51e339b3
cmp ax, 0xc
jne 0x51e3397f
mov ecx, ebx
call fcn.51df4d05
mov dx, word [ebx*2 + 0x51e85cd0]
and edx, 0x7ff
cmp edx, 0x780
jae 0x51df4d6b
mov ecx, dword [0x51e84be8]
mov word [ebx*2 + 0x51e85cd0], 0
cmp ebx, ecx
jne 0x51df4d6b
mov edx, dword [ecx*4 + 0x51e864d0]
lea eax, [ecx*4 + 0x51e864d0]
test edx, edx
jne 0x51df4d6b
cmp eax, 0x51e874d0
jge 0x51df4d65
mov edx, dword [eax + 4]
add eax, 4
inc ecx
test edx, edx
jne 0x51df4d65
jmp 0x51df4c7f
mov dword [0x51e84be8], ecx
mov eax, dword [0x51e874e4]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret 8
mov esi, 4
jmp 0x51df4b44
mov eax, dword [0x51eb8c04]
lea ecx, [esp + 0x1c]
push 0x51e77934
lea edx, [esp + 0x14]
push ecx
push edx
push eax
mov dword [esp + 0x20], edi
call fcn.51e77d3e
mov edx, dword [0x51eb8c04]
push 1
mov ecx, dword [esp + 0x20]
push ecx
push edx
call fcn.51e77f06
push 0x8000
push 0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x51df4d6b
mov eax, dword [esp + 0x1c]
add esi, ebp
mov dword [esp + 0x10], eax
jmp 0x51df4bbe
cmp esi, 0x1200
mov word [edi + 2], ax
jle 0x51e339b3
and word [ebx*2 + 0x51e85cd0], 0xbfff
push 0
lea edx, [ebp + 0x200]
mov ecx, ebx
call fcn.51e7781b
mov edi, dword [ebx*4 + 0x51e864d0]
sub eax, ebp
mov esi, eax
mov eax, dword [esp + 0x10]
mov cx, word [edi]
mov edx, esi
and edx, 0xffff
mov word [eax], cx
mov word [eax + 2], si
mov word [edi], ax
mov word [edx + eax - 2], si
jmp 0x51df4d6b
Function at 0x51df8206
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
cmp si, 0xffff
push edi
je 0x51e2fbcf
test si, 0x3ff
je 0x51e2fbcf
push dword [ebp + 0x10]
mov edi, 0x51df8250
push dword [ebp + 0xc]
push esi
push 0x35
push edi
call fcn.51df83f8
add esp, 0x14
test eax, eax
je 0x51e2fb68
pop edi
pop esi
pop ebx
leave
ret
push eax
push eax
movzx ebx, si
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x58
push ebx
call esi
test eax, eax
jne 0x51e2fb95
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x35
push edi
call fcn.51df83f8
add esp, 0x14
jmp 0x51df8246
push 0x20
lea eax, [ebp - 0x20]
push eax
push 0x58
push ebx
call esi
and dword [ebp - 0xc], 0
push 3
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.51e6d089
add esp, 0xc
test eax, eax
je 0x51e2fbcf
mov al, byte [ebp - 0x40]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x51df8246
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp + 0x10]
and dword [eax], 0
jmp 0x51df8246

Function at 0x51df882e
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [0x51e8c240]
movsx ecx, word [0x51e8b556]
mov dword [esp], eax
mov eax, dword [0x51e8bbc0]
test eax, eax
mov word [0x51e8b556], 1
jne 0x51e27193
mov ecx, dword [esp]
add esp, 4
jmp fcn.51e03d50
cmp ecx, 1
je 0x51df8854
push 0x285
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x51df8854
Function at 0x51e0026a
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov al, byte [edi + 0x37]
mov cl, al
and cl, 6
cmp cl, 2
je 0x51e1bcac
xor al, al
mov esi, dword [esp + 0x10]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 4]
mov ebx, dword [edi]
mov byte [esi + 0x78], al
mov eax, dword [edi + 0x20]
mov dword [esi + 0x18], ecx
mov ecx, dword [edi + 0x10]
mov dword [esi + 4], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], edx
add edx, ecx
test ecx, ecx
mov dword [esi + 8], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x10], edx
jne 0x51e00320
mov ecx, dword [edi + 8]
mov dword [esi + 0x28], ecx
mov ecx, eax
dec ecx
neg ecx
