joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419d00
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040fcfb
lea edi, [eax + 0x9c]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x419ca8
or dword [edi + 8], 0x104
jmp 0x419d6b
mov dword [edi], eax
add eax, 0x40
lea ebx, [edi + 4]
mov dword [ebx], eax
je 0x419cc9
cmp byte [eax], 0
je 0x419cc9
push ebx
push 0x16
push 0x41db50
call fcn.004116a4
add esp, 0xc
mov eax, dword [edi]
and dword [edi + 8], 0
test eax, eax
je 0x419d2e
cmp byte [eax], 0
je 0x419d2e
mov eax, dword [ebx]
test eax, eax
je 0x419cec
cmp byte [eax], 0
je 0x419cec
mov esi, edi
call fcn.004010c3
jmp 0x419cf3
mov esi, edi
call fcn.0040f10c
cmp dword [edi + 8], 0
jne 0x419d81
push edi
push 0x40
push 0x41d948
call fcn.004116a4
add esp, 0xc
test eax, eax
je 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d25
cmp byte [ebx], 0
je 0x419d25
mov esi, edi
call fcn.004010c3
jmp 0x419d77
mov esi, edi
call fcn.0040f10c
jmp 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d64
cmp byte [ebx], 0
je 0x419d64
push ebx
call fcn.00402d0a
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x419321
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [edi + 8], 4
jne 0x419d77
and dword [edi + 8], 0
jmp 0x419d77
mov dword [edi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
cmp dword [edi + 8], 0
je 0x419e6c
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 0xffffff80
neg esi
sbb esi, esi
and esi, eax
call fcn.00411706
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x419e6c
cmp esi, 0xfde8
je 0x419e6c
cmp esi, 0xfde9
je 0x419e6c
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x419e6c
push 1
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x419e6c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x419df8
mov cx, word [edi + 0x18]
mov word [eax], cx
mov cx, word [edi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], si
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x419e67
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x419e2f
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.0040d663
add esp, 0xc
test eax, eax
je 0x419e40
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040e571
push 0x40
push ebx
push 0x1001
push dword [edi + 0x18]
call esi
test eax, eax
je 0x419e6c
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [edi + 0x1c]
call esi
test eax, eax
je 0x419e6c
push 0xa
push 0x10
sub ebx, 0xffffff80
push ebx
push dword [ebp + 8]
call fcn.0040d7a7
add esp, 0x10
xor eax, eax
inc eax
jmp 0x419e6e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x419d2b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040fcfb
lea edi, [eax + 0x9c]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x419ca8
or dword [edi + 8], 0x104
jmp 0x419d6b
mov dword [edi], eax
add eax, 0x40
lea ebx, [edi + 4]
mov dword [ebx], eax
je 0x419cc9
cmp byte [eax], 0
je 0x419cc9
push ebx
push 0x16
push 0x41db50
call fcn.004116a4
add esp, 0xc
mov eax, dword [edi]
and dword [edi + 8], 0
test eax, eax
je 0x419d2e
cmp byte [eax], 0
je 0x419d2e
mov eax, dword [ebx]
test eax, eax
je 0x419cec
cmp byte [eax], 0
je 0x419cec
mov esi, edi
call fcn.004010c3
jmp 0x419cf3
mov esi, edi
call fcn.0040f10c
cmp dword [edi + 8], 0
jne 0x419d81
push edi
push 0x40
push 0x41d948
call fcn.004116a4
add esp, 0xc
test eax, eax
je 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d25
cmp byte [ebx], 0
je 0x419d25
mov esi, edi
call fcn.004010c3
jmp 0x419d77
mov esi, edi
call fcn.0040f10c
jmp 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d64
cmp byte [ebx], 0
je 0x419d64
push ebx
call fcn.00402d0a
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x419321
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [edi + 8], 4
jne 0x419d77
and dword [edi + 8], 0
jmp 0x419d77
mov dword [edi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
cmp dword [edi + 8], 0
je 0x419e6c
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 0xffffff80
neg esi
sbb esi, esi
and esi, eax
call fcn.00411706
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x419e6c
cmp esi, 0xfde8
je 0x419e6c
cmp esi, 0xfde9
je 0x419e6c
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x419e6c
push 1
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x419e6c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x419df8
mov cx, word [edi + 0x18]
mov word [eax], cx
mov cx, word [edi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], si
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x419e67
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x419e2f
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.0040d663
add esp, 0xc
test eax, eax
je 0x419e40
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040e571
