joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3af0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x430
mov eax, dword [0x6b66bc]
xor eax, esp
mov dword [esp + 0x42c], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x757724]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x7460a4]
cmp eax, dword [ecx + 8]
jg 0x4d3cd2
mov ecx, dword [0x74609c]
test ecx, ecx
je 0x4d3b39
lea eax, [ecx - 1]
test eax, eax
jne 0x4d3caf
push esi
push edi
push 0x208
lea eax, [esp + 0x230]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x22c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x208
lea eax, [esp + 0x28]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x24]
push 0x104
push eax
lea eax, [esp + 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor edx, edx
mov dword [esp + 0xc], 0
xor edi, edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edi
cmp word [esp + 0x24], dx
je 0x4d3c05
lea ecx, [esp + 0x24]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d3bb3
sub ecx, esi
sar ecx, 1
lea esi, [ecx + 1]
test esi, esi
jle 0x4d3bdb
push esi
lea ecx, [esp + 0x10]
call fcn.0040ce40
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esi + edx]
mov dword [esp + 0x10], eax
cmp eax, edi
jle 0x4d3bf0
push edx
lea ecx, [esp + 0x10]
call fcn.0040cde0
lea eax, [esi + esi]
push eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x14]
call fcn.004263f0
add esp, 0xc
push 1
push 0x61bb6c
push 0x6112e4
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.00412180
mov esi, eax
cmp esi, 0x746098
je 0x4d3c85
mov eax, dword [0x746098]
test eax, eax
je 0x4d3c3b
push eax
call fcn.0043f8f0
add esp, 4
mov eax, dword [esi]
mov dword [0x746098], eax
mov dword [esi], 0
mov eax, dword [esi + 4]
mov dword [0x74609c], eax
mov ecx, dword [esi + 8]
mov dword [0x7460a0], ecx
cmp eax, dword [esi + 4]
jne 0x4d3c63
cmp ecx, dword [esi + 8]
je 0x4d3c77
lea eax, [esp + 0xb]
mov byte [esp + 0xb], 0
push eax
call fcn.00609010
add esp, 4
nop
int3
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [esp + 0x18]
pop edi
pop esi
test eax, eax
je 0x4d3c98
push eax
call fcn.0043f8f0
add esp, 4
mov eax, dword [esp + 4]
test eax, eax
je 0x4d3ca9
push eax
call fcn.0043f8f0
add esp, 4
mov ecx, dword [0x74609c]
test ecx, ecx
mov eax, 0x60f5ec
mov ecx, dword [esp + 0x42c]
cmovne eax, dword [0x746098]
xor ecx, esp
call fcn.005f4480
add esp, 0x430
ret
push 0x7460a4
call fcn.005f48b1
add esp, 4
cmp dword [0x7460a4], 0xffffffff
jne 0x4d3b24
push 0x608780
call fcn.005f4769
push 0x7460a4
call fcn.005f4867
add esp, 8
jmp 0x4d3b24

Function at 0x4d3f20
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4d3f5f
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4d3f5f
push 0
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0
push edx
push eax
push dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x10]
test eax, eax
setne al
test edx, edx
je 0x4d3f61
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
ret
xor al, al
ret
Function at 0x4d6e00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4d6e0c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004d6e20
Function at 0x4d8140
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push dword [ebx + 0xed9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp byte [ebp + 8], 0
je 0x4d8252
test eax, eax
jne 0x4d8252
push esi
push edi
lea edi, [ebx + 0xeda0]
push edi
call fcn.004d7100
mov esi, dword [edi + 0xc]
add esp, 4
test esi, esi
je 0x4d8183
mov eax, dword [esi]
mov dword [edi + 0xc], eax
jmp 0x4d81e1
mov edx, dword [edi + 4]
test edx, edx
jne 0x4d81a8
push 0x1a8
mov ecx, ebx
call fcn.004d7ce0
mov edx, eax
mov dword [edi + 4], edx
test edx, edx
jne 0x4d81a8
mov byte [edi], al
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov esi, dword [edx + 0x48]