push 4
sbb ecx, ecx
cdq
pop ebx
idiv ebx
and ecx, 2
cmp ecx, eax
jle 0x51e1bcbb
mov eax, dword [edi + 0x1c]
mov edx, dword [edi]
mov dword [esi + 0x70], eax
mov al, byte [edi + 0x34]
mov dword [esi + 0xc], ecx
mov ecx, dword [edi + 0x10]
mov byte [esi + 0x79], al
mov al, byte [edi + 0x35]
add ecx, edx
test al, al
mov byte [esi + 0x7a], al
mov dword [esi + 0x24], ecx
jne 0x51e1bcc2
mov al, byte [edi + 0x38]
mov byte [esi + 0x7b], al
mov eax, dword [0x51e8b69c]
test eax, eax
je 0x51e1bccb
cmp dword [eax + 0x53b8], 0
jne 0x51e1bcf5
pop edi
pop esi
pop ebx
ret
mov ecx, dword [edi + 0x10]
jmp 0x51e002ba
test al, 8
jne 0x51e00282
mov al, 1
jmp 0x51e00284
mov ecx, eax
jmp 0x51e002d5
inc ecx
mov dword [esi + 0x24], ecx
jmp 0x51e002fc
mov ebx, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call ebx
cmp ax, 0x411
je 0x51e1bcf5
call ebx
cmp ax, 0x404
je 0x51e1bcf5
call ebx
cmp ax, 0x412
je 0x51e1bcf5
call ebx
cmp ax, 0x804
jne 0x51e0031c
mov al, byte [edi + 0x37]
not al
and al, 1
mov byte [esi + 0x7d], al
jmp 0x51e0031c

Function at 0x51e02ed9
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push esi
lea eax, [ebp - 0xc8]
push eax
push 0x32
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov ecx, dword [0x51e8b69c]
xor esi, esi
cmp eax, esi
mov dword [ecx + 0x53b4], esi
jle 0x51e02f3d
mov dx, word [ebp + esi*4 - 0xc8]
cmp dx, 0x411
je 0x51e270c4
cmp dx, 0x412
je 0x51e270d0
cmp dx, 0x804
je 0x51e270dc
cmp dx, 0x404
je 0x51e270e8
inc esi
cmp esi, eax
jl 0x51e02f04
pop esi
leave
ret
or byte [ecx + 0x53b6], 4
jmp 0x51e02f38
or byte [ecx + 0x53b6], 0x10
jmp 0x51e02f38
or byte [ecx + 0x53b6], 8
jmp 0x51e02f38
or byte [ecx + 0x53b6], 0x20
jmp 0x51e02f38

Function at 0x51e03933
Capabilities:
Encode data using xor

Disassembly:
cmp word [eax], 0
je 0x51e30707
lea eax, [eax + 2]
test eax, 3
jne 0x51df562b
jmp 0x51e03945
test ecx, 0xffff0000
lea eax, [eax + 1]
jne 0x51e30711
jmp 0x51e0396d
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
jne 0x51df562b
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x51e03945
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
jne 0x51e0331e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x51e0396d
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x51e03945
Function at 0x51e03e7c
Capabilities:
Accept command line arguments
Print debug messages

Disassembly:
mov eax, 0x94
call fcn.51e038cf
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x51e34102
mov ecx, dword [esi + 0x10]
mov dword [0x51e895e0], ecx
mov eax, dword [esi + 4]
mov dword [0x51e895ec], eax
mov edx, dword [esi + 8]
mov dword [0x51e895f0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x51e895e4], esi
jne 0x51e3409c
shl eax, 8
add eax, edx
push 1
mov dword [0x51e895e8], eax
call fcn.51df19d3
test eax, eax
pop ecx
je 0x51e34102
call fcn.51df1a28
test eax, eax
je 0x51e340ad
mov eax, dword [0x51e89bf4]
test eax, eax
jne 0x51e340b4
call fcn.51df1c2d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x51e89bf0], eax
call fcn.51df1c6c
mov dword [0x51e895d8], eax
call fcn.51df1d33
test eax, eax
jl 0x51e340d0
call fcn.51df1e3b
test eax, eax
jl 0x51e340cb
call fcn.51df267e
test eax, eax
jl 0x51e340cb
push 0
call fcn.51df2846
test eax, eax
pop ecx
jne 0x51e340cb
inc dword [0x51e895d4]
jmp 0x51e03eaa
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
je 0x51df18f0
test eax, eax
je 0x51e340d7
cmp eax, 2
je 0x51e1ae33
cmp eax, 3
jne 0x51e03eaa
push 0
