joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51101d
Capabilities:
Set current directory

Disassembly:
mov eax, 0x5ea450
call fcn.00594e8c
sub esp, 0x2c
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x10]
call fcn.0040b0ee
and dword [ebp - 4], 0
mov al, byte [0x7c3ea8]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x511098
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.C:Windows_notepad
call fcn.0040e04b
push 0x615e04
push 0x615e0c
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x65a4f0]
call fcn.0051d9ab
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x30]
lea ecx, [ebp - 0x10]
call fcn.0040b132
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040b121
jmp 0x5110e5
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.C:WinNT_notepad
call fcn.0040e04b
push str.Editor
push 0x615e34
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [0x65a4f0]
call fcn.0051d9ab
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x38]
lea ecx, [ebp - 0x10]
call fcn.0040b132
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.0040b121
mov ecx, dword [0x68385c]
add ecx, 0x80bbc
call fcn.00517034
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
push 0
push str.LastErrors.txt
push 0x64
lea ecx, [ebp - 0x10]
call fcn.0041d7d9
push eax
push 0x64
lea ecx, [ebp - 0x10]
call fcn.0041d7d9
push eax
push 1
call fcn.00596268
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040b121
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x5113a0
Capabilities:
Create thread

Disassembly:
mov eax, 0x5ea496
call fcn.00594e8c
sub esp, 0x10
mov dword [ebp - 0x18], ecx
and dword [ebp - 4], 0
push 0x2c
call fcn.005b955b
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5113d2
mov ecx, dword [ebp - 0x14]
call fcn.0051515e
mov dword [ebp - 0x1c], eax
jmp 0x5113d6
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
call fcn.0046ed34
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0040b132
push 0x615e63
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0040b14b
mov eax, dword [ebp - 0x10]
mov byte [eax + 8], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x10], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x18], 0
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0xc35fc]
test eax, eax
je 0x511440
mov ecx, dword [ebp - 0x18]
add ecx, 0xc35ec
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc35ec]
call dword [eax + 0x4c]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x11cd0c], 0
jne 0x51145b
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x6834d4]
mov dword [eax + 0x11dda0], ecx
and dword [0x6834d4], 0
push 0
push 0
push dword [ebp - 0x10]
push 0x4dda1d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040b121
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x51149b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x11f030], 2
jne 0x5114b5
jmp 0x5115aa
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
mov byte [ebp - 9], al
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
movzx eax, byte [eax + 0x682aec]
test eax, eax
je 0x5114fa
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
mov eax, dword [eax + 0x682af0]
cmp eax, dword [ebp + 0xc]
je 0x5114fa
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
mov byte [eax + 0x682aea], 1
jmp 0x5115aa
fld qword [0x5f0c90]
fld qword [ebp + 0x10]
fucompp
fnstsw ax
test ah, 0x44
jp 0x511528
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
cmp dword [eax + 0x682ad8], 0
je 0x511528
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
mov byte [eax + 0x682aea], 1
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x682af0], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
fild dword [ecx + eax*4 + 0xc3b48]
fst qword [ebp - 8]
fmul qword [ebp + 0x10]
fst qword [ebp - 8]
call fcn.00595bd0
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x60
mov dword [ecx + 0x682adc], eax
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + ecx*4 + 0xc3b60]
mov dword [eax + 0x682ae4], ecx
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + ecx*4 + 0xc3b48]
mov dword [eax + 0x682ae0], ecx
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
mov byte [eax + 0x682aea], 0
mov eax, dword [ebp + 8]
imul eax, eax, 0x60
mov byte [eax + 0x682aec], 1
leave
ret 0x10

Function at 0x514fb5
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
leave
ret

