joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e6cb6
Capabilities:
Resume thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
lea eax, [esi + 0x4c]
push eax
lea ecx, [esp + 0x14]
call fcn.004b8400
cmp byte [esi + 0x53], 0
mov ebx, dword [esp + 0x10]
je 0x4e6c1a
test bl, 1
je 0x4e6bd5
and ebx, 0xfffffffe
mov ecx, ebx
and ecx, 0xfffffffe
mov eax, dword [ecx]
test byte [eax + 4], 1
je 0x4e6bbd
call fcn.004e2610
jmp 0x4e6bd5
mov ebp, eax
xor edx, edx
mov eax, 1
lock cmpxchg dword [ebp], edx
cmp eax, 1
je 0x4e6bd5
call fcn.004e2640
push 0xffffffffffffffff
mov ecx, edi
call fcn.004e6780
test ebx, ebx
je 0x4e6c1a
test bl, 1
jne 0x4e6c1a
mov ecx, ebx
and ecx, 0xfffffffe
mov eax, dword [ecx]
test byte [eax + 4], 1
je 0x4e6bfb
call fcn.004e28f0
jmp 0x4e6c17
mov ebp, eax
mov edx, 1
xor eax, eax
lock cmpxchg dword [ebp], edx
test eax, eax
sete al
test al, al
jne 0x4e6c17
call fcn.004e2670
or ebx, 1
cmp byte [esi + 0x50], 0
jne 0x4e6d02
mov ecx, dword [esi + 0x5c]
lea eax, [esi + 0x68]
push eax
push 4
push edi
push 0x4e6a60
push ecx
push 0
mov byte [esi + 0x50], 1
mov byte [esi + 0x51], 0
mov byte [esi + 0x52], 0
mov byte [esi + 0x54], 0
mov dword [esi + 0x58], 0
call fcn.0057b57b
add esp, 0x18
mov dword [esi + 0x64], eax
test eax, eax
jne 0x4e6c7e
call fcn.0057ef61
mov edx, dword [eax]
push str.QThread::start:_Failed_to_create_thread
push edx
call fcn.004b76b0
add esp, 8
mov byte [esi + 0x50], 0
mov byte [esi + 0x51], 1
jmp 0x4e6d02
mov eax, dword [esp + 0x18]
mov dword [esi + 0x60], eax
cmp eax, 6
ja case.default.0x4e6c8a
jmp dword [eax*4 + 0x4e6d40]
mov eax, 0xfffffff1
jmp 0x4e6cca
mov eax, 0xfffffffe
jmp 0x4e6cca
or eax, 0xffffffff
jmp 0x4e6cca
xor eax, eax
jmp 0x4e6cca
mov eax, 1
jmp 0x4e6cca
mov eax, 2
jmp 0x4e6cca
mov eax, 0xf
jmp 0x4e6cca
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push eax
mov eax, dword [esi + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x4e6ce6
push str.QThread::start:_Failed_to_set_thread_priority
call fcn.004b75d0
add esp, 4
mov ecx, dword [esi + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x4e6d02
push str.QThread::start:_Failed_to_resume_new_thread
call fcn.004b75d0
add esp, 4
test bl, 1
je 0x4e6d38
and ebx, 0xfffffffe
mov ecx, ebx
mov eax, dword [ecx]
test byte [eax + 4], 1
je 0x4e6d21
call fcn.004e2610
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov esi, eax
xor edx, edx
mov eax, 1
lock cmpxchg dword [esi], edx
cmp eax, 1
je 0x4e6d38
call fcn.004e2640
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4e70d0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0x6cb3cc
lea ecx, [esp + 8]
call fcn.004b8400
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x6cb3c0]
jne 0x4e713a
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
test al, 1
je 0x4e71c3
and eax, 0xfffffffe
mov ecx, eax
mov eax, dword [ecx]
test byte [eax + 4], 1
je 0x4e711b
pop esi
add esp, 4
jmp fcn.004e2610
mov esi, eax
xor edx, edx
mov eax, 1
lock cmpxchg dword [esi], edx
cmp eax, 1
je 0x4e71c3
pop esi
add esp, 4
jmp fcn.004e2640
lea eax, [esp + 0xc]
push eax
mov ecx, 0x6c3bb8
call fcn.0051caf0
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x6c3bbc
call fcn.0051caf0
cmp dword [0x6cb3c0], 0
jne 0x4e71ad
cmp dword [0x6cb3c4], 0
jne 0x4e718c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x6cb3c4
mov ecx, 0x6c3bb8
mov dword [0x6cb3c4], eax
call fcn.004e6dd0
push 0x6cb3c0
push 0
push 0
push 0x4e6e70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [esp + 4]
jmp 0x4e70fd
mov edx, dword [0x6cb3c4]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esp + 4]
jmp 0x4e70fd
pop esi
pop ecx
ret
Function at 0x4e71d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 8
call fcn.004e6480
mov eax, dword [0x6c3bb4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4e730c
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
push ecx
push 2