call fcn.51e1b118
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
push 0x8c
push 1
call fcn.51e03cdb
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x51e34102
push esi
push dword [0x51e8c250]
call dword [0x51e8c254]
test eax, eax
push esi
je 0x51e340fc
call fcn.51e1ae20
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x51e03eaa
call fcn.51e78b7d
call fcn.51e78b9e
jmp 0x51e03eaa
or esi, 0x8000
mov dword [0x51e895e4], esi
jmp 0x51df1943
call fcn.51e78b9e
jmp 0x51e34102
call eax
test eax, eax
jne 0x51df1977
push 0x51e3410c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x51e34102
call fcn.51e346ba
call fcn.51e78b7d
jmp 0x51e340ad
cmp dword [0x51e895d4], eax
jle 0x51e34102
dec dword [0x51e895d4]
cmp dword [0x51eb8c1c], eax
jne 0x51e340f2
call fcn.51e343cc
call fcn.51e346ba
jmp 0x51e1b150
call fcn.51e03c37
pop ecx
xor eax, eax
jmp 0x51e03ead
Function at 0x51e04cb4
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x51e7d882
call fcn.51e038b0
sub esp, 0x44
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
push ebx
call fcn.51e04c40
push dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push ebx
call fcn.51e003a2
add esp, 0x10
lea eax, [ebp - 0x50]
push eax
push ebx
call fcn.51e0024b
mov eax, dword [0x51e8b69c]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
je 0x51e1bd04
cmp dword [eax + 0x53b8], 0
jne 0x51e1bd54
mov edi, dword [ebp + 8]
push 1
push 0xffffffffffffffff
push ebx
call fcn.51e0507d
mov eax, dword [0x51e8b69c]
add esp, 0xc
test eax, eax
je 0x51e1bd29
cmp dword [eax + 0x53b8], 0
jne 0x51e04d41
lea eax, [ebp - 0x50]
push eax
push edi
call fcn.51e0026a
pop ecx
pop ecx
lea eax, [edi + 0x30]
push eax
push 0x20
push ebx
call dword [0x51e89c10]
and word [edi + eax*2 + 0x30], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
cmp ax, 0x804
jne 0x51e04d35
jmp 0x51e04d41
call esi
cmp ax, 0x411
je 0x51e1bd54
call esi
cmp ax, 0x404
je 0x51e1bd54
call esi
cmp ax, 0x412
je 0x51e1bd54
call esi
cmp ax, 0x804
je 0x51e1bd54
jmp 0x51e04d0f
call esi
cmp ax, 0x411
je 0x51e04d41
call esi
cmp ax, 0x404
je 0x51e04d41
call esi
cmp ax, 0x412
je 0x51e04d41
call esi
jmp 0x51e04d63
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
push edi
call fcn.51e0026a
mov eax, dword [0x51e8b69c]
test eax, eax
pop ecx
pop ecx
jne 0x51e1bd95
call esi
cmp ax, 0x411
je 0x51e1bd9e
call esi
cmp ax, 0x404
je 0x51e1bd9e
call esi
cmp ax, 0x412
je 0x51e1bd9e
call esi
cmp ax, 0x804
je 0x51e1bd9e
and dword [edi + 0x74], 0
jmp 0x51e04d12
cmp dword [eax + 0x53b8], 0
je 0x51e1bd8c
mov eax, dword [0x51e8a120]
test eax, eax
je 0x51e1bd8c
mov eax, dword [eax + 0x60]
test eax, eax
je 0x51e1bd8c
push ebx
push edi
call eax
jmp 0x51e04d12
Function at 0x51e06e4e
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x51e8b69c]
test ecx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push edi
mov edi, 0x411
je 0x51e27256
cmp dword [ecx + 0x53b8], 0
jne 0x51e06e97
test byte [ecx + 0x53b2], 0x3c
jne 0x51e06e97
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.51e06dbf
add esp, 0xc
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ebp
ret
test ecx, ecx
jne 0x51e272a2
jmp 0x51e2728f
call esi
cmp ax, di
je 0x51e27284
call esi
cmp ax, 0x404
je 0x51e27284
call esi
cmp ax, 0x412
je 0x51e27284
call esi
cmp ax, 0x804
mov ecx, dword [0x51e8b69c]
jne 0x51e06e75
jmp 0x51e06e97
mov ecx, dword [0x51e8b69c]
jmp 0x51e06e97
call esi
mov ecx, dword [0x51e8b69c]
sub ax, di
neg ax
sbb eax, eax