Function at 0x515149
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
leave
ret
Function at 0x5368ab
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
cmp dword [eax + 0x214], 0
jne 0x53691f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x53691f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x53691f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
add eax, 0x30
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
add eax, 8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov eax, dword [eax + 0x21c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x268]
mov ecx, dword [ecx + 0x21c]
mov eax, dword [eax]
call dword [eax + 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x54]
jne 0x536937
xor eax, eax
jmp 0x536a29
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00536074
test eax, eax
je 0x53694f
xor eax, eax
inc eax
jmp 0x536a29
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x54]
jne 0x536967
xor eax, eax
jmp 0x536a29
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x54]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call dword [eax + 0x144]
test eax, eax
jne 0x5369a8
push 2
pop eax
jmp 0x536a29
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x50]
jge 0x5369ca
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x38]
jge 0x536a08
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call dword [eax + 0x148]
test eax, eax
jne 0x536a08
push 2
pop eax
jmp 0x536a29
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x54], ecx
mov ecx, dword [ebp - 4]
call fcn.00535197
mov ecx, dword [ebp - 4]
call fcn.0053547b
xor eax, eax
leave
ret 4
Function at 0x536e63
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
cmp dword [eax + 0x214], 0
jne 0x536ed7
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x536ed7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x536ed7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
add eax, 0x30
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
add eax, 8
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov eax, dword [eax + 0x21c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x268]
mov ecx, dword [ecx + 0x21c]
mov eax, dword [eax]
call dword [eax + 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x24]
jne 0x536eef
xor eax, eax
jmp 0x53703b
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.005362af
test eax, eax
je 0x536f07
xor eax, eax
inc eax
jmp 0x53703b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x24]
jne 0x536f1f
xor eax, eax
jmp 0x53703b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x54]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x54]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov eax, dword [eax + 0x20c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x268]
mov ecx, dword [ecx + 0x20c]
mov eax, dword [eax]
call dword [eax + 0x84]
cmp eax, 1
je 0x536f79
push 2
pop eax
jmp 0x53703b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x54]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x54]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call dword [eax + 0x144]
test eax, eax
jne 0x536fba
push 2
pop eax
jmp 0x53703b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x20]
jge 0x536fdc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x10]
jge 0x53701a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x38]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call dword [eax + 0x148]
test eax, eax
jne 0x53701a
push 2
pop eax
jmp 0x53703b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp - 4]
call fcn.005352f9
mov ecx, dword [ebp - 4]
call fcn.0053547b
xor eax, eax
leave
ret 4
Function at 0x5370e3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x24]
jne 0x537174
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x54]
jne 0x537174
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x53716d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
cmp dword [eax + 0x188], 0
jle 0x53716d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x218]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov eax, dword [eax + 0x21c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x268]
mov ecx, dword [ecx + 0x21c]
mov eax, dword [eax]
call dword [eax + 0xc]
mov ecx, dword [ebp - 4]
call fcn.0053b3e3
xor eax, eax
jmp 0x5372d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
cmp dword [eax + 0x1bc], 0
je 0x537196
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00537984
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov eax, dword [eax + 0x20c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x268]
mov ecx, dword [ecx + 0x20c]
mov eax, dword [eax]
call dword [eax + 0x84]
cmp eax, 1
je 0x5371e7
push 2
pop eax
jmp 0x5372d0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call dword [eax + 0x144]
test eax, eax
jne 0x53721f
push 2
pop eax
jmp 0x5372d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x20]
jge 0x537263
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x10]
jl 0x537263
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x50]
jge 0x537263
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x38]
jge 0x537298
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call dword [eax + 0x148]
test eax, eax
jne 0x537298
push 2
pop eax
jmp 0x5372d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x24], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x54], ecx
mov ecx, dword [ebp - 4]
call fcn.005352f9
mov ecx, dword [ebp - 4]
call fcn.00535197
mov ecx, dword [ebp - 4]
call fcn.0053547b
xor eax, eax
leave
ret 8
Function at 0x53ba08
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0053f5db
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp + 8]
call fcn.0040b164
inc eax
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call fcn.00517034
push eax
push dword [ebp - 0x10]
call fcn.00596170
pop ecx
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 4], 0
je 0x53ba79
push dword [ebp - 0xc]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
leave
ret 4

Function at 0x53ba85
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0053f5db
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x53baac
xor eax, eax
inc eax
jmp 0x53bae0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
call fcn.0040b14b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
leave
ret 4
Function at 0x5586a8
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x5ec98f
call fcn.00594e8c
push ecx
push ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00542c50
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x61c148
push 0xa
mov ecx, dword [ebp - 0x14]
add ecx, 0x68
call fcn.0055a616
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x84], 1
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x88], 0x20
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x89], 0x2e
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x8a], 0x2c
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x8b], 0x3a
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x8c], 0x2f
mov eax, dword [ebp - 0x14]
and dword [eax + 0x90], 0
mov eax, dword [ebp - 0x14]
and dword [eax + 0x94], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x98], 1
push 0
mov eax, dword [ebp - 0x14]
add eax, 0x89
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x558777
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, 0x89
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
mov eax, dword [ebp - 0x14]
add eax, 0x8a
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5587b1
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, 0x8a
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
mov eax, dword [ebp - 0x14]
add eax, 0x8b
push eax
push 0x1e
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5587eb
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, 0x8b
push eax
push 0x1e
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
mov eax, dword [ebp - 0x14]
add eax, 0x8c
push eax
push 0x1d
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x558825
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, 0x8c
push eax
push 0x1d
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
call fcn.00558aba
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x57be20
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xca
jne 0x57be67
mov eax, dword [ebp + 8]
push eax
call fcn.0057c610
add esp, 4
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x40]
test ecx, ecx
je 0x57be5d
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xcf
mov al, 1
jmp 0x57bf7d
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xcb
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcb
jne 0x57bf3d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x190]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x57bf2c
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x57bea4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
call dword [edx]
add esp, 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x190]
call dword [edx]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x57bec6
xor al, al
jmp 0x57bf7d
cmp dword [ebp - 4], 2
jne 0x57bece
jmp 0x57bf2c
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x57bf27
cmp dword [ebp - 4], 3
je 0x57bee3
cmp dword [ebp - 4], 1
jne 0x57bf27
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
add edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [eax + 4]
cmp eax, dword [edx + 8]
jl 0x57bf27
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
add edx, dword [eax + 0x11c]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [eax + 8], edx
jmp 0x57be8c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x7c]
mov dword [eax + 0x84], edx
jmp 0x57bf71
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x57bf71
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ecx + 0x14], 0x14
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx]
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.0057bf90
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57bf90
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x57bfcb
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x180]
call dword [edx]
add esp, 4
mov eax, dword [ebp + 8]
mov dword [eax + 0x78], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xcc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x180]
movzx edx, byte [ecx + 8]
test edx, edx
je 0x57c090
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x78]
cmp edx, dword [ecx + 0x60]
jae 0x57c05c
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x57c024
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x60]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
call dword [edx]
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp + 8]
add eax, 0x78
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x184]
call dword [eax + 4]
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
cmp ecx, dword [ebp - 4]
jne 0x57c05a
xor al, al
jmp 0x57c0ab
jmp 0x57bfe0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x180]
call dword [edx + 4]
add esp, 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x180]
call dword [edx]
add esp, 4
mov eax, dword [ebp + 8]
mov dword [eax + 0x78], 0
jmp 0x57bfcb
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x41]
neg ecx
sbb ecx, ecx
neg ecx
add ecx, 0xcd
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret