joyce8/EMBER2024-capa huggingface dataset:
Function at 0x643d2ae4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ecx, str.There_is_nothing_to_unexport.
mov ebp, esp
push ebx
mov ebx, 0xa3a
sub esp, 0x14
mov eax, dword [0x643e8268]
xor eax, 0x92d5b9e1
mov edx, eax
or edx, 0x65a236b4
imul edx, edx, 0x3c570744
mov dword [0x643e812c], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x643d2b25
add ebx, edx
cmp ebx, 0xaa1
jbe 0x643d2b13
imul eax, eax, 0x216b6915
mov edx, dword [0x643e8270]
xor edx, 0x4e4f0e45
mov dword [0x643e8268], edx
mov dword [0x643e81d0], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edx, dword [0x643e812c]
push eax
mov eax, dword [0x643e8270]
mov ecx, eax
and ecx, 0x1115c584
mov dword [0x643e8268], ecx
imul ecx, edx, 0x7da87e44
cmp byte [str.There_is_nothing_to_unexport.], 0
mov dword [0x643e81d0], ecx
je 0x643d2b86
xor edx, 0x2dba8165
mov dword [0x643e81d0], edx
mov edx, dword [0x643e81d0]
and eax, 0x1058584
mov dword [0x643e81d0], eax
xor edx, 0x4e6a3b89
mov dword [0x643e8270], edx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
sub dword [0x643e81d0], 0x13071e7b
mov edx, eax
and eax, 0x68480a08
and edx, 0x696a5eab
mov dword [0x643e8270], eax
mov dword [0x643e812c], edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor eax, eax
cmp word [eax + str.Failed_to_allocate_DB_structure], 0
je 0x643d2bf5
add eax, 2
cmp eax, 0xadc
jne 0x643d2bd2
imul eax, dword [0x643e8268], 0x90a9504a
mov dword [0x643e812c], eax
mov edx, dword [0x643e812c]
mov ebx, dword [ebp - 4]
imul eax, edx, 0x221f65fe
add edx, 0x5e813325
mov dword [0x643e81d0], edx
mov dword [0x643e8270], eax
xor eax, 0x769d72f3
mov dword [0x643e8268], eax
leave
ret

Function at 0x643d2c24
Capabilities:
Identify system language via api

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x643e7e18]
or eax, 0x73a295f3
mov dword [0x643e8148], eax
cmp word [edx + str.Address_of_the_debug_info_found_in_the_active_list.], 0
je 0x643d2c5a
add edx, 2
cmp edx, 0xa3c
jne 0x643d2c3b
xor eax, 0x313519d0
mov dword [0x643e7e18], eax
imul eax, dword [str.IM], 0xad196c29
mov dword [esp], str.Failed_to_get_the_database_id
mov dword [str.IM], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x643e8194]
push eax
mov eax, dword [0x643e8148]
lea edx, [ecx - 0x3c67f211]
mov ecx, dword [0x643e7e18]
add eax, 0xfd08b1
mov dword [str.IM], edx
or eax, 0x726f7557
lea edx, [ecx + 0x6e864ff5]
mov dword [0x643e8194], eax
xor eax, 0xc924d061
mov dword [0x643e7e18], eax
mov eax, edx
xor eax, 0x1a40b7e9
mov dword [0x643e8148], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [str.IM]
movzx eax, ax
xor eax, 0xa1300eae
or edx, 0x66570b33
add eax, 0x6e7224c4
mov dword [0x643e8148], edx
mov edx, eax
mov dword [0x643e8194], eax
and edx, 0xc7468753
mov dword [str.IM], edx
leave
ret
Function at 0x643d36bc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x480
push ebx
mov ebx, str.An_invalid_allocation_instance_is_being_referenced.