inc eax
jmp 0x51e272ad
xor eax, eax
cmp dword [ecx + 0x53a8], edi
sete al
test eax, eax
jne 0x51e272c1
test byte [ecx + 0x53b2], 4
jne 0x51e272c1
push 0x11
jmp 0x51e06e80
push 0x19
jmp 0x51e06e80
Function at 0x51e0d21c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
call fcn.51e0d294
mov esi, dword [esp + 8]
cmp esi, dword [eax + 0x88]
jne 0x51e341cf
call fcn.51e0d294
mov ecx, dword [esi + 4]
mov dword [eax + 0x88], ecx
pop esi
ret
call fcn.51e0d294
mov eax, dword [eax + 0x88]
jmp 0x51e341e5
mov ecx, dword [eax + 4]
cmp esi, ecx
je 0x51e341f1
mov eax, ecx
cmp dword [eax + 4], 0
jne 0x51e341dc
pop esi
jmp fcn.51e79524
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
pop esi
ret
Function at 0x51e11cf2
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x51e7e650
call fcn.51e038b0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
push esi
push esi
call fcn.51e168aa
push dword [ebp + 0x10]
mov edi, eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.51e11d83
mov eax, dword [0x51e8c348]
or dword [ebp - 4], 0xffffffff
add esp, 0x14
push dword [eax + 0x54]
push dword [eax + 0x50]
push dword [eax + 0x5c]
push dword [eax + 0x58]
call fcn.51e1828b
push esi
push edi
call fcn.51e168aa
add esp, 0x18
call fcn.51e11cad
mov eax, dword [0x51e8b69c]
cmp eax, esi
je 0x51e2b893
cmp dword [eax + 0x53bc], esi
jne 0x51e2b8bd
test byte [eax + 0x53b6], 0x3c
jne 0x51e2b8bd
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call esi
cmp ax, 0x411
je 0x51e2b8bd
call esi
cmp ax, 0x404
je 0x51e2b8bd
call esi
cmp ax, 0x412
je 0x51e2b8bd
call esi
cmp ax, 0x804
jne 0x51e11d71
push 0x805
call fcn.51e168d4
pop ecx
jmp 0x51e11d71

Function at 0x51e1205d
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x14]
call fcn.51e12027
test eax, eax
pop ecx
je 0x51e29beb
mov eax, dword [0x51e8c348]
push esi
mov esi, dword [eax + 0x28]
sub esi, dword [ebp + 0x10]
push edi
add esi, dword [ebp + 0xc]
cmp esi, dword [eax + 0x24]
jg 0x51e29bed
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret
pop ebp
ret
mov eax, dword [0x51e8b69c]
test eax, eax
jne 0x51e29c1e
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call edi
cmp ax, 0x411
je 0x51e29c30
call edi
cmp ax, 0x404
je 0x51e29c30
call edi
cmp ax, 0x412
je 0x51e29c30
call edi
cmp ax, 0x804
jne 0x51e29c47
jmp 0x51e29c30
cmp dword [eax + 0x53bc], 0
jne 0x51e29c30
test byte [eax + 0x53b6], 0x3c
je 0x51e29c47
mov eax, dword [0x51e8c348]
mov eax, dword [eax + 0x11c]
test al, 1
je 0x51e29c47
test al, 0x40
je 0x51e1208a
cmp esi, 2
jg 0x51e29c93
cmp dword [ebp + 0xc], 2
mov eax, dword [ebp + 8]
push 0x22
pop esi
jne 0x51e29c67
cmp word [eax], si
jne 0x51e29c93
cmp word [eax + 2], si
je 0x51e1208a
cmp dword [ebp + 0xc], 1
jne 0x51e29c93
cmp word [eax], si
jne 0x51e29c93
mov eax, dword [0x51e8c348]
cmp dword [eax + 0x28], 1
jne 0x51e29c93
mov eax, dword [0x51e8c344]
push dword [eax]
call fcn.51e1637c
cmp word [eax], si
pop ecx
je 0x51e1208a
cmp dword [ebp + 0x14], 0
je 0x51e29ca3
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x51e29cae
push 0x8ad
call fcn.51e17998
pop ecx
xor eax, eax
jmp 0x51e1208d
Function at 0x51e123d1
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
xor edi, edi
call fcn.51e12027
test eax, eax
pop ecx
je 0x51e12480
push esi
push 1
call fcn.51e11c55
mov dword [ebp - 4], eax
mov eax, dword [0x51e8c348]
mov esi, dword [eax + 0x58]
push 1
push dword [ebp - 4]
mov dword [eax + 0x94], 0x300005
