joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59195c93
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea edx, [ebp - 4]
push edx
push 0x59195e1c
xor edi, edi
inc edi
push edi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax]
push 0xffffffffffffffff
push ebx
push eax
call dword [ecx + 0x28]
test eax, eax
jge 0x59195cc5
xor eax, eax
jmp 0x59195e16
mov eax, dword [esi + 0x1c]
mov ecx, eax
shr ecx, 0x12
test cl, 1
mov dword [ebp - 8], ebx
jne 0x59195cdd
mov dword [ebp - 8], edi
jmp 0x59195e0a
cmp eax, 0x70002
jne 0x59195d22
xor edi, edi
cmp dword [esi + 8], ebx
jle 0x59195d65
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push dword [esi + 4]
push ebx
push eax
call dword [ecx + 0x24]
mov ecx, dword [esi + 4]
jmp 0x59195d16
mov edx, dword [eax]
or edx, 0xff000000
dec ecx
mov dword [eax], edx
add eax, 4
cmp ecx, ebx
jg 0x59195d08
inc edi
cmp edi, dword [esi + 8]
jge 0x59195d65
jmp 0x59195ceb
cmp eax, 0x60001
jne 0x59195d71
xor edi, edi
cmp dword [esi + 8], ebx
jle 0x59195d65
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push dword [esi + 4]
push ebx
push eax
call dword [ecx + 0x28]
mov ecx, dword [esi + 4]
jmp 0x59195d5b
mov edx, dword [eax]
or edx, 0xff000000
dec ecx
mov dword [eax], edx
add eax, 4
cmp ecx, ebx
jg 0x59195d4d
inc edi
cmp edi, dword [esi + 8]
jl 0x59195d30
mov dword [ebp - 8], 1
jmp 0x59195e0a
cmp eax, 0x470003
jne 0x59195e0a
mov edi, dword [esi + 4]
push dword [0x591d52c4]
shl edi, 2
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push 1
push edi
mov ecx, eax
call dword [edx + 4]
mov edi, eax
cmp edi, ebx
je 0x59195e0a
cmp dword [esi + 8], ebx
mov dword [ebp - 8], ebx
jle 0x59195def
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push dword [esi + 4]
push edi
push eax
call dword [ecx + 0x24]
mov ecx, dword [esi + 4]
jmp 0x59195dd3
mov edx, dword [eax]
or edx, 0xff000000
dec ecx
mov dword [eax], edx
add eax, 4
cmp ecx, ebx
jg 0x59195dc5
push dword [esi + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x30]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 8]
jl 0x59195da6
push dword [0x591d52c4]
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x59197a94
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x591d4f7c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x59197aac
mov eax, dword [eax + 0x1194]
jmp 0x59197aae
xor eax, eax
test eax, eax
je 0x59197abd
mov eax, dword [eax + 0x44]
mov ecx, dword [eax + 0xc]
call fcn.59168d0d
xor eax, eax
inc eax
ret
Function at 0x5919bfbb
Capabilities:
Check if file exists
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x591ec1f0]
push esi
push edi
xor edi, edi
test eax, eax
mov dword [ebp - 4], eax
mov esi, 0x591ec1ec
jbe 0x5919c05b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
mov ecx, esi
call fcn.5919bd9c
cmp dword [eax], 0
je 0x5919c054
push edi
mov ecx, esi
call fcn.5919bd9c
xor ecx, ecx
push ecx
push 0x80
push 3
push ecx
push ecx
push 0xc0000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x5919c01d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5919c023
cmp byte [ebp + 8], 0
je 0x5919c054
push edi
mov ecx, esi
call fcn.5919bd9c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x5919c06e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x5919c06e
cmp byte [ebp + 8], 0
je 0x5919c054
push edi
mov ecx, esi
call fcn.5919bd9c
push dword [eax]
call ebx
inc edi
cmp edi, dword [ebp - 4]
jb 0x5919bfe1
pop ebx
cmp byte [ebp + 8], 0
je 0x5919c068
mov ecx, esi
call fcn.5916869a
pop edi
pop esi
leave
ret 4
push edi
mov ecx, esi
call fcn.5919bd9c
push dword [eax]
call ebx
push edi
mov ecx, esi
call fcn.5913338f
dec dword [ebp - 4]
jmp 0x5919c055

Function at 0x5919c3a0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