sub esp, 0x2c
mov eax, dword [0x643e7f6c]
imul edx, dword [0x643e807c], 0xaab6a478
mov dword [0x643e80d4], edx
movzx ecx, byte [ebx]
inc ebx
test cl, cl
je 0x643d36f6
add esi, ecx
cmp esi, 0x169c
jbe 0x643d36e4
and eax, 0x6529c3b9
mov ebx, str.Error_getting_StringRef
mov esi, 0x51f
mov dword [0x643e8278], eax
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
je 0x643d372a
add esi, ecx
cmp esi, 0x5e1
jbe 0x643d370a
imul eax, eax, 0xb78c5f1
mov dword [0x643e8278], eax
mov eax, edx
or edx, 0xf95ff9df
or eax, 0xe94de1db
mov dword [0x643e7f6c], edx
mov dword [0x643e807c], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, str._cHRM_WhitePointY
mov ecx, 0x332
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643d3767
add ecx, eax
cmp ecx, 0x2539
jbe 0x643d3752
mov eax, dword [0x643e807c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
xor dword [0x643e7f6c], 0x9aad6811
add eax, 0x424d5dc9
imul edx, eax, 0x73f863d3
mov dword [0x643e80d4], eax
mov dword [0x643e8278], edx
mov dword [esp], eax
call ebx
mov esi, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push ecx
mov eax, dword [0x643e8278]
imul edx, eax, 0xb0da069e
imul eax, eax, 0x52f647
mov dword [0x643e80d4], edx
add eax, 0x31231de3
mov dword [0x643e8278], eax
mov eax, dword [0x643e7f6c]
xor eax, 0x9463f68e
mov dword [0x643e807c], eax
mov dword [esp], 0x182f
call esi
push edi
mov eax, dword [0x643e7f6c]
mov edi, 0x278
and eax, 0xccedbdc1
mov dword [0x643e8278], eax
mov dword [esp], 0x17f
call dword [sym.imp.USER32.dll_IsZoomed]
mov ecx, str.Error_getting_StringRef
push edx
mov dword [ebp - 0x1c], eax
imul eax, eax, 0x1d747208
mov dword [0x643e8278], eax
mov eax, dword [0x643e80d4]
lea edx, [eax - 0x1593c4a]
mov dword [0x643e807c], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x643d3840
add edi, edx
cmp edi, 0x422
jbe 0x643d381e
imul edx, dword [ebp - 0x1c], 0x4c52b620
mov dword [0x643e8278], edx
lea edx, [eax + 0x14d167e9]
and eax, 0xf81bbd5e
mov dword [0x643e7f6c], edx
mov dword [0x643e80d4], eax
mov dword [esp], 0x160c
call esi
push eax
mov eax, dword [0x643e7f6c]
imul edx, eax, 0x3d550071
mov dword [0x643e80d4], edx
imul edx, eax, 0x5b0ff972
mov dword [0x643e807c], edx
mov dword [esp], eax
call ebx
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x643d4004
Capabilities:
Identify system language via api

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x18
cmp byte [eax + str.The_requested_authentication_level_is_not_supported.], 0
je 0x643d402c
inc eax
cmp eax, 0x389
jne 0x643d400c
mov eax, dword [0x643e7e1c]
and eax, 0x35dc1bf
mov dword [0x643e8124], eax
mov eax, dword [0x643e8124]
xor edx, edx
xor eax, 0xdef073ef
imul eax, eax, 0xc89eeb60
mov dword [0x643e8124], eax
cmp byte [edx + str.VirtualProtect_Failed_0x_p__x], 0
je 0x643d405f
inc edx
cmp edx, 0x1f0c
jne 0x643d4043
add eax, 0x1e842299
mov dword [0x643e8124], eax
mov eax, dword [0x643e8124]
add eax, 0x52a0507c
mov dword [0x643e7e1c], eax
xor eax, 0xfd2ab719
imul eax, eax, 0x7a0ace19
mov dword [0x643e8124], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x643e7e1c]
