joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442618
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0x20]
mov eax, ebx
call fcn.004425a4
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
call sub.KERNEL32.DLL_SetErrorMode
xor edx, edx
push ebp
push 0x442700
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
jmp 0x442668
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44268f
mov eax, dword [ebp - 8]
cmp si, word [eax + 0xc]
jne 0x442660
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x20]
mov edx, ebx
mov eax, dword [ebp - 8]
add eax, 0x10
call fcn.004101d4
test al, al
je 0x442660
cmp dword [ebp - 8], 0
jne 0x4426da
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x20]
add eax, 0x10
call fcn.00404218
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
mov edx, dword [ebx]
mov dword [eax + 8], edx
mov word [eax + 0xc], si
mov edx, dword [ebp - 4]
movzx ecx, word [edx + 0x20]
lea edx, [eax + 0x10]
mov eax, ebx
call fcn.004043dc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 8]
inc dword [eax + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442707
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret

Function at 0x442710
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x4427da
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
call sub.KERNEL32.DLL_SetErrorMode
xor ecx, ecx
push ebp
push 0x4427ab
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 0x10]
dec dword [eax + 4]
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x44278b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 8]
jne 0x44277d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x44278b
mov eax, edx
mov edx, dword [eax]
cmp edx, dword [ebp - 8]
jne 0x44277b
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4427b2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
mov esp, ebp
pop ebp
ret
Function at 0x4427e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
call sub.KERNEL32.DLL_SetErrorMode
xor eax, eax
push ebp
push 0x442859
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00442618
mov edi, eax
mov dword [ebx + 0x10], edi
cmp esi, edi
je 0x44282f
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00442710
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442860
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret

Function at 0x44286c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 8
push eax
call sub.KERNEL32.DLL_SetErrorMode
xor eax, eax
push ebp
push 0x4428da
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 0x10]
cmp edi, ebx
je 0x4428ba
inc dword [edi + 4]
mov dword [esi + 0x10], edi
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00442710
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4428e1
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret

Function at 0x442900
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 8
push eax
call sub.KERNEL32.DLL_SetErrorMode
xor eax, eax
push ebp
push 0x442976
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x442956
mov esi, ebx
mov edi, dword [esi + 8]
test edi, edi
je 0x442950
cmp dword [esi + 0x14], 0
jge 0x442950
push edi
call sub.gdi32.dll_DeleteObject
xor eax, eax
mov dword [esi + 8], eax
mov ebx, dword [ebx]
test ebx, ebx
jne 0x442936
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44297d
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
Function at 0x442984
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [0x497150]
call fcn.0042f300
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x442a2b
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4429cc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0042ea1c
mov ebx, eax
mov eax, ebx
call fcn.00444378
inc dword [ebp - 4]
mov eax, ebx
call fcn.00445344
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 4]
jg 0x4429ae
mov eax, dword [0x497148]
call fcn.00442900
mov eax, dword [0x49714c]
call fcn.00442900
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442a32
mov ebx, dword [ebp - 4]
dec ebx
test ebx, ebx
jl 0x442a16
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.0042ea1c
call fcn.0044443c
inc esi
dec ebx
jne 0x442a03
mov eax, dword [0x497150]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
Function at 0x443848
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x74], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x443a4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jne 0x443a21
mov eax, dword [0x497144]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
call sub.KERNEL32.DLL_SetErrorMode
xor edx, edx
push ebp
push 0x443a1a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jne 0x4439f8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x70], eax
xor eax, eax
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xc]
test byte [eax + 0x1d], 1
je 0x4438d9
mov dword [ebp - 0x60], 0x2bc
jmp 0x4438e0
mov dword [ebp - 0x60], 0x190
mov eax, dword [ebp - 0xc]
test byte [eax + 0x1d], 2
setne al
mov byte [ebp - 0x5c], al
mov eax, dword [ebp - 0xc]
test byte [eax + 0x1d], 4
setne al
mov byte [ebp - 0x5b], al
mov eax, dword [ebp - 0xc]
test byte [eax + 0x1d], 8
setne al
mov byte [ebp - 0x5a], al
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 0x1e]
cmp al, 1
jne 0x443927
cmp byte [0x490062], 1
je 0x443927
movzx eax, byte [0x490062]
mov byte [ebp - 0x59], al
jmp 0x44392a
mov byte [ebp - 0x59], al
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0xc]
add edx, 0x1f
call fcn.004075c4
mov eax, dword [ebp - 0x74]
mov edx, 0x443a68
call fcn.00410268
test eax, eax
jne 0x44396a
mov esi, str._rMS_Sans_Serif
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040a1c8
lea eax, [ebp - 0x54]
mov ecx, 0x1f
mov edx, dword [ebp - 4]
call fcn.004116d0
jmp 0x44398a
mov eax, dword [ebp - 0xc]
lea esi, [eax + 0x1f]
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040a1c8
lea eax, [ebp - 0x54]
mov ecx, 0x1f
mov edx, dword [ebp - 8]
call fcn.004116d0
mov eax, dword [0x4914f4]
cmp dword [eax], 1
jne 0x4439b0
call fcn.0044a4a8
cmp al, 0x80
jne 0x4439b0
mov eax, dword [ebp - 0xc]
add eax, 0x10
call fcn.0044381c
test al, al
je 0x4439b0
mov byte [ebp - 0x59], 0x80
mov byte [ebp - 0x56], 0
cmp dword [ebp - 0x64], 0
je 0x4439c0
mov byte [ebp - 0x58], 7
jmp 0x4439c4
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x57], 0
mov eax, ebx
call fcn.00443c14
dec al
je 0x4439d9
dec al
je 0x4439df
jmp 0x4439e5
mov byte [ebp - 0x55], 2
jmp 0x4439e9
mov byte [ebp - 0x55], 1
jmp 0x4439e9
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x70]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443a21
mov eax, dword [0x497144]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443a51
lea eax, [ebp - 0x74]
call fcn.00407250
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407258
ret
Function at 0x443eac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x443f51
mov eax, dword [0x497148]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 8
push eax
call sub.KERNEL32.DLL_SetErrorMode
xor eax, eax
push ebp
push 0x443f4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x443f28
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1c]
movzx eax, word [eax*2 + 0x490324]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
call fcn.00443184
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
call sub.gdi32.dll_CreatePenIndirect
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443f51
mov eax, dword [0x497148]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret

Function at 0x4441fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x4442e5
mov eax, dword [0x49714c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 8
push eax
call sub.KERNEL32.DLL_SetErrorMode
xor edx, edx
push ebp
push 0x4442de
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x4442bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x444268
mov dword [ebp - 0x18], 3
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x78]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov edx, dword [eax]
call dword [edx + 0x70]
mov dword [ebp - 0x10], eax
jmp 0x44429f
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1c]
mov edx, eax
sub dl, 1
jb 0x44427f
je 0x444286
jmp 0x44428f
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x44429f
mov dword [ebp - 0x18], 1
jmp 0x44429f
mov dword [ebp - 0x18], 2
and eax, 0x7f
sub eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
call fcn.00443184
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
call sub.gdi32.dll_CreateBrushIndirect
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4442e5
mov eax, dword [0x49714c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x446d48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [0x4903bc]
call fcn.0042f300
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x446df0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x446dce
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0042ea1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.004443e0
test al, al
je 0x446dc5
xor eax, eax
push ebp
push 0x446dbe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00446ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446dc5
mov eax, dword [ebp - 0xc]
call fcn.0044443c
ret
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffff
jne 0x446d78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446df7
mov eax, dword [0x4903bc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret

Function at 0x446dfc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x446e7f
mov eax, dword [0x4903bc]
call fcn.0042f300
mov esi, eax
xor ecx, ecx
push ebp
push 0x446e78
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x446e56
mov edx, ebx
mov eax, esi
call fcn.0042ea1c
mov edx, dword [eax + 0x58]
test edx, edx
je 0x446e50
mov edx, dword [edx + 0x28]
mov edx, dword [edx + 8]
cmp edx, dword [ebp - 4]
jne 0x446e50
call fcn.00446ef0
dec ebx
cmp ebx, 0xffffffff
jne 0x446e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446e7f
mov eax, dword [0x4903bc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x448bd8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x442124]
call fcn.004052c8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x448c60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], esi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov esi, eax
lea edi, [edx + 0x18]
mov ecx, 0x15
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
movzx edx, byte [ebp + 0xc]
mov byte [eax + 0x71], dl
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x448c42
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [0x42735c]
call fcn.00405530
mov edx, dword [ebp - 8]
mov dword [edx + 0x6c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x448c77
push 0x497114
call sub.KERNEL32.DLL_SetErrorMode
xor edx, edx
push ebp
push 0x448cbe
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.004470a8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 0x28], eax
inc dword [eax + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448cc5
push 0x497114
call sub.KERNEL32.DLL_GetLocaleInfoW
ret

Function at 0x44a7d0
Capabilities:
Get geographical location

Disassembly:
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
Function at 0x45e5a8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [0x497238]
call fcn.0042f300
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45e662
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x45e640
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0042ea1c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.004443e0
test al, al
je 0x45e638
xor eax, eax
push ebp
push 0x45e631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.0045e804
call fcn.00405ea4
call fcn.00405ea4
jmp 0x45e669
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x45e5df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e669
mov eax, dword [0x497238]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
mov esp, ebp
pop ebp
ret