mov esi, ecx
call fcn.5919bfbb
add esi, 0x6a
cmp word [esi], di
je 0x5919c411
push edi
push 0x80
push 3
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x5919c3f2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x5919c40e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x5919c40e
push esi
call dword [sym.imp.SHLWAPI.dll_StrDupW]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x5919c40e
lea eax, [ebp - 4]
push eax
mov ecx, 0x591ec1ec
call fcn.59141443
mov word [esi], di
pop edi
pop esi
leave
ret
Function at 0x5919e693
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [ebp + 0xc], 2
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x80004005
jne 0x5919e709
cmp dword [ebp + 0x10], esi
je 0x5919e6cc
push 0x2000
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_LoadImageW]
jmp 0x5919e6e0
push esi
push 0xf
push 0x2000
push esi
push esi
push esi
push dword [ebp + 8]
call dword [0x5919e79c]
cmp eax, esi
jne 0x5919e6ee
mov eax, 0x8007000e
jmp 0x5919e78e
push esi
push eax
mov ecx, edi
call fcn.5915310e
cmp dword [edi + 0x18], 0x20
jne 0x5919e701
mov byte [edi + 0x1d], 1
mov dword [ebp - 4], esi
jmp 0x5919e78b
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
je 0x5919e759
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
je 0x5919e78a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp + 8], eax
je 0x5919e78a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, esi
jbe 0x5919e78a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 8]
push edi
push eax
call fcn.5919e64b
mov dword [ebp - 4], eax
jmp 0x5919e78a
push esi
push esi
push 0xf
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call dword [0x5919e798]
cmp dword [ebp - 0x14], esi
je 0x5919e781
push dword [ebp - 0x10]
mov ecx, edi
push dword [ebp - 0x14]
call fcn.5919e64b
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1c]
call dword [0x5919e794]
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0xc
Function at 0x591bff6f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
cmp edi, 0xffffffff
mov esi, ecx
je 0x591bffd1
call ebx
mov dword [ebp + 0xc], eax
jmp 0x591bffd1
mov ecx, dword [esi + 4]
call fcn.5911ca50
cmp eax, edi
jbe 0x591bffa0
mov eax, edi
push 1
push 0
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.5911cd93
cmp eax, 0xffffffff
je 0x591bffd8
test eax, eax
jle 0x591bffbd
cmp eax, 2
jle 0x591bffd8
cmp edi, 0xffffffff
je 0x591bffd1
call ebx
sub eax, dword [ebp + 0xc]
cmp eax, edi
jae 0x591bffcf
sub edi, eax
jmp 0x591bffd1
xor edi, edi
mov eax, dword [esi + 0x64]
test eax, eax
je 0x591bff92
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x591bffdf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
dec eax
mov dword [ebp - 0xc], edi
je 0x591c0010
dec eax
je 0x591c0004
mov eax, 0x80070057
jmp 0x591c014d
mov eax, dword [ebp + 8]
add eax, 0x80
xor esi, esi
jmp 0x591c0019
mov eax, dword [ebp + 8]
xor esi, esi
add eax, 0x78
inc esi
mov dword [ebp + 0x14], eax
call fcn.59130ebf
test eax, eax
jne 0x591c002f
mov eax, 0x80040014
jmp 0x591c014d
push dword [0x591d4f7c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test esi, esi
mov dword [ebp - 4], eax
je 0x591c010b
cmp edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
jne 0x591c00a6
test eax, eax
jle 0x591c009f
mov esi, dword [ebp + 0xc]
add esi, 8
mov dword [ebp + 0xc], eax
test byte [esi - 4], 1
mov edi, dword [esi + 4]
mov ebx, dword [esi - 8]
lea eax, [edi + 0x14]
mov dword [ebp + 8], eax
je 0x591c0089
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
shr eax, 2
test al, 1
je 0x591c0089
mov ecx, dword [ebp + 8]
push 0
push ebx
push edi
call fcn.59124114
jmp 0x591c0095
mov ecx, dword [ebp + 8]
push 0
push ebx
push edi
call fcn.591203d3