mov dword [esp], 0x1cab
lea edx, [eax + 0x40a288d0]
add eax, 0x32bbd0dd
mov dword [0x643e8124], eax
mov dword [0x643e7e1c], edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov eax, dword [0x643e7e1c]
imul ecx, eax, 0x6816cefc
lea edx, [ecx - 0x1b9ec692]
mov dword [0x643e8124], edx
xor edx, edx
cmp byte [edx + str.Windows.WindowsPhone8x], 0
je 0x643d40e4
inc edx
cmp edx, 0x899
jne 0x643d40c6
add ecx, 0x3b9dfa17
mov dword [0x643e8124], ecx
and eax, 0x82bfbaca
mov dword [0x643e7e1c], eax
mov eax, dword [0x643e8124]
and eax, 0x60fb5fd5
xor eax, 0x2713600
mov dword [0x643e8124], eax
leave
ret
Function at 0x643d4630
Capabilities:
Accept command line arguments

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x14
cmp byte [eax + str.Signature_Size], 0
je 0x643d4659
inc eax
cmp eax, 0xeab
jne 0x643d4639
imul eax, dword [0x643e81d8], 0xb5666d
mov dword [0x643e7d88], eax
mov eax, dword [0x643e8154]
xor edx, edx
cmp byte [edx + 0x643e9520], 0
je 0x643d4684
inc edx
cmp edx, 0x189b
jne 0x643d4660
mov ebx, dword [0x643e81d8]
lea edx, [ebx + 0x34db1a9d]
mov dword [0x643e7d88], edx
mov edx, eax
and edx, 0xb4908b88
cmp byte [str.StandardBias], 0
mov dword [0x643e81d8], edx
je 0x643d46a5
and dword [0x643e7d88], 0x84313e9f
imul edx, eax, 0x54d9fff4
mov ecx, 0x643e9520
or dword [0x643e7d88], 0x8e55875
mov dword [0x643e8198], edx
mov dl, byte [ecx]
test dl, dl
je 0x643d46e4
sub edx, 0x30
cmp dl, 9
jbe 0x643d46e1
imul eax, eax, 0x75c6af00
mov dword [0x643e8154], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x643d46e4
inc ecx
jmp 0x643d46c0
mov eax, dword [0x643e8198]
mov ecx, 0x643e9520
mov ebx, 0x18a
mov edx, eax
or edx, 0x8e40c9e7
mov dword [0x643e81d8], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x643d4722
add ebx, edx
cmp ebx, 0x81
jbe 0x643d4701
and eax, 0x6469cb10
or eax, 0x440c900
mov dword [0x643e81d8], eax
mov eax, dword [0x643e81d8]
xor edx, edx
sub eax, 0x36f17a99
imul eax, eax, 0x45f6420c
mov dword [0x643e81d8], eax
mov eax, dword [0x643e8154]
sub eax, 0x60d79036
cmp byte [edx + str.LockVariable], 0
je 0x643d4761
inc edx
cmp edx, 0x369
jne 0x643d4743
imul edx, eax, 0xe9d5180d
mov dword [0x643e81d8], edx
mov ecx, str.StandardBias
mov bl, byte [ecx]
lea edx, [ebx - 0x30]
cmp dl, 9
ja 0x643d4773
inc ecx
jmp 0x643d4766
or eax, 0x5181cc53
mov dword [esp], 0x25e4
mov dword [0x643e7d88], eax
mov eax, dword [0x643e81d8]
xor eax, 0x40a7deb
mov dword [0x643e8198], eax
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ebx, dword [ebp - 4]
xor eax, 0xf1110f7f
push edx
mov dword [0x643e81d8], eax
leave
ret
Function at 0x643d4d50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ecx, 0x10c3
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edx, ebx
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643d4d7e
add ecx, eax
cmp ecx, 0x37f
jbe 0x643d4d69
mov eax, ebx
mov cx, word [eax]
lea edx, [ecx - 0x30]
cmp dx, 9
ja 0x643d4d91
add eax, 2
jmp 0x643d4d80
mov edx, edi
mov ax, word [edx]
sub eax, 0x30
cmp ax, 9
ja 0x643d4da4
add edx, 2
jmp 0x643d4d93
mov eax, esi
mov edx, str.Specified_video_present_target_is_invalid.