mov dword [esp + 0x14], eax
call fcn.004b7bb0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add esp, 8
test al, al
je 0x4e7258
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 4]
mov esi, dword [eax + 0x74]
mov ecx, dword [0x6c3bb4]
push ebp
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 4]
mov byte [eax + 0x50], 1
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
mov byte [edx + 0x51], 0
mov edi, dword [esp + 0x10]
mov ebp, dword [edi + 4]
add edi, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp + 0x64], eax
mov edi, dword [edi]
call ebx
mov dword [edi + 0x68], eax
pop ebp
jmp 0x4e72a6
push 0x48
call fcn.00579757
add esp, 4
test eax, eax
je 0x4e7273
push 1
mov ecx, eax
call fcn.004e0950
mov esi, eax
jmp 0x4e7275
xor esi, esi
mov eax, dword [0x6c3bb4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
call fcn.00579757
add esp, 4
test eax, eax
je 0x4e729a
push esi
mov ecx, eax
call fcn.004e0be0
jmp 0x4e729c
xor eax, eax
mov ecx, esi
mov dword [esi + 4], eax
call fcn.004e0bb0
mov byte [esi + 0x38], 1
call ebx
mov dword [esi + 8], eax
cmp dword [0x6cb374], 0
jne 0x4e72ca
mov ecx, dword [esi + 4]
pop edi
mov eax, esi
pop esi
mov dword [0x6cb374], ecx
pop ebx
add esp, 8
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0xffffffff
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.004e70d0
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x503e50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x1c]
push 0x104
mov ecx, eax
push ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x104
call edi
mov esi, eax
cmp esi, 0x104
jbe 0x503eb3
cmp esi, dword [esp + 0xc]
mov dword [esp + 8], esi
lea eax, [esp + 0xc]
jl 0x503e9c
lea eax, [esp + 8]
mov edx, dword [eax]
push edx
push esi
lea ecx, [esp + 0x14]
call fcn.00503dc0
mov eax, dword [esp + 0x14]
push esi
push eax
call edi
mov esi, eax
mov ecx, dword [esp + 0x14]
push esi
push ecx
push ebx
call fcn.004c0e60
mov eax, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x1c]
pop edi
pop esi
cmp eax, edx
je 0x503ed9
push eax
call fcn.004c45d0
add esp, 4
mov eax, ebx
add esp, 0x224
ret
Function at 0x506b50
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x78], 0
mov dword [esp + 0x1c], edi
mov dword [edi], vtable.QWinSettingsPrivate.0
je 0x506cd1
mov eax, dword [edi + 0x74]
cmp dword [eax + 8], 0
je 0x506cd1
lea esi, [eax + 0x10]
mov ecx, esi
call fcn.005043b0
test eax, eax
je 0x506cd1
cmp byte [esi + 0xc], 0
jne 0x506cd1
mov ecx, esi
call fcn.005043b0
test eax, eax
je 0x506cd1
mov dword [esp + 0xc], 0x6c30d4
mov eax, 0x6c30d4
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [edi + 0x74]
cmp dword [eax + 8], 0
je 0x506be1
lea esi, [eax + 0x10]
mov ecx, esi
call fcn.005043b0
test eax, eax
je 0x506be1
cmp byte [esi + 0xc], 0
jne 0x506be1
mov ecx, esi
call fcn.005043b0
mov esi, eax
jmp 0x506be3
xor esi, esi
lea ecx, [esp + 0xc]
call fcn.004bfc60
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x506cb7
mov edx, dword [edi + 0x74]
mov ecx, dword [edx + 0x18]
mov dword [esp + 8], ecx
mov edx, 1
lock xadd dword [ecx], edx
lea ecx, [esp + 0x14]
push ecx
lea esi, [esp + 0x1c]
call fcn.00504640
mov ecx, eax
call fcn.004bf820
mov ecx, eax
call fcn.004529c2
push eax
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x10]
call fcn.004bf820
mov ecx, eax
call fcn.004529c2
push eax
push str.QSettings:_Failed_to_delete_key___s_:__s
call fcn.004b7590
mov eax, dword [esp + 0x1c]
add esp, 0xc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x506c69
mov edx, dword [esp + 0x10]
push edx
call fcn.004c45d0
add esp, 4
mov eax, dword [esp + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x506c83
mov edx, dword [esp + 8]
push edx
call fcn.004bdf50
add esp, 4
mov eax, dword [esp + 0x14]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x506c9d
mov edx, dword [esp + 0x14]
push edx
call fcn.004c45d0