mov ecx, esi
movzx eax, word [edx + 0x5e]
sub ecx, eax
mov dword [edx + 0x48], ecx
mov ecx, dword [edi + 4]
lea eax, [ecx + 0x80]
cmp dword [ecx + 0x48], eax
jae 0x4d81e1
mov dword [ecx + 0x48], 0
mov ecx, dword [edi + 4]
mov eax, dword [edi + 8]
mov dword [ecx + 0x40], eax
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
mov dword [edi + 4], 0
push 0x1a8
push 0
push esi
mov byte [edi], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
jne 0x4d8201
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
mov dword [esi + 8], ebx
lea eax, [ebx + 8]
push esi
mov dword [esi + 0x188], eax
push dword [ebx + 0xed9c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edi, [ebx + 0xec84]
mov dword [esi + 4], 0
push edi
call fcn.004d7100
mov eax, dword [ebx + 0xec80]
add esp, 4
mov dword [esi], eax
mov eax, dword [ebx + 0xec80]
test eax, eax
je 0x4d8245
mov dword [eax + 4], esi
mov dword [ebx + 0xec80], esi
mov byte [edi], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4d8260
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [0x6b4a10]
test edi, edi
je 0x4d82a6
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4d82a5
push esi
call fcn.004d70c0
add esp, 4
test al, al
je 0x4d829c
push dword [edi + 0xed9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push eax
mov ecx, edi
call fcn.004d8620
pop esi
pop edi
pop ebp
ret
push esi
call fcn.004d7b40
add esp, 4
pop esi
pop edi
pop ebp
ret

Function at 0x4d8590
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
je 0x4d85ce
mov ecx, dword [edx + 0x44]
test ecx, ecx
je 0x4d85a7
mov eax, dword [edx + 0x40]
mov dword [ecx + 0x40], eax
mov ecx, dword [edx + 0x40]
test ecx, ecx
je 0x4d85b4
mov eax, dword [edx + 0x44]
mov dword [ecx + 0x44], eax
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov dword [ebp + 8], edx
mov ecx, dword [edx + 0x10]
pop ebp
jmp fcn.004d89f0
movzx eax, word [edx + 0x5e]
mov ecx, edx
sub ecx, eax
mov dword [edx + 0x4c], 0
add ecx, 0x4000
mov byte [edx + 0x60], 0
mov dword [edx + 0x48], ecx
pop ebp
ret 8
Function at 0x4d8710
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, 0x3f
jne 0x4d87bb
mov eax, dword [esi - 4]
lea edi, [esi - 8]
mov ecx, eax
shr ecx, 0x10
test cl, 1
je 0x4d87bb
mov ecx, dword [edi]
test ecx, ecx
je 0x4d87bb
cmp ecx, edi
jae 0x4d87bb
push eax
call fcn.004daac0
add esp, 4
cmp eax, edi
jne 0x4d87bb
mov ecx, dword [edi]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x24]
sub eax, esi
add eax, ecx
mov dword [ebp + 0xc], eax
cmp edi, eax
ja 0x4d87a1
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4d8776
dec eax
test esi, eax
jne 0x4d87a1
lea ecx, [ebx + 8]
call fcn.004dc0a0
mov edx, dword [ebp + 0xc]
xor ecx, ecx
shr edx, 1
cmp dword [ebp + 0xc], eax
cmova ecx, edx
cmp edi, ecx
jbe 0x4d879e
mov eax, dword [ebp - 4]
mov dword [eax + 0x20], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4d87f5
push eax
push edi
push ebx
call fcn.004d7290
add esp, 0xc
jmp 0x4d87ff
mov ecx, esi
push esi
and ecx, 0xffffc000
call fcn.004d7a60
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
cmp edi, eax
ja 0x4d87e1
test edx, edx
je 0x4d8795
lea ecx, [edx - 1]
test esi, ecx
je 0x4d8795
mov ebx, dword [ebp + 8]
test edx, edx
je 0x4d87f5
push edx
push edi
push ebx
call fcn.004d7290
add esp, 0xc
jmp 0x4d87ff
push edi
push ebx
call fcn.004d8310
add esp, 8
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4d8858
cmp dword [ebp - 4], edi
cmovb edi, dword [ebp - 4]
push edi
push esi
push eax
call fcn.005f7171
add esp, 0xc
test ebx, ebx
je 0x4d8855
test esi, esi
je 0x4d8855
push esi
call fcn.004d70c0
add esp, 4
test al, al
je 0x4d884c
push dword [ebx + 0xed9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push eax
mov ecx, ebx
call fcn.004d8620
