joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58ce40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
test ebx, ebx
jle 0x58cfdf
cmp ebx, 0x100
jle 0x58ce67
mov ebx, 0x100
mov dword [ebp + 0x20], ebx
mov esi, dword [ebp + 0x1c]
fld dword [esi + 4]
fldz
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x58ce80
fadd qword [0x650bc0]
jmp 0x58ce86
fsub qword [0x650bc0]
call fcn.005c6e00
imul eax, dword [ebp + 0x10]
fld dword [esi + 4]
mov ecx, dword [ebp + 8]
lea edi, [ecx + eax*4]
mov dword [ebp + 8], edi
call fcn.005c6e00
mov ecx, eax
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
fld dword [esi + 0xc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x58cfdf
mov edx, dword [ebp + 0x10]
lea eax, [edx*4]
mov edx, dword [ebp + 0x18]
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
jg 0x58cfb9
push esi
lea esi, [esp + 0x24]
call fcn.004f0610
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
cmp esi, dword [esp + 0x24]
jge 0x58cfb2
jmp 0x58cf10
mov edx, dword [ebp + 0xc]
sar eax, 8
sar ecx, 8
imul ecx, dword [ebp + 0x14]
add ecx, eax
mov edx, dword [edx + ecx*4]
mov edi, dword [edi + esi*4]
mov ecx, edx
and ecx, 0xffff00ff
imul ecx, ebx
mov eax, edx
and eax, 0xff00
imul eax, ebx
xor ecx, eax
mov eax, edx
and eax, 0xff00ff
imul eax, ebx
and ecx, 0xff0000
xor ecx, eax
shr ecx, 8
mov eax, edi
not eax
mov ebx, eax
xor eax, ecx
and eax, 0xfefefe
and ebx, ecx
lea eax, [eax + ebx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or eax, edi
mov edi, dword [ebp + 8]
or ebx, ecx
mov ecx, dword [esp + 0x18]
add ecx, dword [esp + 0x34]
sub eax, ebx
mov ebx, dword [ebp + 0x20]
xor eax, edx
and eax, 0xffffff
xor eax, edx
mov dword [edi + esi*4], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x30]
inc esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
cmp esi, dword [esp + 0x24]
jl 0x58cf10
mov ecx, dword [esp + 0x10]
mov esi, dword [ebp + 0x1c]
inc dword [esp + 0xc]
fild dword [esp + 0xc]
add edi, dword [esp + 0x1c]
fld dword [esi + 0xc]
add ecx, 0x18
mov dword [ebp + 8], edi
fcompp
mov dword [esp + 0x10], ecx
fnstsw ax
test ah, 0x41
je 0x58ced5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x58cff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
test edi, edi
jle 0x58d18a
cmp edi, 0x100
jle 0x58d014
mov edi, 0x100
mov esi, dword [ebp + 0x1c]
fld dword [esi + 4]
fldz
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x58d02d
fadd qword [0x650bc0]
jmp 0x58d033
fsub qword [0x650bc0]
call fcn.005c6e00
imul eax, dword [ebp + 0x10]
fld dword [esi + 4]
mov ecx, dword [ebp + 8]
lea ebx, [ecx + eax*4]
mov dword [ebp + 8], ebx
call fcn.005c6e00
mov ecx, eax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fld dword [esi + 0xc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x58d18a
mov edx, dword [ebp + 0x10]
lea eax, [edx*4]
mov edx, dword [ebp + 0x18]
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ecx
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
jg 0x58d164
push esi
lea esi, [esp + 0x2c]
call fcn.004f0610
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
cmp esi, dword [esp + 0x2c]
jge 0x58d15d
mov edx, dword [ebp + 0xc]
sar ecx, 8
imul ecx, dword [ebp + 0x14]
sar eax, 8
add ecx, eax
mov edx, dword [edx + ecx*4]
mov ecx, dword [ebx + esi*4]
mov eax, edx
and eax, 0xffff00ff
imul eax, edi
mov ebx, edx
and ebx, 0xff00
imul ebx, edi
xor eax, ebx
mov ebx, edx
and ebx, 0xff00ff
imul ebx, edi
and eax, 0xff0000
xor eax, ebx
shr eax, 8
mov dword [esp + 0x18], ecx
mov ebx, eax
and ebx, ecx
mov ecx, eax
xor ecx, dword [esp + 0x18]
inc esi
and ecx, 0xfefefe
lea ecx, [ecx + ebx*2]
mov ebx, dword [ebp + 8]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, dword [esp + 0x18]
or eax, ecx
mov ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x3c]
xor eax, edx
and eax, 0xffffff
xor eax, edx
mov dword [ebx + esi*4 - 4], eax