push 0x40
push ebx
push 0x1001
push dword [edi + 0x18]
call esi
test eax, eax
je 0x419e6c
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [edi + 0x1c]
call esi
test eax, eax
je 0x419e6c
push 0xa
push 0x10
sub ebx, 0xffffff80
push ebx
push dword [ebp + 8]
call fcn.0040d7a7
add esp, 0x10
xor eax, eax
inc eax
jmp 0x419e6e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x419d69
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040fcfb
lea edi, [eax + 0x9c]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x419ca8
or dword [edi + 8], 0x104
jmp 0x419d6b
mov dword [edi], eax
add eax, 0x40
lea ebx, [edi + 4]
mov dword [ebx], eax
je 0x419cc9
cmp byte [eax], 0
je 0x419cc9
push ebx
push 0x16
push 0x41db50
call fcn.004116a4
add esp, 0xc
mov eax, dword [edi]
and dword [edi + 8], 0
test eax, eax
je 0x419d2e
cmp byte [eax], 0
je 0x419d2e
mov eax, dword [ebx]
test eax, eax
je 0x419cec
cmp byte [eax], 0
je 0x419cec
mov esi, edi
call fcn.004010c3
jmp 0x419cf3
mov esi, edi
call fcn.0040f10c
cmp dword [edi + 8], 0
jne 0x419d81
push edi
push 0x40
push 0x41d948
call fcn.004116a4
add esp, 0xc
test eax, eax
je 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d25
cmp byte [ebx], 0
je 0x419d25
mov esi, edi
call fcn.004010c3
jmp 0x419d77
mov esi, edi
call fcn.0040f10c
jmp 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d64
cmp byte [ebx], 0
je 0x419d64
push ebx
call fcn.00402d0a
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x419321
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [edi + 8], 4
jne 0x419d77
and dword [edi + 8], 0
jmp 0x419d77
mov dword [edi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
cmp dword [edi + 8], 0
je 0x419e6c
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 0xffffff80
neg esi
sbb esi, esi
and esi, eax
call fcn.00411706
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x419e6c
cmp esi, 0xfde8
je 0x419e6c
cmp esi, 0xfde9
je 0x419e6c
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x419e6c
push 1
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x419e6c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x419df8
mov cx, word [edi + 0x18]
mov word [eax], cx
mov cx, word [edi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], si
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x419e67
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x419e2f
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.0040d663
add esp, 0xc
test eax, eax
je 0x419e40
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040e571
push 0x40
push ebx
push 0x1001
push dword [edi + 0x18]
call esi
test eax, eax
je 0x419e6c
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [edi + 0x1c]
call esi
test eax, eax
je 0x419e6c
push 0xa
push 0x10
sub ebx, 0xffffff80
push ebx
push dword [ebp + 8]
call fcn.0040d7a7
add esp, 0x10
xor eax, eax
inc eax
jmp 0x419e6e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x419dd8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040fcfb
lea edi, [eax + 0x9c]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x419ca8
or dword [edi + 8], 0x104
jmp 0x419d6b
mov dword [edi], eax
add eax, 0x40
lea ebx, [edi + 4]
mov dword [ebx], eax
je 0x419cc9
cmp byte [eax], 0
je 0x419cc9
push ebx
push 0x16
push 0x41db50
call fcn.004116a4
add esp, 0xc
mov eax, dword [edi]
and dword [edi + 8], 0
test eax, eax
je 0x419d2e
cmp byte [eax], 0
je 0x419d2e
mov eax, dword [ebx]
test eax, eax
je 0x419cec
cmp byte [eax], 0
je 0x419cec
mov esi, edi
call fcn.004010c3
jmp 0x419cf3
mov esi, edi
call fcn.0040f10c
cmp dword [edi + 8], 0
jne 0x419d81
push edi
push 0x40
push 0x41d948
call fcn.004116a4
add esp, 0xc
test eax, eax
je 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d25
cmp byte [ebx], 0
je 0x419d25
mov esi, edi
call fcn.004010c3
jmp 0x419d77
mov esi, edi
call fcn.0040f10c
jmp 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d64
cmp byte [ebx], 0
je 0x419d64
push ebx
call fcn.00402d0a
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x419321
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [edi + 8], 4
jne 0x419d77
and dword [edi + 8], 0
jmp 0x419d77
mov dword [edi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
cmp dword [edi + 8], 0
je 0x419e6c
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 0xffffff80
neg esi
sbb esi, esi
and esi, eax
call fcn.00411706
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x419e6c
cmp esi, 0xfde8
je 0x419e6c
cmp esi, 0xfde9
je 0x419e6c
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x419e6c
push 1
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x419e6c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x419df8
mov cx, word [edi + 0x18]
mov word [eax], cx
mov cx, word [edi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], si