mov dword [esi], eax
add esi, 0x10
dec dword [ebp + 0xc]
jne 0x591c005b
xor ebx, ebx
jmp 0x591c014b
dec eax
xor esi, esi
test eax, eax
mov dword [ebp - 8], eax
jle 0x591c00e8
mov edi, dword [ebp + 0xc]
add edi, 4
mov eax, dword [edi - 4]
mov ebx, dword [edi + 8]
mov dword [ebp + 0x10], eax
mov eax, dword [edi]
push eax
push eax
push ebx
call fcn.5912046a
mov ecx, dword [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.59130f49
mov ebx, eax
test ebx, ebx
jl 0x591c014b
inc esi
add edi, 0x10
cmp esi, dword [ebp - 8]
jl 0x591c00b6
shl esi, 4
add esi, dword [ebp + 0xc]
push dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp - 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.59163cf4
mov dword [esi + 8], eax
jmp 0x591c014b
and dword [ebp + 8], ebx
cmp dword [ebp + 0x10], ebx
jle 0x591c014b
mov esi, dword [ebp + 0xc]
add esi, 4
mov eax, dword [esi]
mov edi, dword [esi + 8]
mov ebx, dword [esi - 4]
push eax
push eax
push edi
call fcn.5912046a
mov ecx, dword [ebp + 0x14]
push eax
push edi
push ebx
push dword [ebp - 4]
call fcn.59130f49
mov ebx, eax
test ebx, ebx
jl 0x591c014b
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
add esi, 0x10
cmp eax, dword [ebp + 0x10]
jl 0x591c0119
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x591c1c6c
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
je 0x591c1cfb
mov ebx, dword [ebp + 0xc]
cmp ebx, 2
jb 0x591c1cfb
push 0xf0000000
push 1
push esi
push esi
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x591c1ca7
mov eax, 0x80004005
jmp 0x591c1d00
dec ebx
je 0x591c1cde
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0x591c1d08
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
mov eax, dword [ebp - 4]
xor edx, edx
div ecx
mov ax, word [edx*2 + 0x591c1d08]
mov word [edi + esi*2], ax
inc esi
cmp esi, ebx
jb 0x591c1caa
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 8], eax
mov word [edi + ecx*2 - 2], ax
je 0x591c1cf7
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x591c1d00
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44c78e
Capabilities:
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
jp 0x44c79d
nop
push ecx
sub ch, 0x31
pop ecx
push esi
push ecx
shl esi, cl
push eax
push edx
and al, dh
xchg cx, ax
stc
push ebx
adc bh, 0x1b
xchg bx, bx
push edi
xor dx, di
sub ch, 0x1b
and si, 0x2382
ror edi, cl
ror edi, 1
or bl, 0x21
sub bl, 0x5c
xor cx, 0x1db3
stc
and cx, di
xor esi, ebx
shr cl, 6
stc
test al, 0x3f
add cl, 0x30
sub ecx, ebx
rol ecx, 7
ror esi, cl
rol esi, cl
nop
inc dl
ror si, cl
cmp ch, bh
inc si
sub bh, dl
mov eax, 0x6d5287f1
shl dl, 6
add ecx, 0x214c9888
add dl, bl
test eax, edi
or ebx, eax
adc bx, bx
nop
test bx, 0x6d36
not dh
rol ecx, cl
shr dx, 4
cmp ebx, 0x7c4fd6e4
and bx, ax
xchg si, ax
shr edi, cl
nop
xor ah, al
not eax
ror al, cl
and edx, ebx
xchg ch, dh
mov dx, 0x9b5
nop
nop
dec edi
xor ah, 0x42
add edi, 0x58aabcdc
or cx, 0x3ec6
dec edx
add ax, 0x50cc
shl dl, cl
rol eax, 3
xchg si, dx
mov di, dx
xor esi, eax
shl bx, 7
sbb ah, ah
cmp dh, ch
nop
shl ah, cl
pop edi
pop ebx
pop edx
pop eax
pop ecx
pop esi
push ecx
add cx, 0x7fba
test ecx, 0x438dc13f
push ebx
xor bh, 0x7a
nop
push edi
or edi, 0x6072d183
nop
push esi
cmp ebx, esi
nop
ror cl, cl
sbb ecx, 0xbc1f228
push edx
dec dl
inc ch
shl ebx, cl
inc ecx
or si, 0x786b
xor bx, 0x6ed9
shl bx, cl
mov si, di
xor di, dx
rol cl, 6
xchg esi, ecx
push eax
not eax
xor eax, 0x6d063da9
inc dx
xor eax, 0x4b111e16
xor ah, 0x63
sub bx, si
add edx, edx
sub ax, 0x427c
rol cl, cl
not edx
xor al, 0x76
or ax, ax
mov di, 0x1d14
pop eax
pop edx
pop esi
pop edi
pop ebx
pop ecx
push edi
inc di
push eax
push ebx
mov ah, bl
shl edi, 5
cmp eax, ebx
cmp bx, 0x3b61
not di
push edx
adc bh, dl
inc dh