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.51e1205d
add esp, 0x14
test eax, eax
je 0x51e1247d
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push dword [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.51e12135
add esp, 0x14
test eax, eax
je 0x51e1247d
mov eax, dword [0x51e8b69c]
cmp eax, ebx
je 0x51e2b913
xor ecx, ecx
cmp dword [eax + 0x53a8], 0x411
sete cl
mov eax, ecx
cmp eax, ebx
jne 0x51e2b928
push dword [ebp - 4]
push dword [ebp + 0xc]
push esi
call fcn.51e11cf2
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x51e1247d
cmp dword [ebp + 0x10], ebx
jne 0x51e2b956
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
sub ax, 0x411
neg ax
sbb eax, eax
inc eax
jmp 0x51e12457
cmp dword [ebp - 4], ebx
je 0x51e1245f
call fcn.51e16d81
push eax
mov eax, dword [0x51e8c344]
push dword [eax]
call fcn.51e1637c
pop ecx
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push esi
call fcn.51e65491
jmp 0x51e1245f
mov eax, dword [0x51e8c348]
push ebx
push ebx
push dword [eax + 0x5c]
push dword [eax + 0x58]
call fcn.51e1828b
call fcn.51e181ce
mov eax, dword [0x51e8c348]
push ebx
push ebx
push ebx
push dword [eax + 0x58]
call fcn.51e17032
add esp, 0x20
jmp 0x51e1247d
Function at 0x51e12cff
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x51e8c344]
push ebx
push esi
push edi
push dword [eax]
mov dword [ebp - 4], 3
call fcn.51e1637c
xor ebx, ebx
push ebx
mov esi, eax
call fcn.51e115e1
mov edx, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [0x51e8c348]
mov dword [ecx + 0x15c], eax
cmp byte [ecx + 0x118], bl
jne 0x51e29cc3
mov eax, dword [ecx + 0xa0]
sub eax, dword [ecx + 0x98]
mov dword [edx], eax
mov eax, dword [0x51e8b69c]
cmp eax, ebx
je 0x51e29cd4
cmp dword [eax + 0x53b8], ebx
jne 0x51e29d0c
cmp dword [ecx + 0x15c], ebx
jne 0x51e29d25
push dword [ebp + 0x10]
push dword [ecx + 4]
push dword [ecx + 0xc]
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.51e16d81
lea eax, [esi + eax*2]
push eax
mov eax, dword [ebp + 8]
lea eax, [esi + eax*2]
push eax
call fcn.51e16249
add esp, 0x1c
mov ecx, dword [ebp + 0xc]
sub eax, esi
pop edi
sar eax, 1
pop esi
mov dword [ecx], eax
pop ebx
leave
ret
mov eax, dword [ecx + 0xa4]
sub eax, dword [ecx + 0x9c]
jmp 0x51e12d4c
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call edi
cmp ax, 0x411
je 0x51e29d06
call edi
cmp ax, 0x404
je 0x51e29d06
call edi
cmp ax, 0x412
je 0x51e29d06
call edi
cmp ax, 0x804
mov ecx, dword [0x51e8c348]
jne 0x51e12d67
jmp 0x51e29d0c
mov ecx, dword [0x51e8c348]
cmp byte [ecx + 0x134], 0
je 0x51e12d67
mov dword [ebp - 4], 0x13
jmp 0x51e12d67
mov di, word [ecx + 0x13a]
call fcn.51e16d81
mov ebx, eax
mov eax, dword [0x51e8c348]
xor ecx, ecx
cmp dword [eax + 0x15c], ecx
je 0x51e29d78
mov edx, dword [0x51e8b69c]
cmp dword [edx + 0x5370], ecx
je 0x51e29d78
push ecx
push esi
call fcn.51e584fc
mov eax, dword [0x51e8c348]
cmp di, word [eax + 0x13a]
pop ecx
pop ecx
je 0x51e29d78
push 1
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x51e8c348]
xor ecx, ecx
mov cl, byte [eax + 0x151]
movzx edx, byte [eax + 0x135]
push 0x51eb3d58
push ecx
xor ecx, ecx
mov cl, byte [eax + 0x13c]
push ecx
mov cl, byte [eax + 0x138]
neg cl
sbb ecx, ecx
and ecx, 0x80
or ecx, edx
push ecx
push dword [ebp + 0x10]
push dword [eax + 4]
push dword [eax + 0xc]
lea eax, [esi + ebx*2]
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
lea eax, [esi + eax*2]
push eax
call fcn.51e59871
add esp, 0x2c
jmp 0x51e12d9a