add esp, 4
mov eax, dword [esp + 0x18]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x506cb7
mov edx, dword [esp + 0x18]
push edx
call fcn.004bdf50
add esp, 4
mov eax, dword [esp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x506cd1
mov edx, dword [esp + 0xc]
push edx
call fcn.004bdf50
add esp, 4
mov eax, dword [edi + 0x74]
lea esi, [edi + 0x74]
push ebp
xor ebp, ebp
cmp dword [eax + 8], ebp
jle 0x506d28
push ebx
xor ebx, ebx
mov eax, dword [esi]
mov ecx, dword [eax]
cmp ecx, 1
je 0x506cfc
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push edx
push eax
mov ecx, esi
call fcn.00504910
mov ecx, dword [esi]
mov eax, dword [ebx + ecx + 0x14]
lea edi, [ebx + ecx + 0x10]
test eax, eax
je 0x506d11
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 4], 0
mov edx, dword [esi]
inc ebp
add ebx, 0x10
cmp ebp, dword [edx + 8]
jl 0x506ce2
mov edi, dword [esp + 0x24]
pop ebx
mov eax, dword [esi]
pop ebp
test eax, eax
je 0x506d42
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x506d42
mov edx, dword [esi]
push edx
mov ecx, esi
call fcn.005048c0
mov ecx, edi
pop edi
pop esi
add esp, 0x18
jmp fcn.004c85e0
Function at 0x5095f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], ebx
mov eax, dword [esi + 4]
lea ecx, [edi + 4]
mov dword [ecx], eax
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [esi + 8]
mov dword [ecx + 4], eax
mov edx, 1
lock xadd dword [eax], edx
movzx eax, word [esi + 0xc]
mov word [ecx + 8], ax
mov dx, word [esi + 0xe]
mov word [ecx + 0xa], dx
movzx eax, word [esi + 0x10]
mov word [ecx + 0xc], ax
mov edx, dword [esi + 0x18]
lea eax, [edi + 0x18]
mov dword [eax], edx
mov edx, dword [esi + 0x1c]
mov dword [eax + 4], edx
mov edx, dword [esi + 0x20]
mov dword [eax + 8], edx
mov edx, dword [esi + 0x24]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 0x28]
mov dword [eax + 0x10], edx
mov edx, dword [esi + 0x2c]
mov dword [eax + 0x14], edx
mov edx, dword [esi + 0x30]
mov dword [eax + 0x18], edx
mov edx, dword [esi + 0x34]
mov dword [eax + 0x1c], edx
mov edx, dword [esi + 0x38]
mov dword [eax + 0x20], edx
mov edx, dword [esi + 0x3c]
mov dword [eax + 0x24], edx
mov edx, dword [esi + 0x40]
push eax
push ecx
mov dword [eax + 0x28], edx
call fcn.00531630
add esp, 8
mov dword [edi + 0x48], eax
lea eax, [edi + 0x4c]
lea ecx, [ebx + 8]
push ebp
lea ecx, [ecx]
mov dword [eax], 0x6c30d4
mov edx, 0x6c30d4
mov ebp, 1
lock xadd dword [edx], ebp
add eax, 4
sub ecx, 1
jns 0x509690
lea eax, [edi + 0x70]
mov ecx, 1
jmp 0x5096c0
mov dword [eax], 0x6c30d4
mov edx, 0x6c30d4
mov ebp, 1
lock xadd dword [edx], ebp
add eax, 4
sub ecx, 1
jns 0x5096c0
and byte [edi + 0x7c], 0xfe
and dword [edi + 0x78], 0xc0000000
mov cl, byte [esi + 0x7c]
mov al, byte [edi + 0x7c]
xor cl, al
and cl, 2
xor cl, al
mov dword [edi + 0x80], ebx
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov byte [edi + 0x7c], cl
lea esi, [edi + 0x90]
mov ebx, 2
pop ebp
mov ecx, esi
call fcn.004fb1a0
add esi, 4
sub ebx, 1
jns 0x509715
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x5176b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
mov dword [esp + 0xc], edi
cmp eax, edx
jb 0x517740
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.0057e690
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x51770f
sub eax, ebp
jmp 0x517711
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x517700
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x517730
sub eax, ebp
jmp 0x517732
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x517721
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x51786f
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [esp + 0xc]
mov ebx, ecx
mov dword [esp + 0x10], eax
cmp ebx, edx
jbe 0x517768
mov ebx, edx
test ebx, ebx
je 0x5177b9
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
mov ecx, dword [edx + 0x18]
cmp ecx, 1
jne 0x51778b