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004d7b40
add esp, 4
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8860
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], ebx
lea eax, [ebx + 0xec7c]
push eax
mov dword [ebp - 0xc], eax
call fcn.004d7100
mov ebx, dword [ebx + 0xec78]
add esp, 4
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x4d891a
push esi
push edi
nop word [eax + eax]
mov ecx, dword [ebx + 8]
lea eax, [ebx + 0x190]
add ecx, 8
xor edx, edx
xchg dword [eax], edx
test edx, edx
je 0x4d88c0
push edx
call fcn.004d9b90
mov byte [ebp - 2], 1
jmp 0x4d88c4
mov byte [ebp - 2], 0
add ebx, 0x180
xor al, al
xor esi, esi
xchg dword [ebx], esi
test esi, esi
je 0x4d8906
mov byte [ebp - 3], 1
mov ecx, dword [ebx + 8]
mov edi, dword [esi + 0x40]
mov eax, dword [ecx]
cmp dword [eax + 0xed84], 0
jne 0x4d88f7
push dword [esi + 0x58]
call fcn.004dada0
mov ecx, dword [ebx + 8]
add esp, 4
push esi
call fcn.004dc280
mov esi, edi
test edi, edi
jne 0x4d88d8
mov al, byte [ebp - 3]
mov ebx, dword [ebp - 8]
or al, byte [ebp - 2]
or byte [ebp - 1], al
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x4d88a0
pop edi
pop esi
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
push dword [eax + 0xed94]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop ebx
test eax, eax
je 0x4d8942
mov ecx, eax
call fcn.004d7590
or al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x4d8ac0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4d8b66
lea eax, [ecx - 1]
test ecx, eax
jne 0x4d8b66
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4d8af5
push ecx
push dword [ebp + 0xc]
push dword [0x6b4a10]
call fcn.004d7290
add esp, 0xc
jmp 0x4d8b4f
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4d8b3e
push edi
mov edi, dword [0x6b4a10]
test edi, edi
je 0x4d8b38
push esi
call fcn.004d70c0
add esp, 4
test al, al
je 0x4d8b2f
push dword [edi + 0xed9c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push eax
mov ecx, edi
call fcn.004d8620
pop edi
xor eax, eax
pop esi
pop ebp
ret
push esi
call fcn.004d7b40
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ecx
push eax
push esi
push dword [0x6b4a10]
call fcn.004d8710
add esp, 0x10
mov esi, eax
test esi, esi
jne 0x4d8b61
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0xc
mov eax, esi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x16
xor eax, eax
pop ebp
ret
Function at 0x4d9e80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi], 0
mov dword [edi + 0xbb74], eax
jne 0x4d9f8a
push ebx
push esi
push 0x637ef0
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4d9f2a
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [ebp + 8], 0
call esi
push 0xa
mov dword [eax], 0
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
mov dword [ebp - 4], eax
call esi
cmp dword [eax], 0x22
je 0x4d9f2a
cmp dword [ebp - 4], 0
jl 0x4d9f2a
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4d9f2a
mov al, byte [eax]
test al, al
je 0x4d9f11
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
movsx eax, al
push eax
call esi
add esp, 4
test eax, eax
je 0x4d9f2a
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
mov al, byte [eax]
test al, al
jne 0x4d9ef7
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x4d9f2a
push eax
mov ecx, edi
call fcn.004da780
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80000000
mov dword [edi + 0xb14], 0x3ff
bsr ecx, eax
xor edx, edx
xor eax, eax
add ecx, 0xfffffffd
bts edx, ecx
cmp ecx, 0x20
cmovae eax, edx
xor edx, eax
lea esi, [edx + 0x7fffffff]
neg edx
and esi, edx
mov dword [edi], esi
jne 0x4d9f61
or ebx, 0xffffffff
jmp 0x4d9f64
bsr ebx, esi
mov ecx, ebx
xor edx, edx
xor eax, eax
bts edx, ecx
cmp ecx, 0x20
lea ecx, [ebx - 3]
cmovae eax, edx
xor edx, eax
sub esi, edx