Function at 0x45e670
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [0x497238]
call fcn.0042f300
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45e718
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x45e6f6
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0042ea1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.004443e0
test al, al
je 0x45e6ed
xor eax, eax
push ebp
push 0x45e6e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0045e804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e6ed
mov eax, dword [ebp - 0xc]
call fcn.0044443c
ret
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffff
jne 0x45e6a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e71f
mov eax, dword [0x497238]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret
Function at 0x464b40
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x100], edx
mov edi, eax
xor eax, eax
push ebp
push 0x464d3a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xcc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xac]
cmp dword [ebp - 0xb0], 0
jne 0x464bf3
test byte [ebp - 0xc5], 0x40
je 0x464bf3
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x464bb3
test byte [ebx + 0x1c], 2
je 0x464bb3
mov eax, ebx
mov edx, dword [0x45b2d0]
call fcn.0040550c
test al, al
je 0x464bb3
mov eax, ebx
call fcn.00468c58
mov dword [ebp - 0xb0], eax
jmp 0x464bf3
mov eax, dword [edi + 8]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 0xf8], 0x11
lea eax, [ebp - 0xfc]
push eax
push 0
lea edx, [ebp - 0x100]
mov eax, dword [0x4913ac]
call fcn.0040a270
mov ecx, dword [ebp - 0x100]
mov dl, 1
mov eax, dword [0x423714]
call fcn.0041513c
call fcn.00405db0
mov eax, dword [ebp - 0xa4]
mov dword [edi + 0x254], eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x98]
push eax
call fcn.0040b7f8
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x464c2d
mov edx, 0x45c658
cmp edx, dword [ebp - 0xf0]
je 0x464c6a
test al, al
je 0x464c41
mov eax, dword [ebp - 0x98]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.user32.dll_IsIconic
mov dword [ebp - 0xa4], 0x45c658
lea eax, [ebp - 0x80]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xa8]
push eax
call sub.user32.dll_GetKeyboardLayout
test ax, ax
jne 0x464c6a
call fcn.00417040
mov dword [0x490ab0], edi
lea edx, [ebp - 0xcc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xb0]
cmp dword [edi + 0x258], 0
jne 0x464c8e
call fcn.00417040
push 0xfffffffffffffff0
mov eax, dword [edi + 0x258]
push eax
call sub.user32.dll_DispatchMessageW
test eax, 0x40000000
je 0x464cc4
push 0xfffffffffffffff4
mov eax, dword [edi + 0x258]
push eax
call sub.user32.dll_DispatchMessageW
test eax, eax
jne 0x464cc4
mov eax, dword [edi + 0x258]
push eax
push 0xfffffffffffffff4
push eax
call sub.user32.dll_GetWindowLongW
mov eax, dword [edi + 0x174]
call fcn.0041194c
xor eax, eax
mov dword [edi + 0x174], eax
mov eax, edi
call fcn.00469010
push 1
mov eax, dword [edi + 0x64]
call fcn.00443848
mov ecx, eax
mov edx, 0x30
mov eax, edi
call fcn.004614ac
cmp byte [edi + 0x5e], 0
je 0x464d07
mov eax, edi
mov si, 0xffef
call fcn.0040557c
mov eax, dword [edi + 0xac]
mov eax, dword [eax + 8]
test eax, eax
je 0x464d21
test byte [edi + 0x52], 0x20
je 0x464d21
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464d41
lea eax, [ebp - 0x100]
call fcn.00407250
ret
Function at 0x46eb94
Capabilities:
Clear file content
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x491504]
cmp byte [eax + 0xc], 0
je 0x46ed01
push 0x8000
call sub.KERNEL32.DLL_MultiByteToWideChar
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46ecfa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x497240], 0
jne 0x46ebe8
push 0x46ed08
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
push 0x46ed18
push ebx
call fcn.0040b274
mov dword [0x497240], eax
cmp dword [0x490c58], 0
jne 0x46ece3
push 0x46ed38
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
mov dword [0x490c58], eax
cmp dword [0x490c58], 0
je 0x46ece3
push 0x46ed4c
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x497244], eax
push 0x46ed68
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x497248], eax
push 0x46ed8c
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x49724c], eax
push 0x46edbc
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x497250], eax
push 0x46edec
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x497254], eax
push 0x46ee10
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x497258], eax
push 0x46ee40
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x49725c], eax
push 0x46ee70
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x497260], eax
push 0x46eea4
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x497264], eax
push 0x46eeb8
mov eax, dword [0x490c58]
push eax
call fcn.0040b274
mov dword [0x497268], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ed01
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
ret
pop ebx
pop ecx
pop ebp
ret