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x419e67
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x419e2f
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.0040d663
add esp, 0xc
test eax, eax
je 0x419e40
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040e571
push 0x40
push ebx
push 0x1001
push dword [edi + 0x18]
call esi
test eax, eax
je 0x419e6c
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [edi + 0x1c]
call esi
test eax, eax
je 0x419e6c
push 0xa
push 0x10
sub ebx, 0xffffff80
push ebx
push dword [ebp + 8]
call fcn.0040d7a7
add esp, 0x10
xor eax, eax
inc eax
jmp 0x419e6e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x419e10
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040fcfb
lea edi, [eax + 0x9c]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x419ca8
or dword [edi + 8], 0x104
jmp 0x419d6b
mov dword [edi], eax
add eax, 0x40
lea ebx, [edi + 4]
mov dword [ebx], eax
je 0x419cc9
cmp byte [eax], 0
je 0x419cc9
push ebx
push 0x16
push 0x41db50
call fcn.004116a4
add esp, 0xc
mov eax, dword [edi]
and dword [edi + 8], 0
test eax, eax
je 0x419d2e
cmp byte [eax], 0
je 0x419d2e
mov eax, dword [ebx]
test eax, eax
je 0x419cec
cmp byte [eax], 0
je 0x419cec
mov esi, edi
call fcn.004010c3
jmp 0x419cf3
mov esi, edi
call fcn.0040f10c
cmp dword [edi + 8], 0
jne 0x419d81
push edi
push 0x40
push 0x41d948
call fcn.004116a4
add esp, 0xc
test eax, eax
je 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d25
cmp byte [ebx], 0
je 0x419d25
mov esi, edi
call fcn.004010c3
jmp 0x419d77
mov esi, edi
call fcn.0040f10c
jmp 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d64
cmp byte [ebx], 0
je 0x419d64
push ebx
call fcn.00402d0a
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x419321
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [edi + 8], 4
jne 0x419d77
and dword [edi + 8], 0
jmp 0x419d77
mov dword [edi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
cmp dword [edi + 8], 0
je 0x419e6c
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 0xffffff80
neg esi
sbb esi, esi
and esi, eax
call fcn.00411706
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x419e6c
cmp esi, 0xfde8
je 0x419e6c
cmp esi, 0xfde9
je 0x419e6c
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x419e6c
push 1
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x419e6c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x419df8
mov cx, word [edi + 0x18]
mov word [eax], cx
mov cx, word [edi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], si
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x419e67
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x419e2f
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.0040d663
add esp, 0xc
test eax, eax
je 0x419e40
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040e571
push 0x40
push ebx
push 0x1001
push dword [edi + 0x18]
call esi
test eax, eax
je 0x419e6c
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [edi + 0x1c]
call esi
test eax, eax
je 0x419e6c
push 0xa
push 0x10
sub ebx, 0xffffff80
push ebx
push dword [ebp + 8]
call fcn.0040d7a7
add esp, 0x10
xor eax, eax
inc eax
jmp 0x419e6e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x419e40
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040fcfb
lea edi, [eax + 0x9c]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x419ca8
or dword [edi + 8], 0x104
jmp 0x419d6b
mov dword [edi], eax
add eax, 0x40
lea ebx, [edi + 4]
mov dword [ebx], eax
je 0x419cc9
cmp byte [eax], 0
je 0x419cc9
push ebx
push 0x16
push 0x41db50
call fcn.004116a4
add esp, 0xc
mov eax, dword [edi]
and dword [edi + 8], 0
test eax, eax
je 0x419d2e
cmp byte [eax], 0
je 0x419d2e
mov eax, dword [ebx]
test eax, eax
je 0x419cec
cmp byte [eax], 0
je 0x419cec
mov esi, edi
call fcn.004010c3
jmp 0x419cf3
mov esi, edi
call fcn.0040f10c
cmp dword [edi + 8], 0
jne 0x419d81
push edi
push 0x40
push 0x41d948
call fcn.004116a4
add esp, 0xc
test eax, eax
je 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d25
cmp byte [ebx], 0
je 0x419d25
mov esi, edi
call fcn.004010c3
jmp 0x419d77
mov esi, edi
call fcn.0040f10c
jmp 0x419d77
mov ebx, dword [ebx]
test ebx, ebx
je 0x419d64
cmp byte [ebx], 0
je 0x419d64
push ebx
call fcn.00402d0a
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x419321
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [edi + 8], 4
jne 0x419d77
and dword [edi + 8], 0
jmp 0x419d77
mov dword [edi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
cmp dword [edi + 8], 0
je 0x419e6c
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 0xffffff80
neg esi
sbb esi, esi
and esi, eax
call fcn.00411706
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x419e6c
cmp esi, 0xfde8