shr esi, cl
lea eax, [esi - 0xb8]
lea eax, [eax + ebx*8]
pop esi
mov dword [edi + 4], eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x4e1ff0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x4e2070
push 0x13
call fcn.00505d70
push 0x38
call fcn.004deba0
mov edx, eax
add esp, 0xc
mov dword [ebp - 4], edx
test edx, edx
je 0x4e2031
lea ecx, [edx + 9]
mov dword [edx + 4], 0x28
mov eax, ecx
mov dword [edx], ecx
mov byte [edx + 8], 0
mov dword [edx + 0x34], 0
mov byte [eax], 0
jmp 0x4e2033
xor edx, edx
mov dword [0x756114], edx
test edx, edx
jne 0x4e204a
mov eax, dword [ebp + 8]
mov dword [eax], 7
mov esp, ebp
pop ebp
ret
push str.ICU_TIMEZONE_FILES_DIR
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
push dword [ebp + 8]
test eax, eax
mov ecx, 0x637ceb
cmovne ecx, eax
push ecx
call fcn.004e2110
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4e24c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x6b66bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x756118]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x4e25af
push 0x55
push 0x756120
push 0x5c
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x4e259a
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
nop
lea edx, [ebp - 0x5c]
add edx, ecx
cmp word [ecx*2 + 0x756120], 0x5f
jne 0x4e2525
mov byte [edx], 0x2d
jmp 0x4e252e
mov al, byte [ecx*2 + 0x756120]
mov byte [edx], al
cmp byte [edx], 0
je 0x4e253b
inc ecx
cmp ecx, 0x55
jl 0x4e2510
jmp 0x4e2540
cmp ecx, 0x55
jl 0x4e2544
mov byte [ebp - 8], 0
push esi
push 0x41
call fcn.00505f20
mov esi, eax
add esp, 4
test esi, esi
je 0x4e2599
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.004e36b0
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x4e2590
push 0x4e2070
push 0x13
mov byte [eax + esi], 0
mov dword [0x756118], esi
mov byte [0x75611c], 1
call fcn.00505d70
add esp, 8
jmp 0x4e2599
push esi
call fcn.00505ef0
add esp, 4
pop esi
mov ecx, dword [0x756118]
mov eax, str.en_US
test ecx, ecx
cmovne eax, ecx
mov dword [0x756118], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005f4480
mov esp, ebp
pop ebp
ret

Function at 0x4efdb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f7faf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6b66bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
mov dword [esi], 2
lea ecx, [esi + 0xc]
movq qword [esi + 4], xmm0
call fcn.00536280
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], 0
call fcn.00536280
mov dword [esi + 0x30], 0
mov eax, 0xfffffffd
mov dword [esi + 0x50], 4
mov word [esi + 0x54], ax
or eax, 0xffffffff
mov dword [esi + 0x60], 0xfffffffe
mov byte [esi + 0x74], 0
mov word [esi + 0x6c], ax
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 5
mov dword [esi + 0x84], 7
mov dword [esi + 0x88], 2
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 3
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 3
call fcn.004dce00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5143a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x6b66bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x358], 0
push edi
push 0x1b0
push eax
mov dword [ebp - 0xc], eax
xor edi, edi
mov word [ebp - 8], ax
mov word [ebp - 0x35c], ax
mov byte [ebp - 0x35a], al
lea eax, [ebp - 0x354]
push eax
call sub.VCRUNTIME140.dll_memset
push 0x80
lea eax, [ebp - 0x10c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push 0x80
lea eax, [ebp - 0x8c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
cmp eax, 0xffffffff
jne 0x514432
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005f4480
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
push 3
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
mov ebx, eax
lea eax, [ebp - 0x358]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x35c]