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
cmp esi, dword [esp + 0x2c]
jl 0x58d0b5
mov esi, dword [ebp + 0x1c]
mov ecx, dword [esp + 0x14]
inc dword [esp + 0x10]
fild dword [esp + 0x10]
add ebx, dword [esp + 0x24]
fld dword [esi + 0xc]
add ecx, 0x18
mov dword [ebp + 8], ebx
fcompp
mov dword [esp + 0x14], ecx
fnstsw ax
test ah, 0x41
je 0x58d082
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x58d4b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
test edi, edi
jg 0x58d4ee
mov edx, dword [ebp + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x1dc]
push edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
cmp edi, 0x100
jl 0x58d526
mov eax, dword [ebp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1e0]
push 0xffffff
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [ebp + 0x1c]
fld dword [esi + 4]
fldz
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x58d53f
fadd qword [0x650bc0]
jmp 0x58d545
fsub qword [0x650bc0]
call fcn.005c6e00
fld dword [esi + 4]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
imul eax, ebx
lea edx, [ecx + eax*4]
mov dword [ebp + 8], edx
call fcn.005c6e00
mov ecx, eax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fld dword [esi + 0xc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x58d653
mov edx, dword [ebp + 0x18]
lea eax, [ebx*4]
lea ecx, [ecx + ecx*2]
lea ebx, [edx + ecx*8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jg 0x58d62d
push esi
mov ecx, ebx
lea esi, [esp + 0x24]
call fcn.004f0610
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x24]
jge 0x58d62a
sar eax, 8
imul eax, dword [ebp + 0x14]
mov edx, esi
sar edx, 8
add eax, edx
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + eax*4]
mov eax, edx
not eax
mov ebx, eax
and ebx, 0xffff00ff
imul ebx, edi
mov edi, eax
and edi, 0xff00
imul edi, dword [ebp + 0x20]
add esi, dword [esp + 0x30]
xor ebx, edi
mov edi, dword [ebp + 0x20]
and eax, 0xff00ff
imul eax, edi
and ebx, 0xff0000
xor ebx, eax
mov eax, dword [ebp + 8]
shr ebx, 8
add ebx, edx
mov dword [eax + ecx*4], ebx
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x34]
inc ecx
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x24]
jl 0x58d5c0
mov ebx, dword [esp + 0x18]
mov esi, dword [ebp + 0x1c]
inc dword [esp + 0x10]
fild dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
fld dword [esi + 0xc]
add dword [ebp + 8], ecx
add ebx, 0x18
fcompp
mov dword [esp + 0x18], ebx
fnstsw ax
test ah, 0x41
je 0x58d593
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x58d660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
test edi, edi
jg 0x58d6a0
mov edx, dword [ebp + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x1e0]
push 0
push edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
cmp edi, 0x100
jl 0x58d6d3
mov eax, dword [ebp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1dc]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [ebp + 0x1c]
fld dword [esi + 4]
fldz
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x58d6ec
fadd qword [0x650bc0]
jmp 0x58d6f2
fsub qword [0x650bc0]
call fcn.005c6e00
fld dword [esi + 4]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
imul eax, ebx
lea edx, [ecx + eax*4]
mov dword [ebp + 8], edx
call fcn.005c6e00
mov ecx, eax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fld dword [esi + 0xc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x58d800
mov edx, dword [ebp + 0x18]
lea eax, [ebx*4]
lea ecx, [ecx + ecx*2]
lea ebx, [edx + ecx*8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jg 0x58d7da
push esi
mov ecx, ebx
lea esi, [esp + 0x24]
call fcn.004f0610
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x24]
jge 0x58d7d7
sar eax, 8
imul eax, dword [ebp + 0x14]
mov esi, edx
sar esi, 8
add eax, esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + eax*4]
mov esi, eax
and esi, 0xffff00ff
mov ebx, eax
imul esi, edi
and ebx, 0xff00
imul ebx, edi