push esi
or esi, ebx
stc
and ax, 0x10e0
xor esi, edx
and al, 0x1f
push ecx
not cx
mov ecx, ecx
xor cl, ch
mov dl, al
xchg edx, eax
and bh, bl
dec esi
dec ax
xchg esi, ebx
xchg bx, dx
test edi, ebx
sbb ah, dl
mov ax, ax
shl edi, 1
mov dx, 0xa53
xchg edi, eax
cmp dl, cl
rol ebx, cl
ror esi, 2
sub eax, esi
sub edi, 0x79203d5d
xchg edi, eax
not ebx
shl cx, cl
shr eax, 7
adc cl, 0xe
cmp ch, 0x57
nop
ror ebx, 5
xor bl, 0x1e
nop
shr edi, 8
adc bh, ah
shl di, 7
cmp di, bx
dec edi
sbb cx, 0x6afc
or bx, 0x1501
sbb ch, ch
test ecx, eax
sbb ch, 0x25
sbb dl, dh
sbb dl, cl
add cl, 0x69
pop ecx
pop esi
pop edx
pop ebx
pop eax
pop edi
js 0x44c9ff
jb 0x44c9f4
push edx
xchg dh, dl
push esi
and dx, si
nop
push eax
sbb al, 0x47
xor dx, 0x523
push ecx
dec ch
rol edx, 3
cmp ah, 0x63
xor si, 0x4b19
stc
push ebx
xor bx, bx
stc
pop ebx
pop ecx
pop eax
pop esi
pop edx
js 0x44c9bb
push edx
push ecx
rol dx, cl
push eax
or ah, 0x66
push ebx
xchg bx, cx
pop ebx
pop eax
pop ecx
pop edx
push edi
push ebx
add di, bx
push esi
xchg si, di
cmp bx, si
adc bh, 0x66
push eax
add bx, ax
push ecx
sbb cx, ax
nop
rol bl, cl
pop ecx
pop eax
pop esi
pop ebx
pop edi
push ecx
add ecx, 0x80526d1
push edi
test di, 0x3f0c
pop edi
pop ecx
push edx
push ecx
sub dx, cx
pop ecx
pop edx
push eax
add eax, eax
pop eax
jl 0x44c9ff
push edx
cmp dx, dx
pop edx
push ecx
not cx
push ebx
sub bh, 0x7a
pop ebx
pop ecx
push ebx
inc bl
add bx, 0x17d4
push edx
or dl, bl
push eax
push esi
and eax, esi
pop esi
pop eax
pop edx
pop ebx
pop ebp
ret
Function at 0x406740
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42384c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x42f040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0
mov dword [ebx], 0x42c184
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x50], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov byte [ebx + 0x90], 0
mov dword [ebp - 4], 0
lea esi, [ebx + 4]
mov eax, dword [ebx]
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
push ecx
push esi
call fcn.00407da0
mov dword [ebp - 4], 2
lea edi, [esi + 0x28]
mov eax, dword [ebx]
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [ebp - 0x18], eax
mov dword [eax], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [edi], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0040ad04
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 3
call fcn.0040a05e
mov dword [esi + 4], eax
add esp, 4
mov eax, ebx
mov dword [eax + 0x38], esi
lea edx, [eax + 0xc]
lea esi, [eax + 8]
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], esi
lea ecx, [eax + 0x18]
mov esi, ebx
mov dword [eax + 0x20], ecx
lea eax, [esi + 0x1c]
mov dword [esi + 0x24], eax
lea ebx, [esi + 0x28]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edi
mov esi, dword [ebp - 0x18]
mov dword [edx], 0
mov dword [eax], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0x10]
mov eax, ecx
mov dword [ebx], 0
mov dword [ecx + 4], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b7b2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40b7f1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40b7f1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b7f1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40b7f1
cmp dword [ecx + 0x74], 0xe
jbe 0x40b7f1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41767c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427de8
push 0x427de0
push str.FlsAlloc
push 0x1f
call fcn.00417544
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4176b0
push dword [ebp + 8]
mov ecx, esi
call dword [0x424178]
call esi
jmp 0x4176b6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4176fa
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427df8
push 0x427df0