je 0x419e6c
cmp esi, 0xfde9
je 0x419e6c
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x419e6c
push 1
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x419e6c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x419df8
mov cx, word [edi + 0x18]
mov word [eax], cx
mov cx, word [edi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], si
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x419e67
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x419e2f
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.0040d663
add esp, 0xc
test eax, eax
je 0x419e40
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040e571
push 0x40
push ebx
push 0x1001
push dword [edi + 0x18]
call esi
test eax, eax
je 0x419e6c
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [edi + 0x1c]
call esi
test eax, eax
je 0x419e6c
push 0xa
push 0x10
sub ebx, 0xffffff80
push ebx
push dword [ebp + 8]
call fcn.0040d7a7
add esp, 0x10
xor eax, eax
inc eax
jmp 0x419e6e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x438ca8
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
add ecx, eax
call fcn.00438cd1
inc ecx
xor dword [edx], esi
and eax, ecx
inc edx
add ecx, ecx
sub eax, eax
cmp edx, edi
jne fcn.00438ca8
add ecx, eax
add ecx, 0x17a4db39
ret
Function at 0x4e376b
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x404476
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x403b18
and dword [ebp - 0x20], 0
call fcn.0043f12c
mov esi, eax
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [0x5222ec], esi
call fcn.0043f12c
mov esi, eax
call sub.MSVBVM60.DLL___vbaSetSystemError
mov eax, dword [ebp + 0xc]
movsx eax, word [eax]
add eax, dword [0x5222ec]
jo 0x4e37fc
cmp esi, eax
jge 0x4e37ce
call sub.MSVBVM60.DLL_rtcDoEvents
jmp 0x4e37a9
push 0x4e37df
jmp 0x4e37de
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow

Function at 0x4e3801
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x404476
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x403b28
and dword [ebp - 0x20], 0
call fcn.0043f12c
mov esi, eax
call sub.MSVBVM60.DLL___vbaSetSystemError
mov dword [0x5222ec], esi
call fcn.0043f12c
mov esi, eax
call sub.MSVBVM60.DLL___vbaSetSystemError
mov eax, dword [ebp + 0xc]
movsx eax, word [eax]
add eax, dword [0x5222ec]
jo 0x4e38f1
cmp esi, eax
jge 0x4e38c3
call sub.MSVBVM60.DLL_rtcDoEvents
push 4
call fcn.0043ece8
mov edi, eax
call sub.MSVBVM60.DLL___vbaSetSystemError
push 0xdc
call fcn.0043f078
mov esi, eax
call sub.MSVBVM60.DLL___vbaSetSystemError
test si, si
jl 0x4e38ad
cmp word [0x5221c2], 0
je 0x4e38ad
cmp word [0x5221e2], 0xffff
je 0x4e38ad
cmp word [0x522244], 0xffff
je 0x4e38ad
push 1
pop eax
jmp 0x4e38af
xor eax, eax
xor ecx, ecx
test di, di
sete cl
test eax, ecx
jne 0x4e383f
or word [0x5221e2], 0xffff
push 0x4e38d4
jmp 0x4e38d3
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow
Function at 0x4e38f6
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x404476
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0xa0
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x403b38
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call sub.MSVBVM60.DLL___vbaOnError
mov dword [ebp - 4], 3
push 0x443ed4
mov eax, dword [ebp + 8]
push dword [eax]
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x2c]
call sub.MSVBVM60.DLL___vbaStrMove
push eax
push 0x443f30
call sub.MSVBVM60.DLL___vbaStrCat
mov edx, eax
lea ecx, [ebp - 0x28]
call sub.MSVBVM60.DLL___vbaStrMove
lea ecx, [ebp - 0x2c]
call sub.MSVBVM60.DLL___vbaFreeStr
mov dword [ebp - 4], 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], 0x4008
mov dword [ebp - 0x44], 0x80020004
mov dword [ebp - 0x4c], 0xa
mov dword [ebp - 0x84], 0x441d7c
mov dword [ebp - 0x8c], 8
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x3c]
call sub.MSVBVM60.DLL___vbaVarDup
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x5c]
push eax
call sub.MSVBVM60.DLL_rtcGetObject
push 0
push 0x443f34
push 0x10
pop eax
call sub.MSVBVM60.DLL___vbaChkstk
lea esi, [ebp - 0xac]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push 0x441e54
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x6c]
push eax
call sub.MSVBVM60.DLL___vbaVarLateMemCallLdRf
add esp, 0x20
push eax
lea eax, [ebp - 0x7c]
push eax
call sub.MSVBVM60.DLL___vbaVarLateMemCallLd
add esp, 0x10
push eax
call sub.MSVBVM60.DLL___vbaBoolVar
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
push 5
call sub.MSVBVM60.DLL___vbaFreeVarList
add esp, 0x18
push 0x4e3a7f
jmp 0x4e3a76
lea ecx, [ebp - 0x28]
call sub.MSVBVM60.DLL___vbaFreeStr
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x246a2ec0
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xeb373cc
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219