or eax, 0xb8ba9145
mov dword [0x643e7e98], eax
mov al, byte [edx]
test al, al
je 0x643d4dd3
sub eax, 0x30
cmp al, 9
jbe 0x643d4dd0
mov eax, esi
xor eax, 0xaa17d2b2
mov dword [0x643e7e98], eax
jmp 0x643d4dd3
inc edx
jmp 0x643d4db5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, ebx
mov ax, word [edx]
sub eax, 0x30
cmp ax, 9
ja 0x643d4dec
add edx, 2
jmp 0x643d4ddb
and esi, 0x9133a8f8
mov dword [0x643e7e98], esi
mov ax, word [ebx]
sub eax, 0x30
cmp ax, 9
ja 0x643d4e09
add ebx, 2
jmp 0x643d4df8
mov edx, 0x153a
movzx eax, word [edi]
add edi, 2
test ax, ax
je 0x643d4e23
add edx, eax
cmp edx, 0x1ed
jbe 0x643d4e0e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, dword [0x643e7e98]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43f26e
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor al, al
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x43f2d1
push ebx
push edi
mov edx, 0x10000000
cmp ecx, 0x7c
je 0x43f2cf
cmp ecx, 0x29
jne 0x43f2d3
cmp dword [esi + 0x10], 0
jne 0x43f2cf
lea edi, [esi + 0x50]
test dword [edi], edx
je 0x43f3cc
cmp ecx, 0x5d
jne 0x43f2aa
test dword [edi], edx
je 0x43f3c0
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0043ebd6
mov ecx, esi
call fcn.0044117c
mov ecx, esi
call fcn.004411bc
mov ecx, dword [esi + 0x4c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x43f27d
pop edi
pop ebx
pop esi
ret
lea edi, [esi + 0x50]
cmp ecx, 0x2e
jne 0x43f2e7
push 5
lea ecx, [esi + 0x24]
call fcn.0044113e
jmp 0x43f2b7
cmp ecx, 0x5c
jne 0x43f332
mov ecx, esi
call fcn.0044117c
test byte [edi], 0x80
je 0x43f329
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x43f312
push 4
lea ecx, [esi + 0x24]
call fcn.0044113e
mov ecx, esi
call fcn.0044117c
jmp 0x43f2c5
cmp al, 0x42
jne 0x43f329
push 4
lea ecx, [esi + 0x24]
call fcn.0044113e
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x43f309
mov ecx, esi
call fcn.0043f3d6
jmp 0x43f2be
cmp ecx, 0x5b
jne 0x43f355
mov ecx, esi
call fcn.0044117c
mov ecx, esi
call fcn.0043fa11
push 4
push 0x5d
mov ecx, esi
call fcn.004408cb
jmp 0x43f2be
cmp ecx, 0x28
jne 0x43f382
mov ecx, esi
call fcn.0044117c
mov ecx, esi
call fcn.004417f7
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.004408cb
test bl, bl
je 0x43f2c5
jmp 0x43f2be
cmp ecx, 0x5e
jne 0x43f38e
push 2
jmp 0x43f301
cmp ecx, 0x24
jne 0x43f39a
push 3
jmp 0x43f301
cmp ecx, 0x2a
je 0x43f3c4
cmp ecx, 0x2b
je 0x43f3c4
cmp ecx, 0x3f
je 0x43f3c4
cmp ecx, 0x7b
je 0x43f3c4
cmp ecx, 0x7d
jne 0x43f29d
test dword [edi], edx
je 0x43f3c8
jmp 0x43f2aa
push 4
jmp 0x43f3ce
push 0xa
jmp 0x43f3ce
push 6
jmp 0x43f3ce
push 5
mov ecx, esi
call fcn.00440895
int3

Function at 0x442587
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x4697b8
call fcn.00443cb8
push ecx
push esi
xor esi, esi
inc esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
push 0x496308
call fcn.0043d928
and dword [ebp - 4], 0
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_GetClipboardOwner]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x442612
push esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x44260c
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x4425f5
call dword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x442612
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.read_clipboard____Error:_0x_X
call fcn.004420ca
pop ecx
pop ecx
jmp 0x442612
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 8]
push eax
call fcn.0044288f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x44447e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4444bd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4444bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4444bd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4444bd
cmp dword [ecx + 0x74], 0xe
jbe 0x4444bd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44f8c8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49a798
push 0x49a790
push str.FlsAlloc
push 0x1f
call fcn.0044f790
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44f8fc
push dword [ebp + 8]
mov ecx, esi
call dword [0x46a198]
call esi
jmp 0x44f902
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44f946
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49a7a8
push 0x49a7a0
push str.FlsGetValue
push 0x21
call fcn.0044f790
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44f97d
push dword [ebp + 8]
mov ecx, esi
call dword [0x46a198]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x44f985
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49a7b0
push 0x49a7a8
push str.FlsSetValue
push 0x22
call fcn.0044f790
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44f9bf
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x46a198]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x454823