push str.FlsGetValue
push 0x21
call fcn.00417544
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417731
push dword [ebp + 8]
mov ecx, esi
call dword [0x424178]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x417739
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427e00
push 0x427df8
push str.FlsSetValue
push 0x22
call fcn.00417544
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417773
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x424178]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41aa45
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41aae2
push ebx
push esi
call fcn.0041aa0e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004196e7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41aa8f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41aae1
push edi
push eax
call fcn.00415a0c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41aaaf
call fcn.004159d2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41aae0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004196e7
add esp, 0x20
test eax, eax
jne 0x41aace
push edi
call fcn.004159d2
jmp 0x41aad6
push ebx
call fcn.004159d2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41cd85
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00416dc2
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41cdf4
cmp esi, dword [ebp - 4]
je 0x41cdef
cmp dword [ebp + 0xc], 0
je 0x41cdef
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41cdcc
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0041c8d7
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x41cdf6
xor eax, eax
inc eax
jmp 0x41cdf6
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x41ce5d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x42f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00416dc2
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00416dc2
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x41ced4
cmp word [ecx], dx
je 0x41ced4
mov eax, dword [0x428444]
push edi
dec eax
push eax
push 0x428330
call fcn.0041cdfa
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x41cf47
cmp word [eax], dx
je 0x41cf47
mov eax, dword [edi]
test eax, eax
je 0x41cef8
cmp word [eax], dx
je 0x41cef8
lea eax, [ebp - 0x10]
push eax
call fcn.0041c7dd
jmp 0x41cf01
lea eax, [ebp - 0x10]
push eax
call fcn.0041c878
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x41cf71
mov eax, dword [0x42832c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x428020
call fcn.0041cdfa
add esp, 0xc
test al, al
je 0x41cf71
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x41cf3c
cmp word [eax], di
je 0x41cf3c
lea eax, [ebp - 0x10]
push eax
call fcn.0041c7dd
pop ecx
jmp 0x41cf73
lea eax, [ebp - 0x10]
push eax
call fcn.0041c878
jmp 0x41cf39
mov eax, dword [edi]
test eax, eax
je 0x41cf5e
cmp word [eax], dx
je 0x41cf5e
lea eax, [ebp - 0x10]
push eax
call fcn.0041c792
pop ecx
jmp 0x41cf71
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x41d03c
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0041cc7f
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41d03c
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41d03c
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x41d03c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41cfc9
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00417879
test ebx, ebx
je 0x41d037
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00417879
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41d03c
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41d03c
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004204c1
add esp, 0x10
xor eax, eax
inc eax
jmp 0x41d03e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aaf4
leave
ret