xor esi, ebx
add edx, dword [esp + 0x30]
mov ebx, eax
and ebx, 0xff00ff
imul ebx, edi
and esi, 0xff0000
xor esi, ebx
and eax, 0xff000000
shr esi, 8
or esi, eax
mov eax, dword [ebp + 8]
mov dword [eax + ecx*4], esi
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x34]
inc ecx
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x24]
jl 0x58d76d
mov ebx, dword [esp + 0x18]
mov esi, dword [ebp + 0x1c]
inc dword [esp + 0x10]
fild dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
fld dword [esi + 0xc]
add dword [ebp + 8], ecx
add ebx, 0x18
fcompp
mov dword [esp + 0x18], ebx
fnstsw ax
test ah, 0x41
je 0x58d740
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x5913c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5cbd8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [ebp + 0xc]
push esi
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.00401c50
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x40], 0
call fcn.00421a30
mov ecx, dword [edi + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
add esp, 4
call eax
lea ecx, [esp + 4]
push ecx
lea eax, [edi + 8]
lea esi, [esp + 0x18]
call fcn.0041d6f0
mov edx, dword [eax]
mov ecx, dword [edi + 4]
mov esi, dword [eax + 4]
mov eax, dword [ecx]
mov dword [esp + 0xc], edx
mov edx, dword [eax + 0xc]
call edx
test esi, esi
je 0x59148d
cmp byte [esi + 0x88], 0
je 0x59148d
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push 0
add esi, 0x20
push esi
call fcn.00401c50
cmp dword [esp + 0x28], 0x10
jb 0x591479
mov eax, dword [esp + 0x14]
push eax
call fcn.0048f06d
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [esp + 0x28], 0x10
jb 0x5914a1
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0048f06d
add esp, 4
mov ecx, dword [esp + 0x34]
xor al, al
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5aeb30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
mov dword [esi], vtable.CThread.0
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov byte [esi + 0xe], 0
mov byte [esi + 0xc], 1
call fcn.004dae90
mov dword [ebp - 4], edi
lea eax, [esi + 0x14]
mov dword [esi], vtable.CLoadingThread.0
push eax
mov dword [esi + 0x10], vtable.CCriticalSection.0
call dword [0x6100ec]
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
push 0x1a0
mov byte [ebp - 4], 2
call fcn.0048f2c5
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
cmp eax, edi
je 0x5aebaf
push eax
call fcn.005757f0
jmp 0x5aebb1
xor eax, eax
mov edi, eax
mov byte [ebp - 4], 2
call fcn.0040a8f0
push eax
lea edi, [esi + 0x2c]
call fcn.0041a180
mov eax, dword [esi + 4]
test eax, eax
je 0x5aebdd
cmp byte [esi + 0xc], 0
je 0x5aebdd
push eax
mov byte [esi + 0xc], 0
call dword [0x6100d8]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5c42e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d1bf9
push eax
mov dword fs:[0], esp
sub esp, 0x34
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
jge 0x5c444e
mov edx, dword [0x6a74c4]
mov esi, dword [edx]
cmp esi, edx
je 0x5c436c
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x5c4328
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
mov edx, dword [0x6a74c4]
cmp byte [esi + 0x19], 0
jne 0x5c4368
mov eax, dword [esi + 8]
cmp byte [eax + 0x19], 0
jne 0x5c434d
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x19], 0
jne 0x5c4368
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x19], 0
je 0x5c4341
jmp 0x5c4368
mov eax, dword [esi + 4]
cmp byte [eax + 0x19], 0
jne 0x5c4366
cmp esi, dword [eax + 8]
jne 0x5c4366
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x19], 0
je 0x5c4356
mov esi, eax
cmp esi, edx
jne 0x5c4314
cmp dword [0x6a9dc0], 0
je 0x5c44ef
mov esi, dword [0x683d54]
mov ecx, dword [0x683d40]
mov eax, ecx
cmp esi, 0x10
jae 0x5c4391
mov eax, 0x683d40
mov edx, dword [0x683d50]
add edx, eax
cmp esi, 0x10
jae 0x5c43a3
mov ecx, 0x683d40
xor eax, eax
cmp ecx, edx
je 0x5c43cd
lea esp, [esp]