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.00534790
jmp 0x51779d
cmp ecx, 2
jne 0x5177a7
mov edx, dword [edi]
mov eax, dword [edi + 0x30]
push ebx
push edx
push eax
call fcn.00515a60
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [edi]
push ebx
push ecx
push eax
call fcn.0057e690
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x5177e3
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x5177f7
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x5176c0
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x51786f
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x51783e
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x51781e
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.0057e5e0
add esp, 0xc
add ebx, edi
pop edi
pop ebp
mov dword [esi + 0x16c0], ebx
pop ebx
add esp, 8
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x51786f
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x517858
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.0057e5e0
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x51e8a0
Capabilities:
Terminate thread

Disassembly:
push 0
call fcn.004e0870
ret
push ecx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
lea eax, [esi + 0x4c]
push eax
lea ecx, [esp + 0xc]
call fcn.004b8400
cmp byte [esi + 0x50], 0
jne 0x4e6746
mov eax, dword [esp + 8]
test al, 1
je 0x4e6777
and eax, 0xfffffffe
mov ecx, eax
mov eax, dword [ecx]
test byte [eax + 4], 1
je 0x4e672a
pop edi
pop esi
add esp, 4
jmp fcn.004e2610
mov esi, eax
xor edx, edx
mov eax, 1
lock cmpxchg dword [esi], edx
cmp eax, 1
je 0x4e6777
pop edi
pop esi
add esp, 4
jmp fcn.004e2640
cmp byte [esi + 0x70], 0
jne 0x4e6756
mov eax, dword [esp + 8]
mov byte [esi + 0x71], 1
jmp 0x4e670f
mov eax, dword [esi + 0x64]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push edi
mov byte [esi + 0x52], 1
call fcn.004e6510
mov eax, dword [esp + 0x10]
add esp, 8
jmp 0x4e670f
pop edi
pop esi
pop ecx
ret
cmp dword [esp + 8], 0
jne case.default.0x51e8b0
mov eax, dword [esp + 0xc]
cmp eax, 6
ja case.default.0x51e8b0
jmp dword [eax*4 + 0x51e904]
mov ecx, dword [esp + 4]
jmp fcn.0051e840
mov ecx, dword [esp + 4]
jmp fcn.0051e860
mov ecx, dword [esp + 4]
jmp fcn.0051e880
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov ecx, dword [esp + 4]
push edx
call fcn.004e6b80
ret
mov ecx, dword [esp + 4]
push 7
call fcn.004e6b80
ret
mov ecx, dword [esp + 4]
jmp 0x4e66f0
mov ecx, dword [esp + 4]
jmp 0x4e0910

Function at 0x51f960
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
mov esi, ecx
cmp dword [esi + 8], 0
push edi
jne 0x51fa4a
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 8
lea eax, [esp + 0xc]
push eax
push 0x1014
push ecx
call edi
test eax, eax
jne 0x51f9b1
mov eax, 3
pop edi
mov dword [esi + 8], eax
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005796dc
add esp, 0x2c
ret
mov ax, word [esp + 8]
cmp ax, 0x31
jne 0x51f9d7
mov dword [esi + 8], 3
mov eax, dword [esi + 8]
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005796dc
add esp, 0x2c
ret
cmp ax, 0x30
jne 0x51f9f8
mov dword [esi + 8], 1
mov eax, dword [esi + 8]
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005796dc
add esp, 0x2c
ret
cmp ax, 0x32
jne 0x51fa19
mov dword [esi + 8], 2
mov eax, dword [esi + 8]
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005796dc
add esp, 0x2c
ret
mov eax, dword [esi + 4]
push 0xb
lea edx, [esp + 0x1c]
push edx
push 0x13
push eax
call edi
test eax, eax
je 0x51f998
movzx ecx, word [esp + 0x18]
movzx edx, word [esp + 8]
add ecx, 2
xor eax, eax
cmp edx, ecx
setne al
add eax, 2
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x30]
pop edi
pop esi
xor ecx, esp
call fcn.005796dc
add esp, 0x2c
ret
Function at 0x51fae0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x208
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0x204], eax
mov dword [esi], 0x6c30d4