push 3
push eax
call fcn.00511030
lea eax, [ebp - 0x358]
push eax
push str.windowsZones
push 0
call fcn.004f7a10
mov esi, eax
lea eax, [ebp - 0x358]
push eax
push esi
push 0x663fb0
push esi
call fcn.004f64e0
lea eax, [ebp - 0x358]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2a8]
push eax
push 0
lea eax, [ebp - 0x10c]
push 0x80
push eax
call fcn.00511030
add esp, 0x4c
cmp dword [ebp - 0x358], edi
jle 0x5144e2
test esi, esi
je 0x5144cf
push esi
call fcn.004f5e40
add esp, 4
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005f4480
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x2a8], di
je 0x5145c6
lea ecx, [ebp - 0x1a4]
call fcn.004f3d10
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.004f64e0
add esp, 0x10
cmp dword [ebp - 0x358], edi
jg 0x5145bb
test ebx, ebx
je 0x514552
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.004f76d0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x51457c
lea eax, [ebp - 0x358]
mov dword [ebp - 0x358], edi
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x1a4]
push 0x663fc0
push eax
call fcn.004f76d0
add esp, 0x10
mov ecx, eax
cmp dword [ebp - 0x358], edi
jg 0x5145bb
movzx eax, word [ecx]
xor edx, edx
test ax, ax
je 0x5145b3
nop
cmp ax, 0x20
je 0x5145ab
mov al, byte [ecx]
add ecx, 2
mov byte [ebp + edx - 0x8c], al
inc edx
movzx eax, word [ecx]
test ax, ax
jne 0x514590
cmp edx, 0x80
jae 0x514600
mov byte [ebp + edx - 0x8c], 0
lea ecx, [ebp - 0x1a4]
call fcn.004f3d40
cmp byte [ebp - 0x8c], 0
je 0x5145e0
lea eax, [ebp - 0x8c]
push eax
call fcn.00509600
add esp, 4
mov edi, eax
test esi, esi
je 0x5145ed
push esi
call fcn.004f5e40
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.005f4480
mov esp, ebp
pop ebp
ret
call fcn.005f50f6
int3
Function at 0x51eb10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa208
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6b66bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_64::UnicodeMatcher.0
mov edi, dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_64::UnicodeSet.0
mov dword [esi + 4], vtable.icu_64::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
push dword [edi + 0x10]
mov dword [ebp - 4], 0
call fcn.005207c0
test al, al
je 0x51ec1d
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
shl eax, 2
push eax
push dword [edi + 8]
push dword [esi + 8]
call fcn.005f7171
mov eax, dword [edi + 0x2c]
add esp, 0xc
test eax, eax
je 0x51ec0b
cmp dword [eax + 4], 0
je 0x51ec0b
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
mov ecx, esi
call fcn.0051fe40
test al, al
je 0x51ec02
mov ecx, dword [esi + 0x2c]
lea eax, [ebp + 8]
push eax
push 0x520040
push dword [edi + 0x2c]
call fcn.005640d0
cmp dword [ebp + 8], 0
jle 0x51ec0b
mov ecx, esi
call fcn.00521590
jmp 0x51ec1d
mov eax, dword [edi + 0x24]
test eax, eax
je 0x51ec1d
push dword [edi + 0x28]
mov ecx, esi
push eax
call fcn.00521520
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x51ec40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa238
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6b66bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_64::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_64::UnicodeSet.0
mov dword [esi + 4], vtable.icu_64::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00520590
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x51ecf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa238
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6b66bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_64::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_64::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_64::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call fcn.0051fbb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8