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [ecx]
lea esi, [esi + edi - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x5c43b0
xor edx, edx
div dword [0x6a9db4]
mov eax, dword [0x6a9db0]
push 0x683d40
lea esi, [eax + edx*4]
mov eax, esi
call fcn.0041e360
mov ecx, dword [eax]
test ecx, ecx
je 0x5c44ef
mov edx, dword [ecx]
push edx
push ecx
mov dword [eax], edx
call fcn.0041dd50
sub dword [0x6a9dc0], eax
mov eax, dword [0x6a9dc8]
cmp esi, eax
jne 0x5c44ef
cmp dword [0x6a9dc0], 0
je 0x5c4435
cmp dword [eax], 0
jne 0x5c44ef
add eax, 4
mov dword [0x6a9dc8], eax
cmp dword [eax], 0
je 0x5c4423
jmp 0x5c44ef
mov ecx, dword [0x6a9db4]
mov edx, dword [0x6a9db0]
lea eax, [edx + ecx*4]
mov dword [0x6a9dc8], eax
jmp 0x5c44ef
lea ecx, [ebp + 8]
lea edi, [ebp - 0x3c]
call fcn.0040f8d0
mov esi, eax
mov ecx, 0x683d40
mov edx, 0x6a9db0
mov dword [ebp - 4], 0
call fcn.00416e40
lea ecx, [ebp - 0x18]
push ecx
add eax, 0x84
call fcn.0041d6f0
cmp dword [eax + 4], 0
mov edx, dword [eax]
setne bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0x10
mov dword [ebp - 0x20], edx
jb 0x5c44a4
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0048f06d
add esp, 4
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x3c], 0
test bl, bl
je 0x5c44e3
lea ecx, [ebp + 8]
call fcn.0041b130
cmp dword [eax], 0
je 0x5c44d8
lea ecx, [ebp + 8]
call fcn.0041b130
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00433520
jmp 0x5c44ec
mov edx, dword [ebp + 8]
push edx
call fcn.0046d410
add esp, 4
cmp byte [0x692b3f], 0
je 0x5c4503
mov eax, dword [0x692f10]
push eax
call fcn.00506dd0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10001527
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x10038a48]
fld qword [0x10038a40]
fdiv st(1), st(0)
fxch st(1)
call fcn.1001d980
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1001d980
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x10038a38]
fadd qword [0x10038a30]
call fcn.1001d980
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x100389dc
push eax
call fcn.10033db7
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x10001671
push dword [ebp - 0x78]
jmp 0x10001676
push 0x100389e4
push 0x20
push eax
call fcn.10033db7
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x3d8
leave
ret 0x14
Function at 0x10007dfb
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x10038a48]
fld qword [0x10038a40]
fdiv st(1), st(0)
fxch st(1)
call fcn.1001d980
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.1001d980
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x10038a38]
fadd qword [0x10038a30]
call fcn.1001d980
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x10039320
push eax
call fcn.10033db7
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x10007f45
push dword [ebp - 0x78]
jmp 0x10007f4a
push 0x10039328
push 0x20
push eax
call fcn.10033db7
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0x3d8
leave
ret 0x14

Function at 0x10008ee6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f34
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10008f45
push 0xd
pop eax
jmp 0x10008f6f
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10008f48
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x1000c26f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x10047578]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10033db7
mov ebx, eax
cmp ebx, esi
je 0x1000c2e2
lea ecx, [ebp - 0x74]
call fcn.1000135a
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d742
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000c2fa
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.1000c26f
cmp eax, esi
jne 0x1000c32c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000c2ea
lea ecx, [ebp - 0x74]
call fcn.1000135a
push dword [ebp - 0x78]
mov ecx, edi
call fcn.10008dd7
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.1000135a
mov eax, esi
jmp 0x1000c2c8