mov eax, 0x6c30d4
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [esp + 0x20c]
push 0xff
lea edx, [esp + 8]
push edx
push 0x5a
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x51fb5a
push 0xffffffffffffffff
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
call fcn.004c0e60
add esp, 0xc
push eax
mov ecx, esi
call fcn.004bb760
mov eax, dword [esp]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x51fb5a
mov edx, dword [esp]
push edx
call fcn.004bdf50
add esp, 4
mov ecx, dword [esp + 0x204]
xor ecx, esp
mov eax, esi
call fcn.005796dc
add esp, 0x208
ret

Function at 0x51fbc0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [ecx + 4]
sub esp, 0xc
push esi
push 2
lea eax, [esp + 0xc]
push eax
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x51fc53
push 0xffffffffffffffff
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.004c0e60
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0x69467c
call fcn.004bdfb0
test al, al
je 0x51fc39
mov esi, dword [esp + 0x14]
push 1
mov ecx, esi
call fcn.004ce040
mov edx, dword [esp + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x51fc60
mov ecx, dword [esp + 4]
push ecx
call fcn.004bdf50
add esp, 4
mov eax, esi
pop esi
add esp, 0xc
ret 4
mov edx, dword [esp + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x51fc53
mov ecx, dword [esp + 4]
push ecx
call fcn.004bdf50
add esp, 4
mov esi, dword [esp + 0x14]
push 0
mov ecx, esi
call fcn.004ce040
mov eax, esi
pop esi
add esp, 0xc
ret 4

Function at 0x51fc70
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x28
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [ecx + 4]
push esi
mov esi, dword [esp + 0x30]
push 0xf
lea eax, [esp + 0xc]
push eax
push 0x28
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x51fce4
push 0xffffffffffffffff
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.004c0e60
add esp, 0xc
push eax
mov ecx, esi
call fcn.004d00d0
mov ecx, dword [esp + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x51fcf1
mov eax, dword [esp + 4]
push eax
call fcn.004bdf50
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005796dc
add esp, 0x28
ret 4
mov dword [esi + 8], connect
mov dword [esi], 0
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
xor ecx, esp
call fcn.005796dc
add esp, 0x28
ret 4
Function at 0x51fd10
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x28
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [ecx + 4]
push esi
mov esi, dword [esp + 0x30]
push 0xf
lea eax, [esp + 0xc]
push eax
push 0x29
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x51fd84
push 0xffffffffffffffff
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.004c0e60
add esp, 0xc
push eax
mov ecx, esi
call fcn.004d00d0
mov ecx, dword [esp + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x51fd91
mov eax, dword [esp + 4]
push eax
call fcn.004bdf50
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005796dc
add esp, 0x28
ret 4
mov dword [esi + 8], connect
mov dword [esi], 0
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
xor ecx, esp
call fcn.005796dc
add esp, 0x28
ret 4

Function at 0x51fdb0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0xc], eax
mov ecx, dword [ecx + 4]
push esi
mov esi, dword [esp + 0x18]
push 4
lea eax, [esp + 0xc]
push eax
push 0x100c
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x51fe33
push 0xa
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.004c0e60
add esp, 0xc
mov ecx, eax
call fcn.004be430
inc eax
push eax
mov ecx, esi
call fcn.004ce060
mov ecx, dword [esp + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x51fe3c
mov eax, dword [esp + 4]
push eax
call fcn.004bdf50
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005796dc
add esp, 0x10
ret 4
push 1
mov ecx, esi
call fcn.004ce040
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
xor ecx, esp
call fcn.005796dc
add esp, 0x10
ret 4