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4548c0
push ebx
push esi
call fcn.004547ec
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004535c1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x45486d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4548bf
push edi
push eax
call fcn.00450909
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x45488d
call fcn.0044f3eb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4548be
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004535c1
add esp, 0x20
test eax, eax
jne 0x4548ac
push edi
call fcn.0044f3eb
jmp 0x4548b4
push ebx
call fcn.0044f3eb
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x456f25
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0044f100
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x456f94
cmp esi, dword [ebp - 4]
je 0x456f8f
cmp dword [ebp + 0xc], 0
je 0x456f8f
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x456f6c
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00456a77
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x456f96
xor eax, eax
inc eax
jmp 0x456f96
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x456ffb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a9018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0044f100
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0044f100
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x457072
cmp word [ecx], dx
je 0x457072
mov eax, dword [0x49ae9c]
push edi
dec eax
push eax
push 0x49ad88
call fcn.00456f9a
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4570e5
cmp word [eax], dx
je 0x4570e5
mov eax, dword [edi]
test eax, eax
je 0x457096
cmp word [eax], dx
je 0x457096
lea eax, [ebp - 0x10]
push eax
call fcn.0045697d
jmp 0x45709f
lea eax, [ebp - 0x10]
push eax
call fcn.00456a18
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x45710f
mov eax, dword [0x49ad84]
push dword [ebp - 0x14]
dec eax
push eax
push 0x49aa78
call fcn.00456f9a
add esp, 0xc
test al, al
je 0x45710f
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4570da
cmp word [eax], di
je 0x4570da
lea eax, [ebp - 0x10]
push eax
call fcn.0045697d
pop ecx
jmp 0x457111
lea eax, [ebp - 0x10]
push eax
call fcn.00456a18
jmp 0x4570d7
mov eax, dword [edi]
test eax, eax
je 0x4570fc
cmp word [eax], dx
je 0x4570fc
lea eax, [ebp - 0x10]
push eax
call fcn.00456932
pop ecx
jmp 0x45710f
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4571da
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00456e1f
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4571da
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4571da
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4571da
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x457167
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0044fac5
test ebx, ebx
je 0x4571d5
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0044fac5
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4571da
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4571da
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0045bc94
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4571dc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443f82
leave
ret
Function at 0x45bf3f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4aa8a8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45bf7f
cmp byte [ebx], 0xa
jne 0x45bf7f
or byte [edi + eax + 0x28], 4
jmp 0x45bf84
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x45c083
mov dl, byte [eax]
cmp dl, 0x1a
je 0x45c066
inc eax
cmp dl, 0xd
je 0x45bfb0
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x45bfd6
cmp eax, ecx
jae 0x45bfe4
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x45bf98
jmp 0x45c083
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45c061
cmp dword [ebp - 0x10], 0
je 0x45c061
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4aa8a8]
test byte [eax + edi + 0x28], 0x48
je 0x45c03b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x45c026
mov byte [esi], dl
jmp 0x45c037
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4aa8a8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x45c083
cmp byte [ebp - 1], 0xa
jne 0x45c04a
cmp esi, ebx
jne 0x45c04a
mov byte [esi], 0xa
jmp 0x45c082
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0045beaf
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x45c083
mov byte [esi], 0xd
jmp 0x45c082
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4aa8a8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x45c080
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x45c083
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret